registry / @dynamic-labs-sdk/solana / 1.17.0

@dynamic-labs-sdk/solana@1.17.0

⚠ Under review

This package contains the Solana (SVM) integration for the Dynamic SDK.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

Crypto

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 21 file(s), 225 KB of source, external domains: phantom.app

Source & flagged code

2 flagged

dist/index.esm.jsView file

Lines 1-21javascript

1import { a as NotSolanaProviderError, c as isSolanaWalletAccount, d as registerSolanaNetworkProviderBuilder, f as name, i as isSolanaGasSponsorshipEnabled, l as isVersionedTransaction, n as solanaExecuteSwapTransaction, o as isSolanaWalletProvider, p as version, r as signAndSendTransaction, s as solanaConfirmTransaction, t as solanaTransferAmount, u as getSolanaConnection } from "./solanaTransferAmount-BUwYKL-l.esm.js";

2import { t as assertBufferAvailable } from "./assertBufferAvailable-b4xOlERy.esm.js";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.esm.jsView on unpkg · L1

3import { n as SponsorTransactionError, t as addWaasSolanaExtension } from "./addWaasSolanaExtension-CA2poieU.esm.js";

4import "./createWalletProviderFromSolanaStandardWallet-DmmM6Suh.esm.js";

5import { t as addSolanaWalletStandardExtension } from "./addSolanaWalletStandardExtension-jxPULYI0.esm.js";

6import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";

7import { MethodNotImplementedError, WalletProviderPriority, assertDefined, createApiClient, createDeferredPromise, createRuntimeServiceAccessKey, createStorageKeySchema, emitEvent, formatWalletProviderGroupKey, formatWalletProviderKey, getActiveNetworkIdFromLastKnownRegistry, getBuffer, getCore, getDefaultClient, getNetworkProviders, getWalletProviderFromWalletAccount, getWalletProviderRegistry, hasExtension, randomString, registerExtension } from "@dynamic-labs-sdk/client/core";

8import { BaseError, FeeEstimationFailedError, InvalidParamError, SimulationFailedError, getActiveNetworkData, getDefaultClient as getDefaultClient$1, onEvent, onceEvent } from "@dynamic-labs-sdk/client";

9import { Connection, LAMPORTS_PER_SOL, PublicKey, Transaction, VersionedTransaction } from "@solana/web3.js";

10import { WalletProviderEnum } from "@dynamic-labs/sdk-api-core";

11import bs58 from "bs58";

12import * as z from "zod/mini";

13import nacl from "tweetnacl";

15//#region src/addSolanaExtension/addSolanaExtension.ts

16/**

17* Adds the Solana extension to the Dynamic client.

18*

19* This is a convenience function that adds both the Solana Wallet Standard extension

20* and the Dynamic WaaS Solana extension, enabling support for all Solana wallet types

21* including standard wallets and embedded wallets managed by Dynamic's infrastructure.

dist/index.cjsView file

Lines 37-77javascript

37//#region src/isSolanaNetworkProvider/isSolanaNetworkProvider.ts

38/**

39* Type guard function to check if a network provider is a Solana network provider.

40*

41* @param networkProvider - The network provider to check.

42* @returns True if the network provider is a Solana network provider, false otherwise.

43* @notInstrumented

44*/

45const isSolanaNetworkProvider =

Source & flagged code

2 flagged · loading source

dist/index.esm.jsView file

1import { a as NotSolanaProviderError, c as isSolanaWalletAccount, d as [redacted], f as name, i as isSolanaGasSponsorshipEnabled, l as isVersionedTransact... L2: import { t as assertBufferAvailable } from "./assertBufferAvailable-b4xOlERy.esm.js"; ... L191: outAssets: response.outAssets || [], L192: priceData: response.priceData, L193: showTotalFiat: response.showTotalFiat, ... L268: //#region [redacted].constants.ts L269: const PHANTOM_DEEPLINK_BASE_URL = "https://phantom.app/ul/v1"; L270: const PHANTOM_SESSION_STORAGE_KEY = "phantom_session"; ... L382: if (!decrypted) throw new PhantomRedirectDecryptionError(); L383: const decryptedString = getBuffer().from(decrypted).toString("utf-8"); L384: try {

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.esm.jsView on unpkg · L1

dist/index.cjsView file

57Trigger-reachable chain: manifest.main -> dist/index.cjs L57: * This function fetches the transaction fee by compiling the transaction message L58: * and querying the network. It handles both legacy Transaction and VersionedTransaction L59: * formats and includes retry logic for network requests. ... L195: outAssets: response.outAssets || [], L196: priceData: response.priceData, L197: showTotalFiat: response.showTotalFiat, ... L272: //#region [redacted].constants.ts L273: const PHANTOM_DEEPLINK_BASE_URL = "https://phantom.app/ul/v1"; L274: const PHANTOM_SESSION_STORAGE_KEY = "phantom_session"; ... L386: if (!decrypted) throw new PhantomRedirectDecryptionError(); L387: const decryptedString = (0, _dynamic_labs_sdk_client_core.getBuffer)().from(decrypted).toString("utf-8"); L388: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L57

Findings

2 Critical1 Medium4 Low

CriticalWallet Draindist/index.esm.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/index.esm.jsView file

Lines 1-21javascript

2import { t as assertBufferAvailable } from "./assertBufferAvailable-b4xOlERy.esm.js";

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.esm.jsView on unpkg · L1

3import { n as SponsorTransactionError, t as addWaasSolanaExtension } from "./addWaasSolanaExtension-CA2poieU.esm.js";

4import "./createWalletProviderFromSolanaStandardWallet-DmmM6Suh.esm.js";

5import { t as addSolanaWalletStandardExtension } from "./addSolanaWalletStandardExtension-jxPULYI0.esm.js";

6import { assertPackageVersion } from "@dynamic-labs-sdk/assert-package-version";

9import { Connection, LAMPORTS_PER_SOL, PublicKey, Transaction, VersionedTransaction } from "@solana/web3.js";

10import { WalletProviderEnum } from "@dynamic-labs/sdk-api-core";

11import bs58 from "bs58";

12import * as z from "zod/mini";

13import nacl from "tweetnacl";

15//#region src/addSolanaExtension/addSolanaExtension.ts

16/**

17* Adds the Solana extension to the Dynamic client.

18*

19* This is a convenience function that adds both the Solana Wallet Standard extension

20* and the Dynamic WaaS Solana extension, enabling support for all Solana wallet types

21* including standard wallets and embedded wallets managed by Dynamic's infrastructure.

dist/index.cjsView file

Lines 37-77javascript

37//#region src/isSolanaNetworkProvider/isSolanaNetworkProvider.ts

38/**

39* Type guard function to check if a network provider is a Solana network provider.

40*

41* @param networkProvider - The network provider to check.

42* @returns True if the network provider is a Solana network provider, false otherwise.

43* @notInstrumented

44*/

45const isSolanaNetworkProvider =