Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This SDK provides an extension to integrate the STREAM NFT (https://www.streammoney.finance/) smart contract to your application. STREAM NFT is an on-chain "solana" smart contract that enables the real-time borrowing/renting of NFTs. ```js import { quer
This SDK provides an extension to integrate the STREAM NFT (https://www.streammoney.finance/) smart contract to your application. STREAM NFT is an on-chain "solana" smart contract that enables the real-time borrowing/renting of NFTs.
import {
queryTokenState,
config,
sendTransaction,
withdrawTx,
rentTx,
initNFTEscrowTx,
findAssociatedTokenAddress,
cancelEscrowTx,
getWalletTokens,
QueryWalletTokensStatus,
getAllListedTokens,
} from "stream-nft";
STREAM NFT flow consists of 5 major flows: Initialize, Rent, Withdraw, Cancel, Query
Initializes NFT on STREAM NFT protocol, making it available for users to browse and rent.
initNFTEscrowTx({
owner: Wallet, // owner's wallet which implements wallet interface
token, // PublicKey of the NFT to be rented
rate: BigNumber // rate in lamports/s,
minBorrowTime: BigNumber // mininum time for borrow (in Seconds),
maxBorrowTime: BigNumber // maximum time for borrow (in Seconds),
sellPrice: BigNumber // selling price of NFT / set 0 for not for sale
connection,
newAccount: PublicKey //new temp account for transfering ownership to PDA (TO BE DEPRECATED),
ownerTokenAccount: await findAssociatedTokenAddress(
wallet.publicKey,
token
),
programId: config.DEVNET_PROGRAM_ID, // program addresses are available in config
});
Users can borrow the NFT utility adhering to the contract constraints of rate, min_duration, and max_duration. This is will change the contract state, changing conditional ownership to the borrower.
rentTx({
borrower: Wallet, // borrower's wallet which implements wallet interface
token, // PublicKey of the NFT to be borrowed
programId: config.DEVNET_PROGRAM_ID,
amount: BigNumber // amount borrower is willing to pay (time * rate)[lamports],
time: BigNumber // time borrower wants to borrow the NFT for (in Seconds),
buy: Enum // set 1 to buy else rent
connection,
});
As per the duration set by the user, the NFT utility would expire. NFT could be withdrawn by anyone upon expiration, and get incentivised. This flow returns NFT back to the available state for renting.
withdrawTx({
token, // PublicKey of the NFT to be withdrawn
programId: config.DEVNET_PROGRAM_ID,
connection,
});
NFT owners can cancel the smart contract, thus claiming back the ownership of NFT. This closes the temporary PDA and settles all PDA balances to the owner.
cancelEscrowTx({
owner: Wallet, // owner's wallet which implements wallet interface
token, // PublicKey of the NFT to be remove from listing
programId: config.DEVNET_PROGRAM_ID,
connection,
ownerTokenAddress: await findAssociatedTokenAddress(
wallet.publicKey,
token
),
});
Any service/user can invoke the query function to get the current on-chain PDA state for a provided NFT.
queryTokenState({
programId: config.DEVNET_PROGRAM_ID,
tokenAddress: PublicKey // PublicKey of the NFT to be remove from listing,
connection,
});
};
service/user can get all their listed and borrowed tokens present on stream-nft platform using the following methods
await getWalletTokens({
connection,
programId: config.DEVNET_PROGRAM_ID,
owner: wallet,
type: QueryWalletTokensStatus.LISTED,
})
await getWalletTokens({
connection,
programId: config.DEVNET_PROGRAM_ID,
owner: wallet,
type: QueryWalletTokensStatus.BORROWED,
})
get all tokens listed on the stream-nft platform
await getAllListedTokens({
connection,
programId: config.DEVNET_PROGRAM_ID,
})
Stream NFT is soon expanding to other chains as well.. stay tuned :)
FAQs
This SDK provides an extension to integrate the STREAM NFT (https://www.streammoney.finance/) smart contract to your application. STREAM NFT is an on-chain "solana" smart contract that enables the real-time borrowing/renting of NFTs. ```js import { quer
We found that stream-nft demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.