Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@oceanprotocol/keeper-contracts
Advanced tools
💧 Integration of TCRs, CPM and Ocean Tokens in Solidity oceanprotocol.com
Dockerhub | TravisCI | Ascribe | Greenkeeper |
---|---|---|---|
🐲🦑 THERE BE DRAGONS AND SQUIDS. This is in alpha state and you can expect running into problems. If you run into them, please open up a new issue. 🦑🐲
Ocean Keeper implementation where we put the following modules together:
For local developmenty you can either use Docker, or setup the development environment on your machine.
The most simple way to get started is with Docker:
git clone git@github.com:oceanprotocol/keeper-contracts.git
cd keeper-contracts/
docker build -t oceanprotocol/keeper-contracts:0.1 .
docker run -d -p 8545:8545 oceanprotocol/keeper-contracts:0.1
or simply pull it from docker hub:
docker pull oceanprotocol/keeper-contracts
docker run -d -p 8545:8545 oceanprotocol/keeper-contracts
Which will expose the Ethereum RPC client with all contracts loaded under localhost:8545, which you can add to your truffle.js
:
module.exports = {
networks: {
development: {
host: 'localhost',
port: 8545,
network_id: '*',
gas: 6000000
},
}
}
As a pre-requisite, you need:
Clone the project and install all dependencies:
git clone git@github.com:oceanprotocol/keeper-contracts.git
cd keeper-contracts/
# install dependencies
npm i
# install RPC client globally
npm install -g ganache-cli
Compile the solidity contracts:
npm run compile
In a new terminal, launch an Ethereum RPC client, e.g. ganache-cli:
ganache-cli
Switch back to your other terminal and deploy the contracts:
npm run migrate
# for redeployment run this instead
npm run migrate -- --reset
Follow the steps for local deployment. Make sure that the address 0x2c0d5f47374b130ee398f4c34dbe8168824a8616 is having enough (~1) Ether.
If you managed to deploy the contracts locally do:
export INFURA_TOKEN=<your infura token>
export KOVAN_NMEMORIC=<your kovan nmemoric>
npm run migrate:kovan
The transaction should show up on: https://kovan.etherscan.io/address/0x2c0d5f47374b130ee398f4c34dbe8168824a8616
The contract addresses deployed on Kovan testnet:
Contract | Address |
---|---|
OceanAuth | 0xfA65f2662224Dd340a2dea0972E70BA450E94e3C |
OceanDispute | 0x6071e51DB7a3CCc81e0ae1D05908c6F958a59f5B |
OceanExchange | 0x018F8A880A11f8c7Ec4112D9CA20D9256e7d64CD |
OceanMarket | 0xb8277FC2A46C11235775BEC194BD8C12ed92343C |
OceanRegistry | 0xD9Ca6e9aD36E70A0a2A995a7BDD02017459dD45b |
OceanToken | 0x656f2Ab5D4C4bC2D5821fd959B083fd50273C2f1 |
To facilitate the integration of the Ocean Keeper Smart Contracts, Python and Javascript libraries are ready to be integrated. Those libraries include the Smart Contract ABI's. Using these libraries helps to avoid compiling the Smart Contracts and copying the ABI's manually to your project. In that way the integration is cleaner and easier. The libraries provided currently are:
scripts/maven.sh
scriptRun tests with npm test
, e.g.:
npm test -- test/Auth.Test.js
Linting is setup for JavaScript with ESLint & Solidity with Solium.
Code style is enforced through the CI test process, builds will fail if there're any linting errors.
const Market = artifacts.require('OceanMarket.sol')
...
// get instance of OceanMarket contract
const market = await Market.deployed()
...
// generate resource id
const name = 'resource name'
const resourceId = await market.generateId(name, { from: accounts[0] })
const resourcePrice = 100
// register data asset on-chain
await market.register(resourceId, resourcePrice, { from: accounts[0] })
Here is an example of authorization process with OceanAuth contract.
accounts[0]
is provider and accounts[1]
is consumer.
Note that different cryptographic algorithms can be chosen to encrypt and decrypt access token using key pairs (i.e., public key and private key). This example uses URSA to demonstrate the process for illustration purpose.
const Token = artifacts.require('OceanToken.sol')
const Market = artifacts.require('OceanMarket.sol')
const Auth = artifacts.require('OceanAuth.sol')
...
const ursa = require('ursa')
const ethers = require('ethers')
const Web3 = require('web3')
...
// get instances of deployed contracts
const token = await Token.deployed()
const market = await Market.deployed()
const auth = await Auth.deployed()
...
// consumer request some testing tokens to buy data asset
await market.requestTokens(200, { from: accounts[1] })
// consumers approve withdraw limit of their funds
await token.approve(market.address, 200, { from: accounts[1] })
...
// consumer generates temporary key pairs in local
const modulusBit = 512
const key = ursa.generatePrivateKey(modulusBit, 65537)
const privatePem = ursa.createPrivateKey(key.toPrivatePem())
const publicPem = ursa.createPublicKey(key.toPublicPem())
const publicKey = publicPem.toPublicPem('utf8')
...
// consumer initiate a new access request and pass public key
await auth.initiateAccessRequest(resourceId, accounts[0], publicKey, expireTime, { from: accounts[1] })
// provider commit the access request
await auth.commitAccessRequest(accessId, true, expireTime, '', '', '', '', { from: accounts[0] })
...
// consumer sends the payment to OceanMarket contract
await market.sendPayment(accessId, accounts[0], price, expireTime, { from: accounts[1] })
...
// provider encrypt "JSON Web Token" (JWT) using consumer's temp public key
const encJWT = getPubKeyPem.encrypt('JWT', 'utf8', 'hex')
// provider delivers the encrypted JWT on-chain
await auth.deliverAccessToken(accessId, `0x${encJWT}`, { from: accounts[0] })
...
// consumer generate signature of encrypte JWT and send to provider
const prefix = '0x'
const hexString = Buffer.from(onChainencToken).toString('hex')
const signature = web3.eth.sign(accounts[1], `${prefix}${hexString}`)
...
// provider verify the signature from consumer to prove delivery of access token
const sig = ethers.utils.splitSignature(signature)
const fixedMsg = `\x19Ethereum Signed Message:\n${onChainencToken.length}${onChainencToken}`
const fixedMsgSha = web3.sha3(fixedMsg)
await auth.verifyAccessTokenDelivery(accessId, accounts[1], fixedMsgSha, sig.v, sig.r, sig.s, { from: accounts[0] })
The bumpversion.sh
script helps to bump the project version. You can execute the script using as first argument {major|minor|patch} to bump accordingly the version. Also you can provide the option --tag
to automatically create the version tag.
We use GitHub as a means for maintaining and tracking issues and source code development.
If you would like to contribute, please fork this repository, do work in a feature branch, and finally open a pull request for maintainers to review your changes.
Ocean Protocol uses C4 Standard process to manage changes in the source code. Find here more details about Ocean C4 OEP.
This project builds on top of the work done in open source projects:
Copyright 2018 Ocean Protocol Foundation
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
FAQs
Integration of SEAs, DID and OceanToken in Solidity
We found that @oceanprotocol/keeper-contracts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.