
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
This package contains contract artifacts for all UMA smart contracts.
Note: this package should rarely be installed by third parties. For abi, bytecode, and official addresses, please use
the @uma/contracts-node or @uma/contracts-frontend packages.
This package should be primarily used to access the full contract source code where necessary. The contracts are
available in contracts/. If you need direct access to the hardhat artifacts, they are available under artifacts/.
yarn add @uma/core
To deploy the contracts, we use the hardhat-deploy package. This may be familiar to users of hardhat. The deployment
process is faily simple, as a result.
To deploy the entire UMA system on a network of your choice:
export MNEMONIC="Your 12-word phrase here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat deploy --network kovan
To deploy a particular contract (along with any dependencies that haven't been deployed on this network):
export MNEMONIC="Your 12-word phrase here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat deploy --network kovan --tags LongShortPairCreator
Note: other tags, like dvm, exist to deploy subsets of contracts.
To perform an etherscan verification on a particular contract address that you have deployed on a public network:
export ETHERSCAN_API_KEY="Your etherscan api key here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat verify "Your contract address here" --network kovan
To perform a verification on all the contracts you have deployed on a particular network:
export CUSTOM_NODE_URL="Your node url here"
export ETHERSCAN_API_KEY="Your etherscan api key here"
yarn hardhat etherscan-verify --network kovan --license AGPL-3.0 --force-license
To add a contract to the official UMA deployments, find the networks/[chainId].json file, and update an existing
contract entry or add a new one.
The following commands are implemented as hardhat tasks that make it easy to interact with deployed contracts via the CLI:
Registers the deployer account (as defined in the namedAccounts param in hardhat.config.js) with the deployed Registry for the network. Optionally registers a custom account.
export MNEMONIC="Your 12-word phrase here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat register-accounts --network <NETWORK-NAME> --account <CUSTOM-ACCOUNT>
Whitelist hardcoded identifiers from the config/identifiers.json file. Optionally whitelists a custom identifier.
export MNEMONIC="Your 12-word phrase here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat whitelist-identifiers --network <NETWORK-NAME> --id <CUSTOM-IDENTIFIER>
Sets specified contracts in the deployed Finder. More contracts available to be set can be found in the common/hardhat/tasks/finder.js script.
export MNEMONIC="Your 12-word phrase here"
export CUSTOM_NODE_URL="Your node url here"
yarn hardhat setup-finder --network <NETWORK-NAME> --registry --bridge --generichandler
Some contracts, such as the Insured bridge, contain end to end integration tests that are run differently to the rest of core's tests. Running these specific tests can be done as follows:
cd ../.. # navigate to the root of the protocol repo
yarn optimsim-up # start the optimism containers. note this will take a long time as a few containers need to be built
cd ./packages/core # move back to this package
yarn test-e2e # run the end to end tests against the optimism containers.
FAQs
UMA smart contracts and unit tests
The npm package @uma/core receives a total of 567 weekly downloads. As such, @uma/core popularity was classified as not popular.
We found that @uma/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Security News
TypeScript 6.0 will be the last JavaScript-based major release, as the project shifts to the TypeScript 7 native toolchain with major build speedups.