HashEx Security Blog - Medium

How to Set Up a Framework: a Developer’s Guide

Polly Traore — Thu, 11 Aug 2022 20:56:18 GMT

New developers often don’t know how to set up a framework for smart contract development to make the process as efficient and secure as possible. For developing Solidity smart contracts, we In HashEx, use Hardhat, and for our internal needs, we have created a pre-configured project with the most useful development projects connected to it and set up according to the developers’ needs.

The Useful Effects of Boilerplate

By using boilerplate you can get ready-for-use software out of the box, immediately starting the development of the project.
A prepared README can help with the usage of preset plug-ins:

Coverage shows how well the contracts are covered during testing.
Prettier formats the code to provide a better code style.
Docgen automatically generates contract documentation.
Solhint is a Solidity code linter.
Slither is an automated analyzer for Solidity code with the purpose of vulnerability detection.
Echidna is required for fuzzing/property-based contract testing.

README also includes instructions on contract testing and deployment. It also describes testing if there’s a need to create a fork of a public network.

How to Use the Initial Repository

To start using the initial repository, you have to clone this repository and install the packages it requires. This can be done using the following commands:

If you’re installing it through npm: npm install
If you’re installing it through yarn: yarn

After that, you have to familiarize yourself with the README.md, create a config.js file following the example of the config.example.js file, then insert API keys as well as private keys (this file is located in .gitignore so it won’t be uploaded to GitHub).
After that, you can attempt compilation of the project and launch the tests.
You can also try to run different plugins and make sure that they function properly.
When all this is finished, you can start developing the project.
The repository contains many useful plugins.

Coverage

This plugin assists with writing tests and contract testing. It allows finding the spots within the contract that are not covered by tests and because of that, can potentially contain an error or a vulnerability.

Prettier

This plugin helps with keeping the repository in a presentable condition, including its visual aspect. The main goal is to achieve a quality code style.

It’s recommended to run this plugin every time before the commit or deployment.

Docgen

This plugin assists with writing the documentation for the contract. The documentation written in a specific way (NatSpec) within the contract files, will be converted into a presentable .md file so that anyone attempting to figure out exactly how the contract works, could do it using said documentation.

Solhint

This plugin serves for checking the code’s Security, Style Guide, and Best Practices. It suggests changes that have to be made for the code to follow the commonly used rules of contract writing.

Slither

This plugin specializes in finding potential vulnerabilities within the code, using static analysis. Vulnerabilities such as reentrancy, non-secure external calls, etc. can be discovered with this plugin.

Echidna

This plugin is used for fuzzing/property-based contract testing. It requires writing specific contracts that will be tested. Examples can be found in the repository in the /contracts/echidna-test folder.
The point of this type of testing is to attempt to break the in-contract invariants, that are supposed to always be run. This is how the contract is checked.
It attempts to apply random actions by calling functions in random order with random arguments.
This type of testing isn’t a universal cure, it only assists with testing. There have been cases of a contract passing Echidna testing without a vulnerability being discovered. This happens because not every possible combination is tried, but a specific subcollection.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

How to Set Up a Framework: a Developer’s Guide was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Polarys Smart Contract Audit Report

Polly Traore — Wed, 10 Aug 2022 14:18:21 GMT

HashEx was commissioned by the Polarys team to perform an audit of their smart contract. The audit was conducted between 20/07/2022 and 25/07/2022.

The purpose of this audit was to achieve the following:

Identify potential security issues with smart contracts
Formally check the logic behind given smart contracts.

Information in this report should be used for understanding the risk exposure of smart contracts, and as a guide to improving the security posture of smart contracts by remediating the issues that were identified.

The code is available at the GitHub repositories: @PolarysDAC/polarys-metis-contract and @PolarysDAC/polarys-evm-contract . The code was audited after the commit 9b898e5 (@PolarysDAC/polarys-metis-contract) and the commit 67cbd2b (@PolarysDAC/polarys-evm-contract).

