Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Tool for translating and creating custom addresses for various cryptocurrencies
Highly experimental, pure python tool for cryptocurrencies. Please notice that coins could change their protocols so make sure the coin parameters are not outdated.
sudo apt-get install build-essential python3-setuptools python3-wheel python3-dev python3-pip
If you don't have Python 3, install it by following instructions from python.org. Supported Python versions are 3.8, 3.9, 3.10, 3.11, 3.12. Then run (using pip for python 3) :
pip install multicrypto
The package contains below commands:
sweepaddress
- combines many inputs into onesendcrypto
- creates raw transaction and send it to insight explorer apicheckaddress
- checks address balance using insight explorer apitransaddress
- translates address to different coin format (resulting address will have the same private key)transprivkey
- translates WIF private key to different coin formatgenaddress
- generates vanity address for given coinsignmessage
- signs message using ECDSAverifymessage
- verify ECDSA signed messageBefore running any commands it is advised to disable shell history. For example on linux it should be enough to run:
unset HISTFILE
sweepaddress --coin_symbol=<COIN SYMBOL> --address=<ADDRESS> --private_key=<PRIVATE KEY> --minimum_input_threshold=<INT> --maximum_input_threshold=<INT>
After mining some currency for longer period we could end up with address having a lot of small inputs. In such case it is very likely it will be not possible to send the funds in one transaction and it could be difficult to cope with. Let say for Zen Cash we have private key of the address which inputs we want to combine, but we want only combine inputs which are smaller than 0.1 ZEN:
sweepaddress -c ZEN -p KwDiDMtpksBAcfyHsVS5XzmirtyjKWSeaeM9U1QppugixMUeKMqp --maximum_input_threshold==10000000
This will create appropriate number of transactions (by default one transaction for each 200 inputs, you can override this value by setting parameter --batch_size, but setting it too high will result in too big transaction error), transaction fee will be set to default 0.00001 ZEN (you can override it using --fee parameter) and the funds will be sent back to original address (you can override the output address using --address parameter). 2. Sending funds:
sendcrypto --coin_symbol=<COIN_SYMBOL> --satoshis=<INT> --address=<ADDRESS> --private_key=<PRIVATE KEY> --minimum_input_threshold=<INT> --maximum_input_threshold=<INT>
Sending (P2PKH) 0.25 BTC to address 1BTC1NNjeiAmFqe2n1QJjkEa4aMyAhkpKG with default fee 10000 satoshis and only using inputs containing not more than 100000 satoshis:
sendcrypto -c BTC -s 25000000 -x 100000 -a 1BTC1NNjeiAmFqe2n1QJjkEa4aMyAhkpKG -p KwDiDMtpksBAcfyHsVS5XzmirtyjKWSeaeM9U1QppugixMUeKMqp
Sending (P2PSH) 0.0019 BTC on testnet to address 2NDN55zZ6BtStckQWnhGJejBdM5EaGcNn7h with fee 5000 satoshis (notice that both input address 2NAMu8JCTLXtTv2LRQktByt1EoKaJaVmDAj and unlocking script 5106519351935387 must be provided):
sendcrypto -a 2NDN55zZ6BtStckQWnhGJejBdM5EaGcNn7h -c TBTC -i 2NAMu8JCTLXtTv2LRQktByt1EoKaJaVmDAj -u 5106519351935387 -s 190000 -f 5000
