
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
@iexec/poco
Advanced tools
This repository contains the smart contract implementation of iExec's Proof of Contribution protocol.
All contract audit files can be found in audits/ folder.
abis/ folder of this repository and in the NPM package (/abis).deployments/ folder of this repository and in the NPM package (/deployments/<chain>).abis. This will be removed in future versions.Note: abis/ folder contains the most up to date version of the ABIs even before deployment on live networks.
Starting from version 5, the PoCo uses a modular design based on ERC-2535. Tests and deployment scripts will use different modules (facets) and deployment process depending on the required configuration. In particular, the configuration can use a create2 factory for the deployment, and enable native token or ERC20 token based escrow depending on the targeted blockchain. This means that the codebase is the same on public blockchains (ERC20 based RLC) and dedicated sidechains (Native token based RLC).
The configuration file is located in ./config/config.json.
It contains:
createCategory function.bytes32(0) will be used by default.If you want to deploy the iExec PoCo V5 smart contracts on a new blockchain, the recommended process is to:
./config/config.json file as follows:"asset": "Token", provide the address of the token you want to use;"v3" resources to Null;Environment variable can be used to alter the configuration of a deployment:
SALT env var will overwrite the salt parameter from the config. This can be useful to distinguish different deployments without modifying the config.Additionally, the migration process will look for some smart contracts before deploying new instances. This is true of the application, dataset and workerpool registries. Thus, if different marketplaces are deployed to the same network, they will share these registries.
This project uses trunk-based development workflow with automatic release management. It means that:
The PoCo smart contracts are in the contracts/ folder. Json artifacts, containing the contracts bytecode and ABI can be found in the artifacts/ folder. In case you need to regenerate them, you can use the following command:
npm install
npm run build
PoCo smart contracts come with a test suite in the ./test folder. You can startup a sandbox blockchain and run the tests using the following command:
npm install
npm run test
Additionally, you can produce a coverage report using the following command:
npm run coverage
The automatic testing command uses the Hardhat network by default to run the tests.
Start a blockchain
npx hardhat node [<any additional arguments>]
[Optional] Update the configuration
If your blockchain listen to a port that is not 8545, or if the blockchain is on a different node, update the hardhat.config.ts configuration (network ports, accounts with mnemonic, ..) accordingly to the Hardhat Configuration documentation.
Run tests
npm run test -- --network <networkUrl>
The iExec PoCo contracts support automated deployment through both command-line interface and GitHub Actions workflows.
You can deploy the smart contracts according to the deploy/0_deploy.ts content. This will automatically save addresses of the deployed artifacts to deployments/ folder.
To deploy using the CLI:
hardhat.config.tsnpm run deploy -- --network <your network name>
Example with custom salt:
SALT=0x0000000000000000000000000000000000000000000000000000000000000001 npx hardhat deploy --network hardhat
To verify contracts:
npm run verify:all -- --network <your network name> # e.g. arbitrum
This script automatically reads all deployed contract addresses and their constructor arguments from the deployment artifacts and verifies them on the relevant block explorer.
Format a specific file or files in a directory:
npm run format <filePath|folderPath>
To render all UML diagrams:
npm run uml
To render only class diagrams:
npm run sol-to-uml
To render only .puml files:
npm run puml-to-links
To render only storage diagrams:
npm run storage-to-diagrams
FAQs
iExec Proof of Contribution protocol smart contracts
The npm package @iexec/poco receives a total of 202 weekly downloads. As such, @iexec/poco popularity was classified as not popular.
We found that @iexec/poco demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.