Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
@pimlico/erc20-paymaster
Advanced tools
PimlicoERC20Paymaster is an ERC-4337 Paymaster contract by Pimlico which is able to sponsor gas fees in exchange for ERC20 tokens. The contract refunds excess tokens if the actual gas cost is lower than the initially provided amount. It also allows updating price configuration and withdrawing tokens by the contract owner. The contract uses an Oracle to fetch the latest token prices.
The PimlicoERC20Paymaster contract inherits from BasePaymaster.
Deploy the PimlicoERC20Paymaster contract, providing the required parameters such as the ERC20 token, EntryPoint contract, and Oracle contract addresses. Update the price markup and price update threshold configurations if needed, using the updateConfig function. If necessary, the contract owner can withdraw tokens using the withdrawToken function. To update the token price, call the updatePrice function. For more information, please refer to the comments within the contract source code.
This repository uses both hardhat and foundry for development, and assumes you have already installed hardhat/foundry
Hardhat is used for gas metering and developing sdk.
npm install
Npx hardhat test
This will show results for the gas metering on different modes based on 1) refund 2) token payment limit 3) price update
note : first transaction is expensive because nonce increases 0 -> 1
Foundry is used for unit tests
forge install
forge test
forge coverage
This project is licensed under the GNU General Public License v3.0.
FAQs
A permissionless ERC20 Paymaster implementation by Pimlico
The npm package @pimlico/erc20-paymaster receives a total of 302 weekly downloads. As such, @pimlico/erc20-paymaster popularity was classified as not popular.
We found that @pimlico/erc20-paymaster demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.