
Security News
Deno 2.6 + Socket: Supply Chain Defense In Your CLI
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.
@phase21/dapi-management
Advanced tools
Tools and contracts that enable running managed dAPIs where most of the data needed to accomplish this is stored on-chain.
In order to be able to make this possible, there needs to be different groups of "data owners" that will provide, review and sign specific sets of data. Other accounts need to provide and sign dAPI prices for different chains and so on.
These signed data sets (Merkle trees) will be stored in JSON files in this repo and can later be used by people with the right roles or permits to use it when calling functions on the contracts datailed below. This repo also provides a frontend app that can be used as interface between the mentioned JSON files and the contracts.
This contract is intended to be used as a generic hash registry. Users of this contract are expected to register hashes that must be previously signed by a group of signer accounts. These signers must sign a hash type, a hash and a timestamp.
The signers list for a hash type is managed by an owner account but anyone can register a new hash for a hash type, provided all signatures are valid and up-to-date. One thing to keep in mind is that signatures must be sent in the same order as the signers list stored in the contract. This requires that off-chain signing workflow keeps up-to-date with signers removal calls made to the contract since this type of calls might change the order of the signers.
This contract is specially useful for use cases where other contracts need to make sure a set of data is valid and it is up-to-date. For example, in the case of a Airnode Signed API URLs, there will be a Merkle tree containing all the Airnode address and URL pairs. Then a group of trusted signers could verify that this data is correct and sign the root of this Merkle tree. Then this root can be registered in the HashRegistry. Any other contract can then receive a Signed API URL for an Airnode and check that it is valid and that it is the most up-to-date one by retrieving the hash and timestamp from the registry.
This contract allows to store the list of active dAPIs plus the data need it in order to be able to update the underlying data feeds.
This data is composed of:
This contract also provides convenience functions to allow callers to read the dAPI names with their related data in a single call or via multicall since the contract inherits from SelfMulticall.sol
This contract ties everything together. It relies on the previously mentioned contracts to allow the caller to buy a subscription for a managed dAPI based on update conditions for a specific period.
The contract is expected to receive the payment based on the price from the pricing Merkle tree but depending if the purchase is:
then the total amount to be paid may differ from the original amount and the difference will be returned to the caller. The actual payment will be redirected to sponsor wallet in charge of keeping the data feed up-to-date.
In the same transaction while making a purchase, the contract will also try to deploy a DapiProxy contract that can be used for reading the current value of a data feed and it will also try to update the underlying data feed values with signed data (stored in Api3ServerV1) if it hasn't been updated recently.
The package can be built by running yarn package:build and contains
Local ETH node can be started and get all deployment scripts to be executed by running this command:
yarn run node-deploy
Alternatively you could do this in separate steps. First start a local running ETH node by running the following command:
yarn run node
Then deploy the contracts by running this command on a new terminal:
HARDHAT_NETWORK=localhost yarn run deploy
Keep in mind that both localhost and hardhat chains, will not be added to references.json file.
FAQs
API3 dAPI management
We found that @phase21/dapi-management demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.

Security News
New DoS and source code exposure bugs in React Server Components and Next.js: what’s affected and how to update safely.

Security News
Socket CEO Feross Aboukhadijeh joins Software Engineering Daily to discuss modern software supply chain attacks and rising AI-driven security risks.