Update: the Polarys team has responded to this report. The updated code is located in the repositories: @PolarysDAC/polarys-metis-contract after the commit 57b2b19 and @PolarysDAC/polarys-evm-contract after the commit c76c99a.

Contract

ERC721B

A fully compliant implementation of IERC721 with significant gas savings for minting multiple NFTs in a single transaction. Includes the Metadata and Enumerable extension.
At the same time, the contract has a very expensive balanceOf() function.

Issues

#01. Floating pragma

Severity: Low
Status: Resolved

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

Contract

PolarysNFTContract

The NFT contract extends ERC721B functionality and with royalty implementation inherited from the OpenZeppelin ERC2981 contract.

The contract has the functionality to change the price of tokens depending on the sale stage.

Contract’s admin role allows to mint tokens to users.

According to the developer, the purchase of NFT is made through the contract DepositContract by calling the depositToken() function, and then a third-party application with the Minter role performs the minting of tokens to the buyer. The contract itself does not provide any guarantees that the right amount of tokens will be minted to the account that purchased them, it all depends on accounts with the Minter role.

Issues

#01. Missing functionality for prices

Severity: Medium
Status: Resolved

The functions setPrivateSalePrice(), setPublicSalePrice() allow to set prices. But these prices are never used when minting (purchasing) tokens.

Without documentation, it is impossible to say about the correct operation of the minting (purchase) of NFT tokens.

Recommendation:
a. Make sure you need to use prices.
b. Make sure the mint function should not use prices.
c. Add documentation.
Update: According to the developer team prices will be used by the third-party application to generate the buyer’s signature.
Note: no third-party application has been audited by the audit team.

#02. Withdrawal of undistributed rewards

Severity: Medium
Status: Resolved

The depositMetis() function allows transferring native currency to the contract. This native currency is supposed to be paid out to some users at the time of minting. After the minting is completed, part of the currency may not be distributed, and it will be blocked in the contract.

Recommendation: We recommend adding a function to withdraw undistributed native tokens after the minting is ended.

#03. Floating Pragma

Severity: Medium
Status: Resolved

#04. AccessControl and Ownable using

Severity: Low
Status: Resolved

OpenZeppelin’s AccessControl authentication model assumes defining specific roles. The contract also uses the Ownable library, although one more role is sufficient instead.

Recommendation: Consider adding one more role instead of using the Ownable library or use the default role from Access control.

#05. Lack of events

Severity: Low
Status: Resolved

The functions setPrivateSalePrice(), setPublicSalePrice(), setRoyaltyFee(), setBaseURI() don’t emit events, which complicates the tracking of important off-chain changes.

#06. Lack of parameters validation

Severity: Low
Status: Resolved

Consider adding validation for input parameters of the setPrivateSalePrice(), setPublicSalePrice(), setRoyaltyFee() functions.

#07. Gas optimization

Severity: Low
Status: Resolved

a. The getRoyaltyFee(), getPrivateSalePrice(), getPublicSalePrice(), depositMetis(), exists() functions can be declared as external to save gas.

b. The require check on L105 is redundant because the same check already exists inside the ERC721B._mint() function.

require(to != address(0), “Should not be zero address”);

c. No need to pause the mint() function using the if statement in L123–125 because the require statement in L106 will not allow to mint more than MAX_SUPPLY value. Moreover, the inheritance of the Pausable contract is redundant as it does not add any useful functionality.

function mint(address to, uint256 quantity) external whenNotPaused onlyRole(MINTER_ROLE) nonReentrant {
 …
 require(_currentSupply + quantity <= MAX_SUPPLY, “Can not mint NFT more than MAX_SUPPLY”);
 …

_currentSupply += quantity;
 
 if (MAX_SUPPLY == _currentSupply) {
 _pause(); 
 }
 …
 }

d. The state variables _current Supply, _royaltyFee are read several times in the mint() function. Consider adding local variables for these values to save gas.

e. No need to use a special variable metisBalance for contract balance. Using address(this).balance in L108 will save gas.

f. Instead of declaring and reading _currentSupply storage variable, ERC721B _owners.length can be read.

