Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@mercurial-finance/dynamic-amm-sdk
Advanced tools
Mercurial Vaults SDK is a typescript library that allows you to interact with Mercurial v2's AMM.
NPM: https://www.npmjs.com/package/@mercurial-finance/dynamic-amm-sdk
SDK: https://github.com/mercurial-finance/mercurial-dynamic-amm-sdk
Discord: https://discord.com/channels/841152225564950528/864859354335412224
npm i @mercurial-finance/dynamic-amm-sdk @project-serum/anchor @solana/web3.js @solana/spl-token @solana/spl-token-registry
import AmmImpl, { MAINNET_POOL } from '@mercurial-finance/dynamic-amm-sdk';
import { PublicKey } from '@solana/web3.js';
import { Wallet, AnchorProvider } from '@project-serum/anchor';
// Connection, Wallet, and AnchorProvider to interact with the network
const mainnetConnection = new Connection('https://api.mainnet-beta.solana.com');
const mockWallet = new Wallet(new Keypair());
const provider = new AnchorProvider(mainnetConnection, mockWallet, {
commitment: 'confirmed',
});
// Alternatively, to use Solana Wallet Adapter
const constantProductPool = await AmmImpl.create(connection, MAINNET_POOL.USDC_SOL);
const stablePool = await AmmImpl.create(connection, MAINNET_POOL.USDT_USDC);
// If you need to create multiple, can consider using `createMultiple`
const pools = [MAINNET_POOL.USDC_SOL, MAINNET_POOL.USDT_USDC];
const [constantProductPool, stablePool] = await AmmImpl.createMultiple(connection, pools);
// To refetch the pool's latest supply
// Alternatively, use `AmmImpl.poolState.lpSupply`
const lpSupply = await constantProductPool.getLpSupply();
// Get the user's ATA LP balance
const userLpBalance = await constantProductPool.getUserBalance(mockWallet.publicKey);
await constantProduct.updateState();
const inAmountALamport = new BN(1 * 10 ** constantProductPool.tokenA.decimals); // 1.0 SOL
// Get deposit quote for constant product
const { poolTokenAmountOut, tokenAInAmount, tokenBInAmount } = constantProductPool.getDepositQuote(
inAmountALamport,
new BN(0),
);
const depositTx = await constantProductPool.deposit(
mockWallet.publicKey,
tokenAInAmount,
tokenBInAmount,
poolTokenAmountOut,
); // Web3 Transaction Object
const depositResult = await provider.sendAndConfirm(depositTx); // Transaction hash
const inAmountALamport = new BN(0.1 * 10 ** stablePool.tokenA.decimals);
const { poolTokenAmountOut, tokenAInAmount, tokenBInAmount } = stablePool.getDepositQuote(inAmountALamport, new BN(0));
const depositTx = await stablePool.deposit(mockWallet.publicKey, tokenAInAmount, tokenBInAmount, poolTokenAmountOut); // Web3 Transaction Object
const depositResult = await provider.sendAndConfirm(depositTx); // Transaction hash
const inAmountALamport = new BN(0.1 * 10 ** stablePool.tokenA.decimals);
const inAmountBLamport = new BN(0.1 * 10 ** stablePool.tokenB.decimals);
const { poolTokenAmountOut, tokenAInAmount, tokenBInAmount } = stablePool.getDepositQuote(
inAmountALamport,
inAmountBLamport,
false, // pass in false for imbalance deposit quote
); // Web3 Transaction Object
const depositTx = await stablePool.deposit(mockWallet.publicKey, tokenAInAmount, tokenBInAmount, poolTokenAmountOut);
const depositResult = await provider.sendAndConfirm(depositTx); // Transaction hash
const inAmountALamport = new BN(0.1 * 10 ** stablePool.tokenA.decimals);
const { poolTokenAmountOut, tokenAInAmount, tokenBInAmount } = stablePool.getDepositQuote(
inAmountALamport,
new BN(0),
false, // pass in false for imbalance deposit quote
); // Web3 Transaction Object
const depositTx = await stablePool.deposit(mockWallet.publicKey, tokenAInAmount, tokenBInAmount, poolTokenAmountOut);
const depositResult = await provider.sendAndConfirm(depositTx); // Transaction hash
const outTokenAmountLamport = new BN(0.1 * 10 ** cpPool.decimals);
const { poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount } = cpPool.getWithdrawQuote(outTokenAmountLamport); // use lp balance for full withdrawal
const withdrawTx = await cpPool.withdraw(mockWallet.publicKey, poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount); // Web3 Transaction Object
const withdrawResult = await provider.sendAndConfirm(withdrawTx); // Transaction hash
const outTokenAmountLamport = new BN(0.1 * 10 ** stablePool.decimals);
const { poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount } = stablePool.getWithdrawQuote(outTokenAmountLamport); // use lp balance for full withdrawal
const withdrawTx = await stablePool.withdraw(mockWallet.publicKey, poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount); // Web3 Transaction Object
const withdrawResult = await provider.sendAndConfirm(withdrawTx);
const outTokenAmountLamport = new BN(0.1 * 10 ** stablePool.decimals);
const { poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount } = stablePool.getWithdrawQuote(
outTokenAmountLamport,
new PublicKey(stablePool.tokenA.address), // Pass in token A/B mint to perform imbalance withdraw
);
const withdrawTx = await stablePool.withdraw(mockWallet.publicKey, poolTokenAmountIn, tokenAOutAmount, tokenBOutAmount); // Web3 Transaction Object
const withdrawResult = await provider.sendAndConfirm(withdrawTx);
const inAmountLamport = new BN(0.1 * 10 ** constantProductPool.tokenB.decimals);
// Swap SOL → USDT
const { minSwapOutAmount } = constantProductPool.getSwapQuote(
new PublicKey(constantProductPool.tokenB.address),
inAmountLamport,
);
const swapTx = await constantProductPool.swap(
mockWallet.publicKey,
new PublicKey(constantProductPool.tokenB.address),
inAmountLamport,
minSwapOutAmount,
);
const swapResult = await provider.sendAndConfirm(swapTx);
constantProductPool.updateState();
FAQs
Mercurial Vaults SDK is a typescript library that allows you to interact with Mercurial v2's AMM.
The npm package @mercurial-finance/dynamic-amm-sdk receives a total of 7,823 weekly downloads. As such, @mercurial-finance/dynamic-amm-sdk popularity was classified as popular.
We found that @mercurial-finance/dynamic-amm-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.