
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
boring-solidity
Advanced tools
BoringSolidity is a collection of general purpose Solidity contracts that have been reasonably optimized, reviewed and tested. Still, they come with no guarantees and are provided as-is.
Once we can move to Solidity 0.8.0 we won't need this anymore, but until then, this library helps protect against over and under flows. Also contains some support for uint128.
There is no div function because never solidity versions will revert on a division by 0.
BoringMath128 does not contain a mul function on purpose. To avoid overflows during calculations, it's encouraged to convert to uint256 first.
This is a combination of the well known Ownable and Claimable patterns. It's streamlined to reduce the amount of functions exposed for gas savings.
This is not a full ERC20 implementation, as it's missing totalSupply. It's optimized for minimal gas usage while remaining easy to read.
Simple universal factory to create minimal proxies from masterContracts.
Extension to be added to any contract to allow calling multiple functions on the contract in a batch (a single EOA call). The EIP 2612 permit proxy function is included because it's common to approve spending before calling other functions on a contract.
The Rebase struct and RebaseLibary make it easy to track amounts and shares in a single storage slot. This will limit amounts and shares to 128 bits, but if used for token balances, this should be enough for pretty much all tokens that have real use.
MIT
FAQs
BoringSolidity
We found that boring-solidity demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.