Contract

DepositContract

The contract allows depositing ERC20 tokens with specifying the quantity of NFT tokens. The deposit can only be made by users with the Deposit role.

Users who have admin permission can withdraw deposited ERC20 tokens to any address.

According to the developer, the contract allows accepting payment for NFT in other chains. After payment, the contract emits events that must be processed by third-party applications. Based on these events, users will be able to receive NFT tokens on the Metis network. At the same time, the audit team did not audit third-party applications and warns of the possibility of exceeding the number of purchased NFT tokens on different networks by the maximum possible number (MAX_SUPPLY = 2500) of minted tokens by the PolarysNFTContract contract in the Metis network.

Issues

#01. Replay of depositToken()

Severity: Medium
Status: Resolved

A user who has a signature that allows the function depositToken() to be executed can replay his call several times until the deadline arrives. This will emit multiple events with the same parameters.

Recommendation: We recommend verifying the signature against reuse.

#02. Floating pragma

Severity: Low
Status: Resolved

#03. Simultaneous usage of AccessControl and Ownable

Severity: Low
Status: Resolved

OpenZeppelin’s AccessControl authentication model assumes defining specific roles. The contract also uses the Ownable library, although one more role is sufficient instead.

Recommendation: Consider adding one more role instead of using the Ownable library or using the default admin role from AccessControl.

#04. depositToken() params check

Severity: Low
Status: Resolved

The params amount and quantity of the depositToken() function are not checked and may content unexpected values.

Update: According to developer the amount parameter is checked on the third-party application (backend).

#05. Lack of event

Severity: Low
Status: Resolved

The function setupAcceptToken() doesn’t emit events, which complicates the tracking of important off-chain changes.

#06. Lack of parameter validation

Severity: Low
Status: Resolved

The setupAcceptToken() function does not check the address token for a non-zero value.

#07. Gas optimization

Severity: Low
Status: Resolved

a. The setupAdminRole(), setupDepositRole(), setupAcceptToken(), getAcceptToken() functions can be declared as external to save gas.

b. The internal function toBytes32() is never used in contract code and can be removed to save gas on deployment.

#08. Changing _acceptToken and further withdrawal

Severity: Low
Status: Resolved

The contract owner can change _acceptToken using the setupAcceptToken() function. This will block the ability to withdraw previously deposited tokens with a different address.

Recommendation: Consider adding the additional paramater tokenAddress into withdrawToken() funсtion. It will allow withdrawing any token at any time by the admin.

#09. Excessive MerkleProof check on depositToken()

Severity: Low
Status: Resolved

The parameter status of the function depositToken() denotes the type of sale: private or public.
This parameter is also included in a signature created by a third-party app. Additionally, the third-party application generates a list of addresses allowed for private sale. This is done using the Merkle proof pattern.
Thus, both the third-party application and the contract do the same work twice. In our opinion, adding the status parameter is enough to identify the purchase in the private mode. And there is no need to use on-chain MerkleProof verification.

#10. Typos

Severity: Info
Status: Resolved

Typos reduce the code’s readability:
in L96-L98 ‘receipient’ should be replaced with ‘recipient’.

Conclusion

3 medium, 13 low and 1 info severity issues have been resolved in the update. 1 low and 1 informational severity issues were added in the update.

The contracts are highly dependent on third-party applications and the owner’s account. Users using the project have to trust the project team, owner and that the owner’s account is properly secured, and that the third-party applications work properly.

We strongly suggest adding documentation as well as unit and functional tests for all contracts.

This audit includes recommendations on improving the code and preventing potential attacks.

Note: no third party application has been audited by the audit team.

HashEx website: https://hashex.org
Request an audit

Polarys Smart Contract Audit Report was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Three Biggest Solana Security Breaches

Polly Traore — Fri, 05 Aug 2022 18:09:25 GMT

Recently, one of the biggest and most unexpected hacks targeted the Solana blockchain. As always, experts offer their opinions, and the company offers rewards, but we think the time’s ideal to review the most notorious security breaches on Solana and connected projects.

