
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@rhinestone/sdk
Advanced tools
End-to-end chain abstraction and modularity toolkit
npm install viem @rhinestone/sdk
pnpm install viem @rhinestone/sdk
yarn add viem @rhinestone/sdk
bun install viem @rhinestone/sdk
You'll need a Rhinestone API key, as well as an existing account with some testnet ETH on the source chain.
Let's create a smart account with a single owner:
import { createRhinestoneAccount } from '@rhinestone/sdk'
import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
import { baseSepolia, arbitrumSepolia, optimismSepolia } from 'viem/chains'
import {
Chain,
createPublicClient,
createWalletClient,
encodeFunctionData,
erc20Abi,
Hex,
http,
parseEther,
} from 'viem'
const fundingPrivateKey = process.env.FUNDING_PRIVATE_KEY
if (!fundingPrivateKey) {
throw new Error('FUNDING_PRIVATE_KEY is not set')
}
const rhinestoneApiKey = process.env.RHINESTONE_API_KEY
if (!rhinestoneApiKey) {
throw new Error('RHINESTONE_API_KEY is not set')
}
const sourceChain = baseSepolia
const targetChain = arbitrumSepolia
// You can use an existing PK here
const privateKey = generatePrivateKey()
console.info(`Owner private key: ${privateKey}`)
const account = privateKeyToAccount(privateKey)
const rhinestoneAccount = await createRhinestoneAccount({
owners: {
type: 'ecdsa',
accounts: [account],
}
rhinestoneApiKey,
})
const address = await rhinestoneAccount.getAddress()
console.info(`Smart account address: ${address}`)
We will send some ETH from the funding account to the created smart account. The Orchestrator will use some of that ETH to deploy the account on the target chain, as well as to convert it to USDC for a transfer transaction.
const publicClient = createPublicClient({
chain: sourceChain,
transport: http(),
});
const fundingAccount = privateKeyToAccount(fundingPrivateKey as Hex);
const fundingClient = createWalletClient({
account: fundingAccount,
chain: sourceChain,
transport: http(),
});
const txHash = await fundingClient.sendTransaction({
to: address,
value: parseEther('0.001'),
});
await publicClient.waitForTransactionReceipt({ hash: txHash });
Finally, let's make a cross-chain token transfer:
const usdcTarget = '0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d';
const usdcAmount = 1n;
const transaction = await rhinestoneAccount.sendTransaction({
sourceChain,
targetChain,
calls: [
{
to: usdcTarget,
value: 0n,
data: encodeFunctionData({
abi: erc20Abi,
functionName: 'transfer',
args: ['0xd8da6bf26964af9d7eed9e03e53415d37aa96045', usdcAmount],
}),
},
],
tokenRequests: [
{
address: usdcTarget,
amount: usdcAmount,
},
],
});
console.info('Transaction', transaction);
const transactionResult = await rhinestoneAccount.waitForExecution(transaction);
console.info('Result', transactionResult);
After running that, you will get a smart account deployed on both Base Sepolia and Arbitrum Sepolia, and make a cross-chain USDC transfer.
First, define a session you want to use:
const session: Session = {
owners: {
type: 'ecdsa',
accounts: [sessionOwner],
},
actions: [
{
target: wethAddress,
selector: toFunctionSelector(
getAbiItem({
abi: wethAbi,
name: 'deposit',
}),
),
},
{
target: wethAddress,
selector: toFunctionSelector(
getAbiItem({
abi: wethAbi,
name: 'transfer',
}),
),
policies: [
{
type: 'universal-action',
rules: [
{
condition: 'equal',
calldataOffset: 0n,
referenceValue: '0xd8da6bf26964af9d7eed9e03e53415d37aa96045',
},
],
},
],
},
],
}
During account initialization, provide the session you've just created. Make sure to also provide a bundler configuration.
const rhinestoneAccount = await createRhinestoneAccount({
// …
sessions: [session],
bundler: {
// …
},
})
When making a transaction, specify the signers
object to sign it with the session key:
const transactionResult = await rhinestoneAccount.sendTransaction({
// …
signers: {
type: 'session',
session: session,
},
})
To migrate from the Orchestrator SDK, replace all imports of @rhinestone/orchestrator-sdk
with @rhinestone/sdk/orchestrator
.
Let us know if you encounter any issues!
For feature or change requests, feel free to open a PR, start a discussion or get in touch with us.
FAQs
End-to-end chain abstraction and modularity toolkit
The npm package @rhinestone/sdk receives a total of 0 weekly downloads. As such, @rhinestone/sdk popularity was classified as not popular.
We found that @rhinestone/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.