
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@looksrare/contracts-libs
Advanced tools
This repository contains a set of Solidity contracts that can be used across contracts for purposes such as verifying signatures, protecting contracts against reentrancy attacks, low-level call functions, and a library for managing the ownership of a contract.
It also contains generic contract interfaces (for EIP/ERC) that can be used.
# Yarn
yarn add @looksrare/contracts-libs
# NPM
npm install @looksrare/contracts-libs
The NPM package contains the following:
Name | Description | Type | Latest version | Audited? |
---|---|---|---|---|
OwnableTwoSteps | Contract for managing ownership of a smart contract. The transfer of ownership is done in a 2-step process. | Contract | 2.5.0 | Yes |
SignatureCheckerCalldata | Contract for verifying the validity of a (calldata) signature for EOA (64-byte, 65-byte signatures) and EIP-1271. | Contract | 3.0.0 | Yes |
SignatureCheckerMemory | Contract for verifying the validity of a (memory) signature for EOA (64-byte, 65-byte signatures) and EIP-1271. | Contract | 3.0.0 | Yes |
ReentrancyGuard | Contract with a modifier to prevent reentrancy calls. | Contract | 2.4.4 | Yes |
PackedReentrancyGuard | Contract with a modifier to prevent reentrancy calls. Adapted from ReentrancyGuard. | Contract | 2.5.1 | Yes |
LowLevelETHTransfer | Low-level call function to transfer ETH | Contract | 2.4.4 | Yes |
LowLevelETHReturnETHIfAny | Low-level call function to return all ETH left | Contract | 2.4.4 | Yes |
LowLevelETHReturnETHIfAnyExceptOneWei | Low-level call function to return all ETH left except one wei | Contract | 2.4.4 | Yes |
LowLevelWETH | Low-level call functions to transfer ETH with an option to wrap to WETH if the original ETH transfer fails within a gas limit | Contract | 2.4.4 | Yes |
LowLevelERC20Approve | Low-level call functions for ERC20 approve functions | Contract | 2.4.4 | Yes |
LowLevelERC20Transfer | Low-level call functions for ERC20 transfer functions | Contract | 2.4.4 | Yes |
LowLevelERC721Transfer | Low-level call functions for ERC721 functions | Contract | 2.4.4 | Yes |
LowLevelERC1155Transfer | Low-level call functions for ERC1155 functions | Contract | 2.4.4 | Yes |
ProtocolFee | Contract for defining protocol fee recipient and basis points | Contract | 3.2.0 | No |
It is a hybrid Hardhat repo that also requires Foundry to run Solidity tests powered by the ds-test library.
To install Foundry, please follow the instructions here.
foundry
folder in the test
folder.forge build
forge test
forge test -vv
forge tree
npx eslint '**/*.{js,ts}'
npx eslint '**/*.{js,ts}' --fix
npx prettier '**/*.{json,sol,md}' --check
npx prettier '**/*.{json,sol,md}' --write
npx solhint 'contracts/**/*.sol'
npx solhint 'contracts/**/*.sol' --fix
It is required to install lcov.
brew install lcov
To run the coverage report, the below command can be executed.
forge coverage --report lcov
LCOV_EXCLUDE=("test/*" "contracts/interfaces/*" "contracts/errors/*.sol")
echo $LCOV_EXCLUDE | xargs lcov --output-file lcov-filtered.info --remove lcov.info
genhtml lcov-filtered.info --output-directory out
open out/index.html
FAQs
LooksRare contract helper libraries
The npm package @looksrare/contracts-libs receives a total of 25 weekly downloads. As such, @looksrare/contracts-libs popularity was classified as not popular.
We found that @looksrare/contracts-libs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.