Solana Wallets: ~$6 million

Over $6 000 000 in SOL and USDC was taken from Solana wallets on August 4, 2022. Approximately 8 000 wallets were attacked while the hacker used private keys to get a hold of the funds.
When some unusual activity was first noticed on phantom wallets on the chain, news started appearing, stating that users are transferring funds from their Solana wallets in massive amounts. Phantom quickly informed that the issue was not Phantom-specific.
Turned out that Slope and Phantom wallets were attacked by hackers, who then siphoned funds from them. In this case, the first recommendation from security experts is to remove the wallet’s access to all dApps as soon as possible. However, the already affected accounts are left with no options. Right now there are two possible hypotheses. One of them is a supply chain attack, while the other is a browser exploit. Although the latter seems unlikely since it’s been noted that only Solana suffered the effects of the hack.
Solana representatives are still trying to collect data from users to discover the cause of the issue.

Wormhole bridge: ~$325 million

On February 2, Wormhole portal, a bridge platform for transferring cryptocurrency between Solana and Ethereum suffered a massive hacker attack, resulting in the loss of over $325 million worth of various tokens. This was certainly one of the biggest hacks on Solana.
Wormhole, which was launched in August 2021, informed users of the attack, immediately closing the network for maintenance to look into the situation.
It turned out that approximately 120 000 $WETH had been stolen.
Wrapped ETH tracks the value of ETH, so it’s not just a popular asset, it’s considered one of the most stable for investments and trading.
The reason for the attack was discovered shortly after, and the vulnerability that had led to the event was fixed. The details of the issue itself, unfortunately, were not disclosed by the Wormhole representatives.
While the reason for the hack wasn’t Solana itself, the attack still affected its users.

CremaFinance: $8.7 million

Another recent attack, that targeted the users of this chain, occurred in July 2022. A Solana-based liquidity protocol CremaFinance had to temporarily suspend its service, following a big exploit.
CremaFinance is a liquidity network with a concentrated liquidity market maker built on and for Solana.
Losses amounted to $8.7 million after a vulnerability in Crema’s tick account was exploited. A tick account usually stores price information, that is later used for calculating transaction fees. Authentic data regarding fees was replaced by the hacker, so they managed to claim a large fee amount from the liquidity pool.
A malicious contract was also deployed to execute six flash loans from Solend (Solana lending service), with the goal of adding liquidity to Crema.
Among the taken cryptocurrencies were tether coins and staked Solana.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

Three Biggest Solana Security Breaches was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

AnalytEx Updates Now live. Data for everyone

Max Nekoz — Thu, 04 Aug 2022 19:34:40 GMT

AnalytEx has already become one of the most convenient and informative data providers in the industry, and it is constantly updated with new opportunities for money makers and developers. The team is proud to present a new version of our core product.

What’s new?

Lending Aggregator interface has been completely reworked. It is more convenient than ever before!

AnalytEx lending aggregator

You can search lending opportunities by token name, filter by chains, stablecoins, or protocols.
New incredible indicators allow users to monitor changes in key indicators of each protocol in order to make the right and informed decision.
You can connect your wallet and see statistics on used lending protocols in one convenient place. In the next updates, users will be able to track all their assets on one page!

AnalytEx lending aggregator

Utilization rate is available! It is one of the most important indicators in DeFi lending. Utilization Rate is a ratio of deposited funds to borrowed. High liquidity (and thus, a low Utilization Rate) allows users to borrow assets at lower rates, and guarantee that suppliers are able to withdraw funds at any point in time. There might be situations when you put your assets into a lending protocol, and at some stage when a protocol pool is highly utilized, not able to withdraw. This happens when utilization rate exceeds a certain threshold, and there is not enough or zero liquidity left. The optimal Utilization rating values — up to 80%.

