Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@ledgerhq/coin-evm
Advanced tools
How to integrate a new EVM family currency in the Ledger Live application.
This document will outline the different steps needed to implement a new EVM family currency in the Ledger Live application. Depending on the specifications, some steps might not be needed for all currencies.
Most EVM coin integrations are quite similar. The main specs will be outlined below. But each coin may have its specificities and more information can be found on the specific coin integration Jira Epic created for each integration, based on this template https://ledgerhq.atlassian.net/browse/LIVE-10187
Here is an example PR of an EVM currency integration: https://github.com/LedgerHQ/ledger-live/pull/4008
Common steps for all new EVM currency integration
libs/ledgerjs/packages/cryptoassets/src/currencies.ts
CryptoCurrencyId
type under libs/ledgerjs/packages/types-cryptoassets/src/index.ts
abandonSeedAddresses
(using the currency ID as key and EVM_DEAD_ADDRESS
as value) under libs/ledgerjs/packages/cryptoassets/src/abandonseed.ts
setSupportedCurrencies
function param on each relevant project (CLI, LLD, LLM and LLC test environement)CurrencyFeatures
type under libs/ledgerjs/packages/types-live/src/feature.ts
CURRENCY_DEFAULT_FEATURES
mapping under libs/ledger-live-common/src/featureFlags/defaultFeatures.ts
pnpm doc
under libs/ledgerjs/packages/types-live
to update the docpnpm test:jest
under apps/ledger-live-desktop
to update the snapshotslibs/ui/packages/crypto-icons/src/svg
folder within the @ledgerhq/icons-ui package
{currency_id}.svg
naming conventionOptional / extra steps that might be needed on a case-by-case basis depending on the integration
libs/coin-evm/src/api/explorer
foldergetExplorerApi
function under libs/coin-evm/src/api/explorer/index.ts
EthereumLikeInfo.explorer.type
type under libs/ledgerjs/packages/types-cryptoassets/src/index.ts
isEtherscanLikeExplorerConfig
type guard under libs/ledgerjs/packages/types-cryptoassets/src/index.ts
(this is the case for some custom made explorers that are not blockscan white label implementation, but are still compatible with the blockscan/etherscan API)Here are the steps to handle the new currencies (ERC20) tokens, if relevant:
{chainId}
with the actual currency chain ID, specified under ethereumLikeInfo.chainId
in the currency config (under libs/ledgerjs/packages/cryptoassets/src/currencies.ts) which would be 1
for ethereum mainnet for example, using https://cdn.live.ledger.com/cryptoassets/evm/{chainId}/erc20.jsonNo change should be needed on Ledger Live side since tokens are automatically imported from CAL at the release stage, cf:
.github/workflows/test-release-create.yml
import:cal-tokens
job in the ledger-js
packageTo have the associated market (fiat) price supported for the network being added, some config updates are needed on the CAL
and countervalue service
sides.
The process for this can be found here: https://ledgerhq.atlassian.net/wiki/spaces/WALLETCO/pages/4354769042/Adding+price+support+for+a+currency
The new network being added needs to be handled by the nano ethereum app.
Make sure the network being added is present under the network_info_t
mapping in src_common/network.c
(here for staging and here for prod).
In Ledger Live, make sure the ethereum nano app version requirements match the latest version of the ethereum app handling the network being added:
appVersion
in getAppQuery
under libs/coin-evm/src/specs.ts
Ethereum
in appVersionsRequired
under libs/ledger-live-common/src/apps/support.ts
libs/ledger-live-common/src/apps/support.test.ts
minBalancePerCurrencyId
under libs/coin-evm/src/specs.ts
The bare minimum to test in terms of flows is, on both LLD and LLM:
Make sure to add the newly created currency feature flag to the Firebase config
FAQs
Ledger EVM Coin integration
We found that @ledgerhq/coin-evm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.