
Security News
Socket Security Analysis Is Now One Click Away on npm
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.
@iexec/poco
Advanced tools
[](https://codecov.io/github/iExecBlockchainComputing/PoCo)
This repository contains the smart contract implementation of iExec's PoCo protocol.
Starting from version 5, the PoCo uses a modular design based on ERC1538. The migration scripts and tests will use different modules and deployment process depending on the required configuration. In particular, the configuration can use a create2 factory for the deployment, and enable native token or ERC20 token based escrow depending on the targeted blockchain. This means that the codebase is the same on public blockchains (ERC20 based RLC) and dedicated sidechains (Native token based RLC).
The configuration file is located in ./config/config.json.
It contains:
createCategory function.bytes32(0) will be used by default.If you want to deploy the iExec PoCo V5 smart contracts on a new blockchain, the recommended process is to:
./config/config.json file as follows:"asset": "Token", provide the address of the token you want to use;"v3" resources to Null;Environment variable can be used to alter the configuration of a deployment:
SALT envvar will overwrite the salt parameter from the config. This can be useful to distinguish different deployments without modifying the config.Additionally, the migration process will look for some smart contracts before deploying new instances. This is true of the application, dataset and workerpool registries. Thus, if different marketplaces are deployed to the same network, they will share these registries.
The PoCo smart contracts are in the ./contracts folder. Json artifacts, containing the contracts bytecode and ABI can be found in the ./build folder. In case you need to regenerate them, you can use the following command:
npm install
npm run build
PoCo smart contracts come with a test suite in the ./test folder. You can startup a sandbox blockchain and run the tests using the following command:
npm install
npm run autotest
Additionally, you can produce a coverage report using the following command:
npm run coverage
The automatic testing command uses the Hardhat network by default to run the tests.
Start a blockchain
npx hardhat node [<any additional arguments>]
[Optional] Update the configuration
If your blockchain listen to a port that is not 8545, or if the blockchain is on a different node, update the hardhat.config.ts configuration (network ports, accounts with mnemonic, ..) accordingly to the Hardhat Configuration documentation.
Run tests
npm run test
You can deploy the smart contracts according to the deploy/0_deploy.ts content. This will automatically save some addresses of the deployed artifacts to the ./build folder.
To do so:
hardhat.config.ts configuration file;npx hardhat deploy --network <your network name>
Example of "complex" deployment:
SALT=0x0000000000000000000000000000000000000000000000000000000000000001 npx hardhat deploy --network hardhat
Format a specific file or files in a directory:
npm run format <filePath|folderPath>
To render all UML diagrams:
npm run uml
npm run sol-to-uml
npm run puml-to-links
npm run storage-to-diagrams
FAQs
iExec Proof of Contribution protocol smart contracts
The npm package @iexec/poco receives a total of 60 weekly downloads. As such, @iexec/poco popularity was classified as not popular.
We found that @iexec/poco demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.