
Research
/Security News
npm Author Qix Compromised via Phishing Email in Major Supply Chain Attack
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.
A decentralized exchange for Handshake names.
The underlying protocol is based on the non-interactive name swap construction created by @tynes. It works like this:
FINALIZE output from the transfer in step 1.FINALIZE the transfer whenever he sees fit.shakedex automates the above flow, and adds an auction layer on top. By creating a set of presigned transactions with decreasing sale prices but increasing lock times, shakedex creates a fully decentralized reverse-Dutch auction system that allows names to be bought and sold without intermediaries.
To install shakedex:
npm i -g hsd # required, min hsd v6.0.0
npm i -g shakedex
For shakedex to work, you'll need a Handshake node running somewhere. You can use Bob Wallet (just remember to set your API key), or run hsd in a background process. Make sure to start your HSD node with --index-tx.
⚠️ Warning: Shakedex generates its own public/private keys to sign/redeem auction presigns. These keys are stored in
~/.shakedex. Remember to back up this folder - without it, you risk losing funds.
shakedex has a command line interface. CLI usage is documented by running shakedex --help.
The workflow to create a swap is as follows:
1. Transfer the name to the locking script.
Run shakedex transfer-lock <name>. This will initiate the transfer to the locking script. You may be asked for your wallet passphrase.
Wait 48 hours for the transfer lockup to expire.
2. Finalize the transfer to the locking script.
Run shakedex finalize-lock <name>. Wait 15 minutes for the transaction to confirm.
3. Generate Presigns
Run shakedex create-auction <name>. This will walk you through the process of creating an auction. You will choose:
This will output a file containing a set of newline-delimited JSONs. These JSONS are the "swap proofs" Bob will use to validate the auction. They are time-locked, so you can release them all at once.
4. Distribute Presigns
The CLI will offer to upload your presigns to ShakeDex Web, a website that displays Shakedex swap proofs.
You can also opload the presigns file wherever presign files are found.
1. Download Presigns
Download a presigns file from wherever presign files are found.
2. Fulfill the Auction
Run shakedex fulfill-auction <path to presigns file>. This will find the lowest non-timelocked price and fulfill it using funds from your wallet. You may be asked for your passphrase.
Wait 48 hours for the transfer lockup to expire.
3. Finalize the Auction
Run shakedex finalize-auction <name>. Wait 15 minutes for the transaction to confirm.
The auction is now complete!
You can see your list of active auctions by running shakedex list-auctions. The output looks something like this:
┌────────┬──────────────────┬─────────────────────┬─────────────────────┬─────────────────────┬─────────────────────┬─────────────┬───────────┬───────────────┐
│ Name │ Status │ Transfer Broadcast │ Transfer Confirmed │ Finalize Broadcast │ Finalize Confirmed │ Start Price │ End Price │ Current Price │
├────────┼──────────────────┼─────────────────────┼─────────────────────┼─────────────────────┼─────────────────────┼─────────────┼───────────┼───────────────┤
│ monk │ AUCTION_LIVE │ 2021-02-06 02:34:16 │ 2021-02-06 02:35:12 │ 2021-02-06 02:40:39 │ 2021-02-06 02:41:05 │ 100.000000 │ 1.000000 │ 95.875000 │
├────────┼──────────────────┼─────────────────────┼─────────────────────┼─────────────────────┼─────────────────────┼─────────────┼───────────┼───────────────┤
│ stonks │ FINALIZE_MEMPOOL │ 2021-02-06 03:40:40 │ 2021-02-06 03:42:30 │ 2021-02-06 03:42:41 │ - │ - │ - │ - │
└────────┴──────────────────┴─────────────────────┴─────────────────────┴─────────────────────┴─────────────────────┴─────────────┴───────────┴───────────────┘
Similarly, you can see the list of names you have bought by running shakedex list-fills. The output looks something like this:
┌──────┬────────────────────────────┬────────────┬─────────────────────┬─────────────────────┬─────────────────────┬─────────────────────┐
│ Name │ Status │ Price │ Fulfill Broadcast │ Fulfill Confirmed │ Finalize Broadcast │ Finalize Confirmed │
├──────┼────────────────────────────┼────────────┼─────────────────────┼─────────────────────┼─────────────────────┼─────────────────────┤
│ honk │ FULFILL_FINALIZE_CONFIRMED │ 100.000000 │ 2021-02-06 02:42:26 │ 2021-02-06 02:50:51 │ 2021-02-06 02:51:50 │ 2021-02-06 02:51:54 │
└──────┴────────────────────────────┴────────────┴─────────────────────┴─────────────────────┴─────────────────────┴─────────────────────┘
How does the locking script work?
Essentially, it uses Handshake's OP_TYPE opcode to return OP_RETURN whenever someon tries to spend a lockd name to a RENEW, REVOKE, or UPDATE output.
You can see the script working for yourself by checking out the swap script tests.
Can I cancel a name transferred to the locking script?
Yes, but you will either need to wait for me to implement a feature for that in shakedex or figure out the right code to unlock the locking script on your own.
Can I use hsd/Bob to manage the names I buy using shakedex?
Yes, you can. Once the transfer has been FINALIZEd, the name can be managed using Bob, HSD, or any other wallet of your choice.
Alpha Software That Works On My Machine 💫
[0.0.19] - 2024-02-24
FAQs
A decentralized exchange for Handshake names.
The npm package shakedex receives a total of 0 weekly downloads. As such, shakedex popularity was classified as not popular.
We found that shakedex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.

Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.