Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@metamask/swaps-controller
Advanced tools
Collection of platform-agnostic modules for creating secure data models for cryptocurrency wallets
@metamask/controllers
A collection of platform-agnostic modules for creating secure data models for cryptocurrency wallets.
First, install the package.
yarn add @metamask/controllers
Then, compose stores to create a data model.
import {
ComposableController,
NetworkController,
TokenRatesController,
} from '@metamask/controllers';
const datamodel = new ComposableController([
new NetworkController(),
new TokenRatesController()
]);
datamodel.subscribe((state) => {/* data model has changed */});
@metamask/controllers
consists of a collection of controller modules that each expose uniform APIs for common operations like configuration, state management, and subscription.
import AccountTrackerController from '@metamask/controllers';
The AccountTrackerController tracks information associated with specific Ethereum accounts.
import AddressBookController from '@metamask/controllers';
The AddressBookController exposes functions for managing a list of recipient addresses and associated nicknames.
import ComposableController from '@metamask/controllers';
The ComposableController can be used to compose multiple controllers together into a single controller.
import CurrencyRateController from '@metamask/controllers';
The CurrencyRateController passively polls for an ETH-to-fiat exchange rate based on a chosen currency.
import KeyringController from '@metamask/controllers';
The KeyringController is responsible for establishing and managing Ethereum address-based identities.
import NetworkController from '@metamask/controllers';
The NetworkController is responsible for creating an underlying provider and for refreshing its configuration.
import PhishingController from '@metamask/controllers';
The PhishingController passively polls for community-maintained lists of approved and unapproved website origins.
import PreferencesController from '@metamask/controllers';
The PreferencesController manages agnostic global settings and exposes convenience methods for updating them.
import TokenRatesController from '@metamask/controllers';
The TokenRatesController passively polls on a set interval for token-to-fiat exchange rates.
import TransactionController from '@metamask/controllers';
The TransactionController is responsible for submitting and managing transactions.
import util from '@metamask/controllers';
The util module exposes a set of utility functions for common operations like gas estimation and generating crypto-buying URLs.
Using controllers should be straightforward since each controller exposes the same minimal API. The concepts detailed in this section form the entirety of the core API: knowing these concepts will allow you to fully use @metamask/controllers
to build wallet data models.
Each controller can be initialized with an optional initial configuration argument and an optional initial state argument:
const controller = new Controller(<initial_config>, <initial_state>)
Data passed into a controller as initial state will be merged with that controller's default state; likewise, options passed into a controller as initial configuration will be merged with that controller's default configuration.
As mentioned in the initialization section, a controller can be configured during initialization by passing in a configuration object as its first argument:
const controller = new Controller(<initial_config>, <initial_state>)
A controller can also be configured (or reconfigured) after initialization by passing a configuration object to its configure
method:
const controller = new Controller()
controller.configure({ foo: 'bar', baz: 'qux' });
Regardless of how a controller is configured, whether it's during or after initialization, configuration options can always be accessed on a controller as instance variables for convenience:
const controller = new Controller()
controller.configure({ foo: 'bar', baz: 'qux' });
console.log(controller.foo, controller.baz); // "bar qux"
The core purpose of every controller is to maintain an internal data object called "state". Modules are like data stores: their internal state data can be updated directly by modifying the data itself or indirectly by calling API methods that in turn modify the data.
A controller's state can be directly modified by calling its update
method and passing in a new data object. By default, this data object will be merged with the controller's existing internal state; however, if the data object should overwrite the controller's internal state, a second argument of true
can be passed to the update
method:
const controller = new Controller();
controller.update({ foo: 'bar' }); // merge with existing state
controller.update({ foo: 'bar' }, true); // overwrite existing state
A controller's state can be indirectly modified by calling any state-modifying API methods it may expose. For example, the AddressBookController exposes a set
method that accepts a new address to save and an associated nickname; calling this method will internally update its state.addressBook
array.
A controller's state can always be accessed by referencing the state
instance variable for convenience:
const controller = new Controller();
console.log(controller.state); // { ... }
Since each controller maintains an internal state object, there should be a way to add listeners to be notified when state data changes. controllers expose two methods for subscription management, subscribe
and unsubscribe
.
Change handlers can be registered with a controller by passing a function to its subscribe
method. This function will be called anytime the controller's underlying state changes and will be passed the current state as its only function argument:
function onChange(state) { /* state data changed */ }
const controller = new Controller();
controller.subscribe(onChange);
Change handlers can be removed from a controller by passing a function to its unsubscribe
method. Any function passed to unsubscribe
will be removed from the internal list of handlers and will no longer be called when state data changes:
function onChange(state) { /* state data changed */ }
const controller = new Controller();
controller.subscribe(onChange);
// ...
controller.unsubscribe(onChange);
Because each controller maintains its own state and subscriptions, it would be tedious to initialize and subscribe to every available controller independently. To solve this issue, the ComposableController can be used to compose multiple controllers into a single controller.
The ComposableController is initialized by passing an array of controller instances:
import {
ComposableController,
NetworkController,
TokenRatesController
} from '@metamask/controllers';
const datamodel = new ComposableController([
new NetworkController(),
new TokenRatesController()
]);
The resulting composed controller exposes the same APIs as every other controller for configuration, state management, and subscription:
datamodel.subscribe((state) => { /* some child state has changed */ });
The internal state maintained by a ComposableController will be keyed by child controller class name. It's also possible to access the flatState
instance variable that is a convenience accessor for merged child state:
console.log(datamodel.state); // {NetworkController: {...}, TokenRatesController: {...}}
console.log(datamodel.flatState); // {infura: {...}, contractExchangeRates: [...]}
Advanced Note: The ComposableController builds a map of all child controllers keyed by controller name. This object is cached as a context
instance variable on both the ComposableController itself as well as all child controllers. This means that child controllers can call methods on other sibling controllers through the context
variable, e.g. this.context.SomeController.someMethod()
.
Linking @metamask/controllers
into other projects involves a special NPM command to ensure that dependencies are not duplicated. This is because @metamask/controllers
ships modules that are transpiled but not bundled, and NPM does not deduplicate linked dependency trees.
First, link @metamask/controllers
.
$ yarn build:link
# or
$ npm run build:link
Then, link into other projects.
$ yarn link @metamask/controllers
# or
$ npm link @metamask/controllers
The project follows the same release process as the other libraries in the MetaMask organization:
master
1.x
)yarn version --minor --no-git-tag-version
)API documentation is auto-generated for the @metamask/controllers
package on every commit to the master
branch.
FAQs
MetaMask Swaps controller module
The npm package @metamask/swaps-controller receives a total of 3,524 weekly downloads. As such, @metamask/swaps-controller popularity was classified as popular.
We found that @metamask/swaps-controller demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 10 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.