AnalytEx lending aggregator

Navigation menu has been updated. You can explore Charts and stats, Crypto prices, the Earn section with Farm and Lending aggregators, and the Learn section with Documentation and Glossary.

Charts and stats section provides users with an opportunity to follow all changes in different, interesting statistics by Chains (Ethereum, BSC, BSC testnet, Avalanche, Polygon, Fantom, and Gnosis.
You can follow charts by Transactions, Blocks, Gas, and Addresses/wallets. AnalytEx engine can differ smart contract and wallets signatures, which is amazing!

AnalytEx charts and stats

Crypto Glossary is available. Blockchain and cryptocurrency terms for our users. It is updated and becomes bigger every day.

Do not forget you can make us better with your ideas: https://analytex.today/contacts.html

Follow our Twitter and get access to Data-Driven news: https://twitter.com/AnalytexToday

Don’t forget about HashEx and CryptEx updates:

Announcement Channel

Twitter

AnalytEx Updates Now live. Data for everyone was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

HashEx Monthly News Digest

Polly Traore — Fri, 29 Jul 2022 16:24:23 GMT

In the last days of July, it’s time to review the results and news from our projects. This month was productive and our teams have a lot to share.

July Security News

Attack on Quixotic

The largest NFT platform that runs on Optimism came under attack at the top of the month. Hackers managed to breach the system’s security and drain its ERC-20 tokens in the amount of $100 000.
In the update to the marketplace contract, the “offer” feature has been compromised. The project quickly addressed the issue promising to refund the lost tokens.
A detailed overview of this event is available at Cryptopotato.

Omni Under Attack

Omni NFT marketplace was attacked by malicious actors on July 10. The attack reportedly has been a result of a reentrancy vulnerability exploit. It resulted in a massive loss in the amount of 1,300 ETH ($1.43 million). According to the Blocksec CEO, the attacker deposited NFTs from a Doodles collection and used them as collateral for borrowing $WETH.
A full report on the attack is available in this The Block article.

Hackers Target Audius

Another massive attack occurred on the music streaming protocol Audius on July 24.
The hacker has been able to modify smart contracts used by the governance system of Audius. The changes allowed them to become the guardian of the contract.
Through an unauthorized transfer, the attackers took out 18 million of AUDIO tokens from the community treasury.
The full story is available here.

Developer Updates From HashEx

New Partnership

On July 6 we announced a new partnership between HashEx and PandaSale. HashEx will be PandaSale’s newest trusted audit partner!
PandaSale is an all-in-one, next-generation Launchpad for EVM-powered networks. HashEx will assist in delivering security to the projects launched on the platform.

Iron Bank is live on AnalytEx!

This July AnalytEx Lending Protocols started supporting Iron Bank lending! Select Iron Bank from the protocols dropdown to view.
AnalytEx lets you discover all the best borrowing/lending opportunities. Everything is available in one place.
Try it for yourself here.

Notable Audits

Three notable audits have been ordered this month:
• HashEx has started the process of auditing MetaWin.
• Ambidex has ordered an audit from HashEx.
• HashEx has started the process of auditing Polarys, the first European-compliant one-stop shop for utility-based NFTs from trusted businesses.

HashEx and CryptEx in Media

July 1: An expert opinion by Dmitry Mishunin regarding defense against attacks on DeFi was released on Cointelegraph.
You can read the full article here.

July 6: Crypto.news released an article based on the AnalytEx research regarding Ethereum gas fees.
The full article is available here.

Another expert opinion by Dmitry Mishunin was published in Daily Hodl. This time, it’s about key issues of Web 3.
Get familiar with the matter here.

July 11: Olga Ortega from AnalytEx speaks to Cryptonews about DeFi terminology. She explains to the readers what are pools and farms of DeFi protocols.
The article is available here.

July 14: Daily Hodl released an article based on research about ETH gas prices by Olga Ortega.
Read the full article here.

July 22: An interview with Dmitry Mishunin about DAO attacks is available on TechMonitor.
Read the interview here.