checkaddress --coin_symbol=<COIN SYMBOL> --address=<ADDRESS> --minimum_input_threshold=<INT> --maximum_input_threshold=<INT>
For example:
checkaddress -c BTC -a 14YK4mzJGo5NKkNnmVJeuEAQftLt795Gec
transaddress --address=<ADDRESS> --input_symbol=<COIN SYMBOL> --output_symbol=<COIN SYMBOL>
For example to translate Bitcoin address 1BTC1NNjeiAmFqe2n1QJjkEa4aMyAhkpKG to Zcash address we enter:
transaddress -a 1BTC1NNjeiAmFqe2n1QJjkEa4aMyAhkpKG -i BTC -o ZEC
transprivkey --private_key=<PRIVATE_KEY> --output_symbol=<COIN SYMBOL>
For example to translate Bitcoin private key KwDiDMtpksBAcfyHsVS5XzmirtyjKWSeaeM9U1QppugixMUeKMqp to Zcash private key we enter:
transprivkey -p KwDiDMtpksBAcfyHsVS5XzmirtyjKWSeaeM9U1QppugixMUeKMqp -o ZEC
genaddress --pattern=<PATTERN> --symbol=<COIN SYMBOL> --output_dir=<DIRECTORY TO STORE QR CODES>
For example if we want to create address with prefix t1aaaa for Zcash coin and save corresponding QR codes to /home/john directory we enter:
genaddress -p t1aaaa -s ZEC -d /home/john
To generate Bitcoin segwit address starting with 3BTC we enter:
genaddress -p 3BTC -s BTC -w
signmessage --coin_symbol=<COIN SYMBOL> --private_key=<PRIVATE KEY> --message=<MESSAGE TO SIGN>
For example proving ownership of BTC address 1HCfFoucNXgYLvpcN2X4TwmUXJjGUMJ2hi:
signmessage -c BTC -p KzReaUKzSaGarrhFhjNMweTrpUx4gqX1KCMFSWJx9374kYNHpmSu -m "Hello World!"
will return: H7Ul0s8Za640duU2MhsifCX1H3Ma2NKRtLvtLYye6mFpZTW0fgXbM//bXq1yeXLHphXi8BUjtBsBHy0zrZjCYsQ=
verifymessage --coin_symbol=<COIN SYMBOL> --address=<ADDRESS> --message=<MESSAGE> --signed_message=<SIGNED MESSAGE>
For example verifying if H7Ul0s8Za640duU2MhsifCX1H3Ma2NKRtLvtLYye6mFpZTW0fgXbM//bXq1yeXLHphXi8BUjtBsBHy0zrZjCYsQ=
is signed Hello World!
message by owner of BTC address 1HCfFoucNXgYLvpcN2X4TwmUXJjGUMJ2hi we run:
verifymessage -c BTC -a 1HCfFoucNXgYLvpcN2X4TwmUXJjGUMJ2hi -m "Hello World!" -s H7Ul0s8Za640duU2MhsifCX1H3Ma2NKRtLvtLYye6mFpZTW0fgXbM//bXq1yeXLHphXi8BUjtBsBHy0zrZjCYsQ=
Coin | Symbol | Address generation | P2PKH transactions | P2SH transactions |
---|---|---|---|---|
Bitcoin | BTC | Yes | Yes | Yes |
BitcoinZ | BTCZ | Yes | Yes | Yes |
Dash | DASH | Yes | Yes | Yes |
Dogecoin | DOGE | Yes | No | No |
Litecoin | LTC | Yes | Yes | Yes |
Safecoin | SAFE | Yes | Yes | Yes |
TENT | TENT | Yes | Yes | Yes |
Smartcash | SMART | Yes | No | No |
Zcash | ZEC | Yes | Yes | Yes |
Zclassic | ZCL | Yes | Yes | Yes |
Zeitcoin | ZEIT | Yes | No | No |
Horizen | ZEN | Yes | Yes | Yes |
Zero | ZERO | Yes | Yes | Yes |
Install pytest, pytest-cov and tox packages:
pip install -r requirements_dev.txt
Run tests and check report htmlcov/index.html:
python -m pytest --cov=./ --cov-report=html
settings.py
. Prefix bytes are usually defined in chainparams.cpp or
base58.h files.Exemplary for Zen we have:
'ZEN': {
'name': 'zen cash',
'address_prefix_bytes': b'\x20\x89',
'secret_prefix_bytes': b'\x80',
'script_prefix_bytes': b'\x1c\xbd',
'params': {'check_block_at_height': True},
'apis': [
{'url': 'https://explorer.zensystem.io/insight-api-zen'}
]
}
FAQs
Tool for translating and creating custom addresses for various cryptocurrencies
We found that multicrypto demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.