Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@uniswap/deploy-v3
Advanced tools
This package includes a CLI script for deploying the latest Uniswap V3 smart contracts to any EVM (Ethereum Virtual Machine) compatible network.
Please note that Uniswap Protocol v3 is under BUSL license until 2023-04-01. To deploy on a new chain, please follow the Uniswap Governance Process to request a DAO vote to request an exception to the license.
Get the arguments for running the latest version of the script via npx @uniswap/deploy-v3 --help
.
As of v1.0.3
the arguments are:
> npx @uniswap/deploy-v3 --help
Usage: npx @uniswap/deploy-v3 [options]
Options:
-pk, --private-key <string> Private key used to deploy all contracts
-j, --json-rpc <url> JSON RPC URL where the program should be deployed
-w9, --weth9-address <address> Address of the WETH9 contract on this chain
-ncl, --native-currency-label <string> Native currency label, e.g. ETH
-o, --owner-address <address> Contract address that will own the deployed artifacts after the script runs
-s, --state <path> Path to the JSON file containing the migrations state (optional) (default: "./state.json")
-v2, --v2-core-factory-address <address> The V2 core factory address used in the swap router (optional)
-g, --gas-price <number> The gas price to pay in GWEI for each transaction (optional)
-c, --confirmations <number> How many confirmations to wait for after each transaction (optional) (default: "2")
-V, --version output the version number
-h, --help display help for command
This script runs a set of migrations, each migration deploying a contract or executing a transaction.
To use the script, you must fund an address, and pass the private key to the script so it can construct and broadcast the deployment transactions.
The block explorer verification process (e.g. Etherscan) is specific to the network. For the existing deployments,
we have used the @nomiclabs/hardhat-etherscan
hardhat plugin in the individual repositories to verify the deployment addresses.
Note that in between deployment steps, the script waits for confirmations. By default, this is set to 2
. If the network
only mines blocks when the transactions is queued (e.g. a local testnet), you must set confirmations to 0
.
To run unit tests, run yarn test
.
For testing the script, run yarn start
.
To publish the script, first create a version: npm version <version identifier>
, then publish via npm publish
.
Don't forget to push your tagged commit!
We estimate 30M - 40M gwei needed to run the full deploy script.
Delete state.json
before a fresh deploy. state.json
tracks which steps have already occurred. If there are any entries, the deploy script will attempt to pick up from the last step in state.json
.
Check out state.json
. It'll show you the final deployed addresses.
Depends on the confirmation times and gas parameter. There are a total of 14 individual deploys on chain.
You can file them in issues
on this repo and we'll try our best to respond.
FAQs
Deploy Uniswap V3 smart contracts
The npm package @uniswap/deploy-v3 receives a total of 0 weekly downloads. As such, @uniswap/deploy-v3 popularity was classified as not popular.
We found that @uniswap/deploy-v3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.