CryptEx Stats:

954 projects
$14.3M locked
$309,596 market cap
$248,569 Fees Generated

HashEx Monthly News Digest was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Warning: New Type of Scam

Max Nekoz — Thu, 28 Jul 2022 19:19:47 GMT

In the world of decentralized finance, there are still many scammers who come up with new ways to steal your funds.

Many members of our team and even the main accounts of the HashEx DeFi Intelligence ecosystem have recently received similar messages from various Twitter accounts.

The Real Scam Example

They all say that they received some kind of large amount and cannot withdraw it, promise to pay you for help, and send a seed phrase from their wallet.

The Real Scam Example

Never share a seed phrase — this will lead to loss of your funds.

The scam works in such a way that when you access this wallet, you will actually see the amount on the balance, but you will need a native token of the network in which these funds are located, for example, for any transaction on the BSC network, you will need a small amount of BNB on balance.

As soon as you transfer the network’s native token to this wallet, an automatic script will instantly redirect your asset to another address using a large amount of gas, you will simply lose your funds!

It is noteworthy that the Twitter accounts of such scammers are very similar, they are newly registered, they have no followers, and few followings.

The scam account example

Be careful and attentive! Subscribe to our social networks to keep abreast of the latest news in the field of blockchain security and data analysis.

Announcement Channel
Twitter
https://twitter.com/AnalytexToday

Warning: New Type of Scam was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

NFT Safekeeping

Polly Traore — Fri, 22 Jul 2022 15:40:33 GMT

In a matter of months, NFTs have become one of the most popular types of crypto investment and trading. They’ve made people rich and helped build and grow businesses. Sadly, there’s no surprise in NFTs becoming a constant target for hackers. In this article, we are reviewing the best practices for safe trading and storing your NFTs.

How do I store NFTs?

You would probably keep an expensive work of art under a lock or glass. It’s more or less the same way with an expensive token. However, bear in mind that NFT isn’t the artwork itself as much as proof of ownership. Basically, a token proves that you own a file with the digital artwork.

Buying an NFT gives you a private key, that has to be a- kept private, and b — stored in your digital wallet. A private key gives you access to the NFT and allows you to transfer it if needed. If you’re dealing with valuable NFTs, you certainly want to keep your investments secure.

The NFT industry is still relatively new, but the potential earnings are large, which makes the market a constant target for exploits. The most relevant information that all crypto attackers will be trying to get a hold of, is your private key and your seed phrase. Meaning you have to make sure that your crypto wallet is as secure as possible.

For that, you have to be extra careful with what sites you connect your wallet to, as well as the links you open. Scammers often send out suspicious links that require you to log into your account and use your data to gain access to your funds.

Another NFT scam involves raffles and giveaways usually from NFT artists or in this case, scammers pretending to be artists. Social networks such as Twitter, Instagram, and Discord. They provide links that require logging in or providing personal data, so make sure to double-check every bit of information before partaking in any events.

Tips for Safekeeping

There’s a set of helpful tips for those who want to avoid having their NFTs accessed by anyone else.

Use two-factor authentication on all your accounts. This will require confirmation via email or a text message.
Always check the accounts inviting you to participate in giveaways, drops, or campaigns.
Use link-checking tools before entering your data.
Store your seed phrase and private keys in a secure place.
Use cold wallets for your most valuable NFTs.

As always, be mindful of your investments and their safety.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

NFT Safekeeping was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

5 Crypto Wallets for Your Tokens

Polly Traore — Fri, 08 Jul 2022 13:14:33 GMT

Step one for decentralized financial activity always includes getting a crypto wallet. Just as the name suggests, a crypto wallet serves as the holding place for your finances. However, that isn’t the only purpose crypto wallets serve. Just like your average bank application, they allow transferring of currency, exchange, lending, and borrowing.

All these processes have to be secure to avoid the loss of funds or granting access to third parties.
If you are interested in crypto wallet security, we recommend this article: Keeping an eye on your crypto wallet

Otherwise, let’s take a look at the most popular wallets and what they have to offer.

