
Security Fundamentals
Obfuscation 101: Unmasking the Tricks Behind Malicious Code
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
@jup-ag/dca-sdk
Advanced tools
This SDK is an abstraction to interact with Jup's DCA Program.
npm i @jup-ag/dca-sdk
import { CloseDCAParams, CreateDCAParamsV2, DCA, DepositParams, WithdrawParams, Network } from 'jup-dca-sdk';
import { Connection, Keypair, PublicKey, sendAndConfirmTransaction } from '@solana/web3.js';
import dotenv from 'dotenv';
dotenv.config();
const connection = new Connection('https://api.devnet.solana.com');
const dca = new DCA(connection, Network.DEVNET);
const user = Keypair.fromSecretKey(new Uint8Array(JSON.parse(process.env.USER_PRIVATE_KEY)));
const USDC_DEVNET = new PublicKey('Gh9ZwEmdLJ8DscKNTkTqPbNwLNNBjuSzaG9Vp2KGtKJr');
const RANDOM_TOKEN = new PublicKey('EJwZgeZrdC8TXTQbQBoL6bfuAnFUUy1PVCMB4DYPzVaS');
async function createDCA() {
const params: CreateDCAParamsV2 = {
payer: payer.publicKey, // this is the payer of the tx aka opening on behalf. this can be user as well ie user.publicKey
user: user.publicKey,
inAmount: BigInt(5_000_000),
inAmountPerCycle: BigInt(1_000_000),
cycleSecondsApart: BigInt(86400),
inputMint: USDC_DEVNET,
outputMint: RANDOM_TOKEN,
minOutAmountPerCycle: null,
maxOutAmountPerCycle: null,
startAt: null,
userInTokenAccount, // optional: Public key of user's input_mint token account. if the user's input_mint token account is an associated token account, feel free to leave this out. if it's not an ATA, then make sure to pass it in.
};
const { tx, dcaPubKey } = await dca.createDcaV2(params);
const txid = await sendAndConfirmTransaction(connection, tx, [user, payer]);
console.log('Create DCA: ', { txid });
return dcaPubKey;
}
/*
This is for withdrawing from your DCA account.
By default, output tokens are sent to you account automatically.
Withdraw is useful if you want to partially withdraw the input token but would still like to continue the DCA.
Or if for some reason, the output token was not sent to you automatically, you can use this instruction to withdraw them at anytime.
If you want to stop the DCA completely, use `closeDCA` instead (see below).
*/
async function withdraw(dcaPubKey) {
// it's possible to withdraw in-tokens only or out-tokens only or both in and out tokens together. See WithdrawParams for more details
const params: WithdrawParams = {
user: user.publicKey,
dca: dcaPubKey,
inputMint: USDC_DEVNET,
withdrawInAmount: BigInt(1_000_000),
};
const { tx } = await dca.withdraw(params);
const txid = await sendAndConfirmTransaction(connection, tx, [user]);
console.log('Withdraw: ', { txid });
}
async function closeDCA(dcaPubKey) {
const params: CloseDCAParams = {
user: user.publicKey,
dca: dcaPubKey,
};
const { tx } = await dca.closeDCA(params);
const txid = await sendAndConfirmTransaction(connection, tx, [user]);
console.log('Close DCA: ', { txid });
}
async function main() {
const dcaPubKey = await createDCA();
console.log('DCA Pub Key: ', { dcaPubKey });
const dcaAccount = await dca.fetchDCA(dcaPubKey);
console.log('DCA Account Data: ', { dcaAccount });
const dcaAccounts = await dca.getCurrentByUser(user.publicKey);
console.log({ dcaAccounts });
await dca.getBalancesByAccount(dcaPubKey);
await withdraw(dcaPubKey);
await closeDCA(dcaPubKey);
}
main();
getAllByUser
to getCurrentByUser
. This method name reflects more accurately the return value of the method -> returns all active DCA accounts (not closed)getClosedByUser
. This method returns DCA Accounts that are already closed and not returned by getCurrentByUser
.
getClosedByUser
returns different values from getCurrentByUser
because it is no longer on the blockchain. E.g.:
[
{
createdAt: <BN: 64820460>,
updatedAt: <BN: 6487378a>,
userKey: [PublicKey [PublicKey(EKnD4oLXP3B2uDigQiUmQHEBX6fBt33kJBWjQRmVgpXB)]],
dcaKey: [PublicKey [PublicKey(Dtkhyuhv5X3nPtU47JSTh4PRQLo5vuUYdHz6vtvX6b1a)]],
inputMint: [PublicKey [PublicKey(EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v)]],
outputMint: [PublicKey [PublicKey(So11111111111111111111111111111111111111112)]],
inDeposited: <BN: 989680>,
inAmountPerCycle: <BN: 1e8480>,
cycleFrequency: <BN: 3c>
},
{
createdAt: <BN: 64873dbb>,
updatedAt: <BN: 64873ef2>,
userKey: [PublicKey [PublicKey(EKnD4oLXP3B2uDigQiUmQHEBX6fBt33kJBWjQRmVgpXB)]],
dcaKey: [PublicKey [PublicKey(AK7fnjQW3XPcy13NjcAp1mbUCezUTkSvxcabYvj83HiL)]],
inputMint: [PublicKey [PublicKey(EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v)]],
outputMint: [PublicKey [PublicKey(So11111111111111111111111111111111111111112)]],
inDeposited: <BN: 989680>,
inAmountPerCycle: <BN: 1e8480>,
cycleFrequency: <BN: 3c>
}
]
getFillHistory
e.g. getFillHistory(closedDcaAccounts[0].publicKey)
trackDca
. Not meant to be used directly. This automatically gets called when creating a new DCA account so that our tracker keeps a off chain record of the DCA Account data and maintain its data even after the dca account has been deleted on-chainFAQs
This SDK is an abstraction to interact with Jup's DCA Program.
We found that @jup-ag/dca-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
Attackers use obfuscation to hide malware in open source packages. Learn how to spot these techniques across npm, PyPI, Maven, and more.
Security News
Join Socket for exclusive networking events, rooftop gatherings, and one-on-one meetings during BSidesSF and RSA 2025 in San Francisco.
Security News
Biome's v2.0 beta introduces custom plugins, domain-specific linting, and type-aware rules while laying groundwork for HTML support and embedded language features in 2025.