
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
dapple-wevm
Advanced tools
This is a direct fork of ethereumjs-vm with a few (significant) modifications.
This repository is a Proof-of-Concept for a wallet side EVM execution(WEVM), which brings several use cases which I want to explore in this POC project. Possible use cases could be:
##Deployment-scripting
Considder the setup of the following OnBlockchain Contract:
contract OnBlockchain {
event owner(address owner);
function OnBlockchain(bytes construcorrr) {
owner(msg.sender);
// hahaha
}
function giveMeTHIRTYTWO() constant returns (uint) {
return 32;
}
function giveMeSEVENTEEN(uint integer) returns (uint) {
return 17;
}
function giveMeFOUR() returns (uint) {
return 4;
}
}
contract B is Script {
function B() {
// deploys a new contract
OnBlockchain a = new OnBlockchain("123");
// export the contract address as variable "varname". Its class
// is automatically inferred
exportObject("varname", a);
// as the function giveMeTHIRTYTWO is constant, the function call
// triggers a call and retrieve a value and export it as the variable
// name "thirtytwo"
exportNumber("thirtytwo", a.giveMeTHIRTYTWO());
// The function giveMeSEVENTEEN is not static, therefore
// a transaction is triggered. However a return value
// can be still retrieved and exported (currently not working)
exportNumber("seventeen_nonstatic", a.giveMeSEVENTEEN(2));
// If one want to retrieve a return value from a function
// without triggering a transaction, this can be done either by
// setting the call flag to true:
setCalls(true);
exportNumber("seventeen", a.giveMeSEVENTEEN(3));
setCalls(false);
// or exporting the the static calls into a function:
staticStuff(b);
// sets the address which triggers the transaction
setOrigin(0x6deec6383397044107be3a74a6d50d41901f0356);
// this contract will have 0x6d... as its creator
OnBlockchain b = new OnBlockchain("123");
// Interacting with the default server environment is also supported
// In order for this to work, curl and jq need to be installed
uint BTC_USD = SH.to_uint("curl -s https://api.coindesk.com/v1/bpi/currentprice.json|jq '.bpi.USD.rate|tonumber|floor'");
exportNumber("btc_usd", BTC_USD);
// one can think of different integrations/ apis, which can be provided by
// dapple with this approach
}
// the static flag indicates, that all transactions in this function will be
// treated as static calls rather then generating a transaction
function staticStuff(OnBlockchain a) static {
exportNumber("four", a.giveMeFOUR());
}
}
This is producing the following output:
NEW new OnBlockchain(0x313233)
TXR OnBlockchain(0xac5fce7ae0051acf4dcd81a64523da41e59cc7a5).giveMeSEVENTEEN(2)
ACC switch origin to 0x6deec6383397044107be3a74a6d50d41901f0356
NEW new OnBlockchain(0x313233)
exportObject(name a, addr 0xac5fce7ae0051acf4dcd81a64523da41e59cc7a5, class OnBlockchain)
exportNumber(name thirtytwo, number 32)
exportNumber(name seventeen_nonstatic, number 1.13526946735478465913037617028159547472529646787646290075579373593588249133056e+77)
exportNumber(name seventeen, number 17)
exportNumber(name four, number 4)
exportNumber(name btc_usd, number 678)
##Sidechain A sidechain running on Dapphub/ Controlled servers can be used to directly interact with ethereum and dapple. E.g. centralized callbacks can be deployed which are triggered by on blockchain events. external Plugins/ Packages/ Services can be easilly implemented and provided through a standard dapphub api.
Contract c = new Contract();
Event(c).on("Trade", "sale");
...
}
function callback(address sender, string name, uint ammount) on("sale") {
sms.msg(me, "Got request, sold ${name} for ${ammount}");
}
WEVM related stuff is located in ./src/. Also ethereumjs-vm's code was modified.
To test it for yourself run testrpc in the background and:
cd src
node index.js
FAQs
an wallet side ethereum VM implementation
We found that dapple-wevm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.