Types of wallets

Before we begin, let us quickly remind you that there are several types of wallets with each one being more suitable for a specific type of activity and holdings.

There are cold wallets — hardware wallets designed to safely keep large amounts of savings. They are the most secure type since all the transactions are signed with a key and connect to the Internet only to upload the transaction to the blockchain.

Hot wallets are more common. They are always online, but because the finances are technically held by a third party, they are far less secure. These wallets are ideal for quick transactions, trading, and small holdings. They also offer additional features. We are going to review several hot wallets for users.

Best Wallets

Guarda Wallet

Right away, this wallet offers wide possibilities: buying, storing, swapping, and staking cryptocurrency from various chains. Despite it being a relatively new addition to the market, Guarda provides high levels of security.

It can be accessed via a browser extension, a separate app, or a web interface. Ease of navigation and simple design allow new users to easily get the hang of the system and take advantage of its features.
There is a downside to this wallet, as many users report that in-app purchases within the wallet are pricey.
However, you know what you’re paying for: over 400 000 currencies, multisig wallets, Face ID support, and customer service.

Coinbase Wallet

Coinbase doesn’t need an introduction, the company’s been well known in the market, and the wallet is its response to public demand for a non-custodial solution for storing and trading currency. Coinbase wallet supports thousands of currencies, including NFTs. It’s widely popular because of its low fees, since only network fees are charged, and access to web3 apps.
Coinbase, however, is not an open-source wallet, and its support can’t rival Guarda’s.
Still, this wallet is secure and offers a wide list of features.

MetaMask Wallet

MetaMask is certainly one of the most popular crypto wallets among all crypto aficionados with approximately 30 million active users. It allows the use of almost any network, including, of course, Ethereum. And for ETH, it’s considered one of the best options. The interface is user-friendly even for beginners. It’s also free with only transactional fees.
MetaMask Wallet has apps for smartphones, browser extensions, and an online version.
The code is open-source, and everyone can review the security measures taken by the developers. Users appreciate what this wallet has to offer: private keys and access codes are not stored on MetaMask servers.

Exodus Wallet

Another wallet with a beginner-friendly interface. Aside from regular features i.e. storing cryptocurrency, Exodus supports exchange and staking. It’s available on both desktops and smartphones. So users can access the app whenever they need it.
Exodus offers speedy transactions and it’s worth noting that the wallet is compatible with hardware wallets designed by Trezor. So if you are dealing with large amounts of cryptocurrency, you can keep it as safe as possible, while being able to quickly access it.
Once again, while Exodus is considered a safe option, the wallet is not open-source.

Mycelium Wallet

This is one of the leading mobile wallets. It supports Bitcoin, Ethereum, and ERC-20 tokens. There are also features that Mycelium can provide: spending accounts, saving accounts, and even cold storage integration. It’s good not just for storing, but for managing your cryptocurrency. Tokens can be purchased through the app too.
Mycelium code is open-source and security is clearly a priority for the developers. However, the wallet is only available as an app, and its design isn’t exactly beginner-friendly.
Otherwise, this wallet is a good fit for advanced crypto traders.

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

5 Crypto Wallets for Your Tokens was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

HashEx News Digest

Polly Traore — Fri, 01 Jul 2022 12:50:21 GMT

It’s June and the perfect time to summarize the results of the first half of 2022. This year is a big one for HashEx, we have many exciting news and developments, and we are happy to share them with our clients, partners, and users.

HashEx Projects and Developments

AnalytEx: advanced analytics for DeFi

This year marks the development of one of our newest and most elaborate projects that is bound to bring more efficiency to DeFi — AnalytEx.
At the same time, AnalytEx presents its own ecosystem that contains multiple tools for easier analysis of the available investment opportunities.

An easy-to-use app with various aggregators of financial data is available to traders and project owners.

With a beta version launched in March, and the official release soon after, AnalytEx quickly captured attention so much so that it took part in the Benzinga Global Fintech Awards in 2 categories: Best API and Best Data Analysis Tool. The results will be announced this December.

