
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
A CLI tool for Diffuse Prime built with TypeScript and viem.
npm install -g difcli
# or
npx difcli
difcli --help # Show help
difcli --version # Show version
difcli wallet set-private-key 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
difcli wallet show
Displays wallet address and type.
difcli wallet remove
Removes the stored private key from local storage.
difcli balance
Displays wallet balance in native BERA tokens and configured token contract balance.
difcli contracts
Displays all configured contract addresses including RPC endpoint, vault contract, and token contract.
difcli token mint <amount>
Mints the specified amount of tokens to the configured wallet. Amount is in token units (will be multiplied by 1e18 for the transaction).
difcli token burn <amount>
Burns the specified amount of tokens from the configured wallet. Amount is in token units (will be multiplied by 1e18 for the transaction).
Both commands will:
difcli lender deposit <amount>
Deposits tokens into the vault as a lender. Amount is in token units (will be multiplied by 1e18 for the transaction).
The command will:
Validation: Command will fail with clear error message if token balance is insufficient.
difcli lender withdraw <amount>
Withdraws tokens from the vault as a lender. Amount is in token units (will be multiplied by 1e18 for the transaction).
The command will:
Note: Both receiver and owner addresses are set to the configured wallet address.
Validation: Command will fail with clear error message if requested amount exceeds maximum withdrawable balance.
difcli borrower activate <positionId>
Calls sgxActivateBorrowerPosition(positionId, liquidationPrice=getBorrowerPosition(id).liquidationPrice, blocksAndHashes=[], proof=0x, data) and simulates first.
⚠️ Warning: this only works on vaults where SGX proof checks are disabled. On normal vaults it will revert.
For Aegis strategies, the CLI will auto-fetch data via Prime API POST /mint (slippage is entered interactively).
difcli borrower exit <positionId>
Runs an eth_call simulation of unborrow and then submits the transaction.
If the preview shows Finished in one tx: No (async), the exit is intercepted by an async adapter and will require one or more follow-up calls:
difcli borrower exit-status <positionId> to see the intercepted adapter.difcli borrower exit-continue <positionId> to continue until finished.difcli borrower exit-status <positionId>
Shows hasUnfinishedSwap + getUnfinishedSwap (intercepted adapter + hop index best-effort).
difcli borrower exit-continue <positionId>
Notes:
minAssetsOut from an eth_call simulation (returnedPerHop) and applies slippage per hop. Hops that output 0 keep minOut=0 automatically (required for unfinished async hops).instanceLocked/getInfoForPosition), and will call Prime API POST /redeem to obtain encodedData.Environment variables:
PRIME_API_BASE_URL (default https://api.prime.diffuse.fi)For strategies with Aegis in the strategy name, previewBorrow(..., data) requires Prime API POST /mint encodedData (used by AegisMintAdapter).
collateral_amount sent to /mint should match the exact amountIn that will go into AegisMintAdapter.buy(...):
collateralType=OriginalAsset: collateralAmount + assetsToBorrowcollateralType=StrategyAsset: assetsToBorrowIn this CLI, this currently affects preview/simulation only (because borrowRequest(...) does not take a data argument). When you run difcli borrower preview or difcli borrower request, the CLI will auto-call /mint for Aegis strategies to make preview work.
Environment variables (mint):
PRIME_API_BASE_URL (default https://api.prime.diffuse.fi)
Slippage for Prime API (/mint and /redeem) is entered interactively as percent when needed.difcli vault set <chain> <address>
Sets a custom vault contract address for a specific chain.
difcli vault set berachain 0x1234567890123456789012345678901234567890
difcli vault show
Displays current vault addresses for all chains, showing both default and custom addresses.
difcli vault reset <chain>
Resets the vault address for a specific chain back to the default.
difcli vault reset berachain
Note: Custom vault addresses are stored per chain and persist across sessions.
difcli lender status
Displays comprehensive vault status and lender-specific information:
Vault Statistics:
Lender Information:
Vault Status:
⚠️ WARNING: This CLI tool stores private keys locally with encryption. While the keys are encrypted, this is NOT suitable for production use with real funds.
For production use:
The current implementation uses a default encryption key. For better security, consider:
# Install dependencies
npm install
# Build the project
npm run build
# Run in development mode
npm run dev
# Test locally
node dist/index.js [command]
# or
npx difcli [command]
MIT
FAQs
CLI tool for Diffuse Prime
We found that difcli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.