Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@openzeppelin/platform-deploy-client
Advanced tools
Client library for managing Platform Deployments
Platform Deployment Client allows you to deploy contracts through the OpenZeppelin Platform, manage deployment configuration and manage block explorer api keys.
npm install @openzeppelin/platform-deploy-client
yarn add @openzeppelin/platform-deploy-client
Start by creating a new Team API Key in Defender, and granting it the capability to manage deployments. Use the newly created API key to initialize an instance of the Deployment client.
You can create instances of the clients using the PlatformClient
helper function which returns an object with the 4 clients DeploymentClient
, DeploymentConfigClient
, UpgradeClient
, and BlockExplorerApiKeyClient
.
const { PlatformClient } = require('@openzeppelin/platform-deploy-client');
const client = PlatformClient({ apiKey: API_KEY, apiSecret: API_SECRET });
Alternatively you can instantiate whichever client you need individually
const { DeploymentClient } = require('@openzeppelin/platform-deploy-client');
const client = new DeploymentClient({ apiKey: API_KEY, apiSecret: API_SECRET });
const { UpgradeClient } = require('@openzeppelin/platform-deploy-client');
const client = new UpgradeClient({ apiKey: API_KEY, apiSecret: API_SECRET });
To deploy a contract you need to provide these required fields:
network
contractName
contractPath
- The path of your contract in your hardhat projectAdditionally you must provide your compilation artifact from hardhat. The compilation artifact can be found in your hardhat project folder at artifacts/build-info/{build-id}.json
. Either one of these fields are required:
artifactPayload
- JSON stringified version of the fileartifactUri
- URI to the hosted artifact fileThere are a number of optional fields depending on what you are deploying, these include:
constructorInputs
- The inputs to your contract constructor,value
- ETH to be sent with the deployment.salt
- deployments are done using the CREATE2 opcode, you can provide a salt or we can generate one for you if none is supplied.licenseType
- This will be displayed on Etherscan e.g MIT.libraries
- If you contract uses any external libraries they will need to be added here in the format { [LibraryName]: LibraryAddress }
.relayerId
- This property will override the default relayer assigned to the approval process for deployments. You may define this property if you wish to use a different relayer than the one assigned to the approval process in the deploy environment.Below is an example of a contract deployment request which responds with a DeploymentResponse
await client.Deployment.deploy({
contractName: 'Greeter',
contractPath: 'contracts/Greeter.sol',
network: 'sepolia',
artifactPayload: JSON.stringify(artifactFile),
licenseType: 'MIT',
constructorInputs: ['Hello World!'],
});
You can also list your deployments, which will return a DeploymentResponse[]
object
await client.Deployment.list();
As well as fetching a deployment via it's ID
const deploymentId = '8181d9e0-88ce-4db0-802a-2b56e2e6a7b1';
await client.Deployment.get(deploymentId);
You can also retrieve the deploy approval process for a given network, which will return a ApprovalProcessResponse
object
await client.Deployment.getApprovalProcess('sepolia');
To upgrade a contract you need to provide these required fields:
proxyAddress
newImplementationAddress
network
There are a number of optional fields, these include:
proxyAdminAddress
- The Proxy Admin address in case you are upgrading with a transparent proxy.newImplementationABI
- The ABI of the new implementation address. This will be required if the implementation contract does not exist in the OpenZeppelin Platform.approvalProcessId
- The approval process ID in case you wish to override the default global approval process.senderAddress
- The address you wish to create the Safe proposal with. When creating an upgrade proposal, we provide you with an external link to the Safe UI. This will lead you to a proposal ready to be signed. This proposal will contain information about what upgrade to execute, as well as who initiated the proposal. The senderAddress
property lets you customise define which address this is.Below is an example of a contract upgrade request which responds with a UpgradeContractResponse
await client.Upgrade.upgrade({
proxyAddress: '0xABC1234...',
proxyAdminAddress: '0xDEF1234...',
newImplementationABI: JSON.stringify(boxABIFile),
newImplementationAddress: '0xABCDEF1....',
network: 'sepolia',
});
You can also retrieve the upgrade approval process for a given network, which will return a ApprovalProcessResponse
object
await client.Upgrade.getApprovalProcess('sepolia');
In order to have your contract source code verified on Etherscan you must provide your Etherscan Api Keys along with the network those keys will belong to. If you want to use the same Api Key for 2 different networks, e.g Ethereum Mainnet and Sepolia Testnet, you must add the Api Key for both networks individually.
await client.BlockExplorerApiKey.create({
key: 'RKI7QAFIZJYAEF45GDSTA9EAEKZFW591D',
network: 'sepolia',
});
You can list your Api Keys, which will return a BlockExplorerApiKeyResponse[]
object
await client.BlockExplorerApiKey.list();
As well as fetching a your Api Key via it's ID
const apiKeyId = '8181d9e0-88ce-4db0-802a-2b56e2e6a7b1';
await client.BlockExplorerApiKey.get(apiKeyId);
And updating the Api Key for a given network
const apiKeyId = '8181d9e0-88ce-4db0-802a-2b56e2e6a7b1';
await client.BlockExplorerApiKey.update(apiKeyId, {
key: 'LDNWOWFNEJ2WEL4WLKNWEF8F2MNWKEF',
});
FAQs
Client library for managing Platform Deployments
The npm package @openzeppelin/platform-deploy-client receives a total of 18,219 weekly downloads. As such, @openzeppelin/platform-deploy-client popularity was classified as popular.
We found that @openzeppelin/platform-deploy-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.