
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@tallyxyz/super-quorum
Advanced tools
### NOTE: This contract is currently not audited. Do not use in production without an Audit.
The SuperQuorumGovernor
smart contract is an innovative extension of the standard governance model provided by OpenZeppelin. It introduces the concept of "Super Quorum" in governance proposals. This higher quorum threshold is designed to ensure that only proposals with substantial backing and consensus are approved, particularly in critical decision-making scenarios. The contract is developed in Solidity ^0.8.20 and is an integration of OpenZeppelin's governance contracts, including Governor, GovernorSettings, GovernorCountingSimple, GovernorStorage, GovernorVotes, GovernorVotesQuorumFraction, and GovernorTimelockControl.
There are two folders for both a regular version that deploys with a constructore function, and a second version designed to be used in a clone factory that utilizes an initializer.
The GovernorVotesSuperQuorumFraction
module adds a robust layer to the governance process by implementing a super quorum threshold, which is significantly higher than the standard quorum. This addition is crucial for enhancing governance security and decision-making quality, especially for critical or sensitive proposals within decentralized organizations or protocols. By setting a higher consensus requirement, it ensures that critical decisions are made with a broader agreement among stakeholders, adding an extra layer of security and stability to the governance process.
In decentralized finance (DeFi) projects or other blockchain-based organizations, modifying core protocol parameters or upgrading smart contract logic are decisions that significantly impact the ecosystem. The SuperQuorumGovernor
is particularly useful in these scenarios as it ensures such critical proposals are approved only when there is an overwhelming consensus among the token holders, reflecting a wide and strong support.
In situations that require emergency measures, it is crucial that decisions are made swiftly but also have strong backing from the community to ensure they are in the collective interest of the stakeholders. The super quorum mechanism is ideal for these situations as it helps measure and ensure overwhelming support for such emergency actions.
The SuperQuorumGovernor
introduces several key modifications to the standard governance structure:
Super Quorum Threshold: A new variable _superQuorumThreshold
is introduced to set the minimum votes required for a proposal to be considered successful under super quorum rules.
State Function Override: The state
function is overridden to include super quorum logic. Proposals now need to be not just active but also meet or exceed the super quorum threshold to be considered successful.
New Events and Error Handling: The contract includes the SuperQuorumNumeratorUpdated
event and the GovernorInvalidSuperQuorumFraction
error for handling updates and validations related to the super quorum threshold.
The SuperQuorumGovernor
contract is a significant enhancement to the governance process in decentralized systems. It introduces a mechanism that requires higher consensus for critical decisions, ensuring that major changes are made with broad community support. This approach adds an extra layer of security and stability, making it an essential tool for robust decentralized governance.
npx hardhat compile
npx hardhat test
npm add @tallyxyz/super-quorum
Import the standard contract:
import "@tallyxyz/contracts/standard/SuperQuorumGovernor.sol";
// as extension:
import "@tallyxyz/contracts/standard/extension/GovernorVotesSuperQuorumFraction.sol";
Using the upgradeable version:
import "@tallyxyz/contracts/upgradeable/SuperQuorumGovernorUpgradeable.sol";
// as extension:
import "@tallyxyz/contracts/upgradeable/extension/GovernorVotesSuperQuorumFractionUpgradeable.sol";
import the super governor !
FAQs
### NOTE: This contract is currently not audited. Do not use in production without an Audit.
We found that @tallyxyz/super-quorum demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.