
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@towns-protocol/contracts
Advanced tools
This project is a blockchain-based space/channel management system with role-based access control and entitlements. It implements a complex permission system using smart contracts that allows for cross-chain rule validation and user management.
The system also supports cross-chain delegation between Ethereum L1 and Base L2, allowing users to stake tokens on L1 and have delegation benefits on L2. Node operators can receive delegations directly or via spaces, with rewards distributed based on stake amounts and time.
src/airdrop/ - Token distribution mechanisms (drops, points, streaks, rules)src/base/registry/ - Core registry, delegation, rewards, entitlement checking
/facets/distribution/ - Staking and rewards distribution for DAO participants and node operators/facets/mainnet/ - Cross-chain delegation handling and message relaying/facets/delegation/ - Space-to-operator delegation management/facets/operator/ - Node operator registration and managementsrc/spaces/ - Space management, entitlements, permissions, cross-chain rulessrc/factory/ - Factory contracts for space creation, deployment, wallet linkingsrc/utils/ - Utility libraries (currency, math, reverts, patterns)src/diamond/ - Diamond pattern implementation, facets, upgradeabilitysrc/tokens/ - Token management, membership NFTs, locks, bridging, inflationscripts/diamonds - Diamond deployment scriptsRuleEntitlement.sol - Rule-based entitlements, cross-chain permission validationEntitlementsManager.sol - Entitlement validation and access controlArchitect.sol - Factory for space creation/initializationCreateSpace.sol - Space instance creation/initializationRoles.sol - Role-based permissions and hierarchiesTowns.sol - Main ERC20 token (inflation, governance)DropFacet.sol - Token airdrops, claiming conditionsTownsPoints.sol - Points-based rewards, check-ins, streaksRewardsDistribution.sol - Manages token staking, delegation proxies, and reward calculationsMainnetDelegation.sol - Handles cross-chain delegation via cross-domain messengersSpaceDelegationFacet.sol - Manages delegation of spaces to node operatorsEntitlementChecker.sol - Cross-chain entitlement validationDiamondCutFacet.sol - Diamond upgradeabilityInstall yarn via corepack:
npm install -g corepack
corepack enable
Install Foundry:
curl -L https://foundry.paradigm.xyz | bash
foundryup
Clone the repo, then:
yarn
To compile the smart contracts:
forge build
To run the solidity unit tests:
forge test
You can add verbosity to the tests by adding -vvvv (1-4 levels) to the command.
To start a local Ethereum blockchain:
anvil
It will generate a set of 10 public/private keys with 10k ether each. Save one of these private keys for deployment.
It starts listening on http://127.0.0.1:8545.
If you want to interact with anvil via a front end, you will need to add the local network to Metamask with ChainID=1337.
To start a local base blockchain and river blockchain:
cd ../../core && just anvils
To deploy our contracts to your local base and river instances:
.env.localhost file in the contracts folder of the project and rename it to .env (this is excluded from git via .gitignore)export RIVER_ENV="local_dev" from your terminal./scripts/deploy-contracts.sh to deploy the entire suite of contracts to your local base-anvil and river-anvil chainsTo deploy a single diamond base contract to your local anvil instance:
From within the contracts/ folder you can run:
make deploy-base-anvil contract=Deploy[Contract] type=diamonds
Replace [Contract] with the contract you want to deploy. You can see all the contracts available for deployment in the diamonds deployments directory.
The project supports two methods for deploying facets:
Using custom deployment scripts:
make deploy-base-anvil contract=Deploy[Facet] type=facets
[Facet] with the name of your facet deployment script found in ./scripts/deployments/facetsDeployer and implement versionName() and __deploy() functionsUsing the standardized DeployFacet script:
make deploy-facet-local rpc=base_anvil contract=[FacetName]
[FacetName] with the actual facet contract name (without "Deploy" prefix)DeployFacet.s.sol script with the CONTRACT_NAME environment variableTo deploy facets to a live network:
From within the contracts/ folder you can run:
# For custom deployment scripts:
make deploy-base-sepolia contract=Deploy[Contract] type=facets context=[context]
# For standardized DeployFacet script:
make deploy-facet rpc=base_sepolia contract=[FacetName] context=[context]
For example, to deploy the WalletLink facet to Base Sepolia with a deployment context of "gamma":
# Using custom deployment script:
make deploy-base-sepolia contract=DeployWalletLink type=facets context=gamma
# Using standardized DeployFacet script:
make deploy-facet rpc=base_sepolia contract=WalletLink context=gamma
For hardware wallet deployments, use the corresponding ledger commands:
# Using custom deployment script:
make deploy-ledger-base-sepolia contract=DeployWalletLink type=facets context=gamma
# Using standardized DeployFacet script:
make deploy-facet-ledger rpc=base_sepolia contract=WalletLink context=gamma
You can see all the contracts available for deployment in the deployments directory.
For detailed information on contributing to this project, please see our CONTRIBUTING.md file. It includes:
FAQs
## Overview
We found that @towns-protocol/contracts demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.