Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
warp-contracts-lmdb
Advanced tools
Warp Contracts implementation of the SortKeyCache
using the LMDB database.
Compatible only in node env.
const warp = WarpFactory
.custom(arweave, cacheOptions, 'mainnet', new LmdbCache({
...cacheOptions,
dbLocation: `./cache/warp/lmdb-2/contracts`
}))
.useWarpGateway(defaultWarpGwOptions, defaultCacheOptions,)
.build();
yarn install
yarn build
DEN docker images are deployed to dockerhub. In order to run node locally:
.secrets
) with wallet.json
file inside - Arweave JSON Web Key (JWK).db
)To start the node, run the following command:
docker run -t -d -p <host_port>:<container_port> \
-v <path_to_db_dir>:/app/dist/.db \
-v <path_to_jwk_dir>:/app/dist/.secrets warpredstone/den:<version> \
--url='<public_address>' --port=<container_port> --testnet='<is_testnet>' \
--networkId='<network_id>' --networkContractId='<network_contract_id>'
where:
host_port
- TCP port on the Docker hostcontainer_port
- TCP port in the Docker container - the port the node is listening for the requests, e.g. 8080
.path_to_jwk_dir
- path to a folder where wallet.json
file is stored (e.g. .secrets
)version
- DEN docker image version (e.g. 1.0.8
). Check latest available version on dockerhub.public_address
- node's public address, e.g.: http://138.197.7.53
is_testnet
- whether network is working in a public RedStone testnet
or Arweave mainnetnetwork_id
- DEN id, e.g. redstone_network
network_contract_id
- contract tx id that this network is registered in (e.g. FxjoXsxQyuknaqaCV2Si7sq0TF3taBb8uTRmXmC6FQs
- SonAR)Full example:
docker run -t -d -p 8080:8080 \
-v /home/den/.db:/app/dist/.db \
-v /home/den/.secrets:/app/dist/.secrets warpredstone/den:1.0.8 \
--url="http://134.209.84.136" --port=8080 --testnet='false' \
--networkId='redstone_network' --networkContractId='FxjoXsxQyuknaqaCV2Si7sq0TF3taBb8uTRmXmC6FQs'
/ehlo
http://<public_address>:<host_port>/ehlo
e.g. http://134.209.84.136:8080/ehlo
This endpoint returns some basic info about a node:
FxjoXsxQyuknaqaCV2Si7sq0TF3taBb8uTRmXmC6FQs
)redstone_network
)/state
http://<public_address>:<host_port>/state?id=<contract_id>
e.g. http://134.209.84.136:8080/state?id=KT45jaf8n9UwgkEareWxPgLJk4oMWpI5NODgYVIF1fY
This endpoint returns the current state of the contract of id passed in the id
query params and some additional data from
the Snowball rounds (all the responses from all the nodes that took part in a given round).
Each response from the node contains its signature.
In order to verify the signature of a given node
deepHash
of [stateHash, signature.owner]
, e.g.:const sigData = await deepHash([
arweave.utils.stringToBuffer(data.hash),
arweave.utils.stringToBuffer(data.signature.owner)
]);
const verified = await arweave.crypto.verify(
data.signature.owner,
sigData,
data.signature.sig
);
This endpoint also returns info about the network height, at which the state was evaluated, the last evaluated transaction id and amount of evaluated interactions.
/state
with validity:http://<public_address>:<host_port>/state?id=<contract_id>&validity=true
Same as in point 2., but also returns validity. This might affect response times for contracts with several thousands of interactions.
e.g. http://134.209.84.136:8080/state?id=pvudp_Wp8NMDJR6KUsQbzJJ27oLO4fAKXsnVQn86JbU
/state
without Snowballhttp://<public_address>:<host_port>/state?id=<contract_id>&snowball=false
This allows to get the state evaluated by a given node, without running the Snowball. Should be used only if you fully trust given node.
e.g. http://134.209.84.136:8080/state?id=pvudp_Wp8NMDJR6KUsQbzJJ27oLO4fAKXsnVQn86JbU&snowball=false
All DENs are registered within a SmartWeave contract (at the time of writing the contract id is FxjoXsxQyuknaqaCV2Si7sq0TF3taBb8uTRmXmC6FQs).
The contract gives an option to register/unregister contracts (by the given DEN operator), register nodes, change network's consensus params, etc.
In the future the staking/slashing features will be added.
The primary license for RedStone Distributed Execution Network Node is the Business Source License 1.1 (BUSL-1.1), see LICENSE
FAQs
Lmdb database for Warp Contracts SDK
The npm package warp-contracts-lmdb receives a total of 1 weekly downloads. As such, warp-contracts-lmdb popularity was classified as not popular.
We found that warp-contracts-lmdb demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.