AnalytEx is here to redefine DeFi Intelligence

You can access the full information regarding AnalytEx and try out the app at AnalytEx.Today.

CryptEx: Security Ecosystem for Liquidity

HashEx continues the development and updates of its CryptEx tools. CryptEx Token Constructor has held several promotional campaigns offering discounts for building pre-audited ERC20/BEP20 and RFI tokens.

In fact, several projects have created their own tokens, using the Constructor. Among them, Crazycoin, launching the $CZC token, and Shopperoo with its $SRO token.

CryptEx Locker continues to keep the liquidity secure with no issues. In fact, the contract has been updated on March 5 adding support for new swaps and networks.

The staking contract for the $CRX token has also been updated on January 20th, providing an improved system for receiving rewards.

To celebrate a successful year, CryptEx has launched its own line of NFT tokens — CryptEx Super Puppies are still available to mint! Each one has its own unique features.

HashEx: Smart Contract Audit and Development

For HashEx itself, these six months have been more than eventful.

First and foremost, meet our new and improved website! More information, more details, and easier navigation. All of this is to make your DeFi security journey as seamless as possible! Check it out: HashEx.org.

The company has audited an enormous number of different projects. Among them are:
Stoneage NFTs, WannaSwap, DeFi Helper, Omicron Rocket, Embers, BlueBit Finance, EvmoSwap, Fringe Finance, and many others.

HashEx team members submitted their articles and expert opinions to several major DeFi media such as Cointelegraph, CoinDesk, CryptoNews, Bitcoinist, Hackernoon, and CryptoSlate. You can follow HashEx media updates in our Monthly News Digest.

That’s not nearly all, because, in the first half of 2022, HashEx gained a whole bunch of new partners. The list includes well-established and new promising projects alike: Kommunitas, ApeLab, Liquid Collectibles, DxLaunch, TitanX, HedgePay Lauchpad, AuditOne, Token Space, and The Crypto Launchpad.
There’s also a very special collaboration with CleanCarbon, a project that employs DeFi to help the environment. We are infinitely proud to support such an admirable effort.
Our network is growing, and with it, DeFi security improves. HashEx is fulfilling its mission to make DeFi SAFU.

Don’t forget our free tools, because we don’t: ABI Encoder has been updated, and an option to encode struct argument with existing ABI was added. You can check the news here.

HashEx Team continues to grow, and we have so much more upcoming events and projects, that we can’t wait to share more news with you!
Here’s to the next 6 months!

Follow HashEx DeFi Intelligence Ecosystem:
Announcement Channel
Twitter

HashEx News Digest was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

AnalytEx update is life“Crypto Prices”

Max Nekoz — Thu, 23 Jun 2022 19:18:45 GMT

AnalytEx is updated and becomes better every day. Today our team is ready to present an update with a new feature. Our mission is to create a product that combines services for money makers and developers in one convenient place!

What’s new?

Crypto price is a price-tracking solution for crypto assets that allows users to follow cryptocurrency prices, total supply, and market cap changes. AnalytEx does not use 3rd party services to follow changes, it auto-detects and lists new ERC-20 tokens data, and takes them all directly from a blockchain without any delays.

It is possible to open a detail page of any cryptocurrency with a “View” button.

Farm Aggregator has been redesigned according to feedback from our users. It has become even more understandable and convenient. No more missed opportunities!

Roadmap of AnalytEx has been updated! Here is its current version:

Do not forget you can make us better with your ideas: https://analytex.today/contacts.html

Follow our Twitter and get access to Data-Driven news: https://twitter.com/AnalytexToday

Don’t forget about HashEx and CryptEx updates:

Announcement Channel

Twitter

AnalytEx update is life“Crypto Prices” was originally published in HashEx Security Blog on Medium, where people are continuing the conversation by highlighting and responding to this story.

HashEx Blog

Sharing useful information about the blockchain

Let's Work Together! Write now.