DEV Community: carson

AI + Foundry's cast: how I investigate smart contracts now

carson — Thu, 19 Mar 2026 12:16:24 +0000

I deploy Solidity contracts on HyperEVM. When the chain first launched in early 2025, the tooling around it was rough.

The indexers couldn't access historical state. Subgraphs broke when you tried to query past blocks. The public RPC was rate-limited to 100 requests per minute. Block explorers showed incomplete data or wrong transaction hashes (a known issue where HyperEVM's S3-based block publishing caused hash mismatches with community tools like nanoreth).

If I needed to investigate a contract — check its state, trace a transaction, understand what some unverified bytecode was doing — I did it the old way.

The old way

Write a script. Call eth_getLogs. Decode calldata manually. Piece it together from whatever fragments the broken tooling gave you.

Something like this:

import { createPublicClient, http, parseAbi } from 'viem';

const client = createPublicClient({
  transport: http('https://rpc.hyperliquid.xyz/evm'),
});

// Read contract state manually
const owner = await client.readContract({
  address: '0x815687F03D2Bab77Dd25237ae7f28bf599aBc2ee',
  abi: parseAbi(['function owner() view returns (address)']),
  functionName: 'owner',
});

// Get logs, filter, decode each one, cross-reference...
const logs = await client.getLogs({
  address: '0x815687F03D2Bab77Dd25237ae7f28bf599aBc2ee',
  fromBlock: 0n,
  toBlock: 'latest',
});

// Now you're manually decoding event data, matching selectors,
// figuring out what happened and in what order.
// On a chain where the explorer barely works.

This works if you already know the ABI. If the contract isn't verified (common on new chains), you're looking at raw bytecode and guessing function signatures from 4-byte selectors.

On Ethereum with Etherscan and working indexers? Annoying but manageable. On HyperEVM in early 2025? A full day for one contract.

What changed

AI coding agents (Claude Code, Cursor, etc.) can now use CLI tools directly. Foundry's cast is one of the most useful CLI tools for EVM interaction. Combine the two and you get something that actually works.

Here's what the AI agent runs when I point it at a contract:

# Read bytecode, check if there's anything to work with
cast code 0x815687F03D2Bab77Dd25237ae7f28bf599aBc2ee \
  --rpc-url https://rpc.hyperliquid.xyz/evm

# Read storage slots directly (slot 0 is usually owner in Ownable)
cast storage 0x815687F03D2Bab77Dd25237ae7f28bf599aBc2ee 0 \
  --rpc-url https://rpc.hyperliquid.xyz/evm

# Call known functions without writing a full script
cast call 0x815687F03D2Bab77Dd25237ae7f28bf599aBc2ee \
  "owner()(address)" \
  --rpc-url https://rpc.hyperliquid.xyz/evm

# Trace a specific transaction
cast run 0x<txhash> --rpc-url https://rpc.hyperliquid.xyz/evm

# Decode calldata without knowing the ABI
cast 4byte-decode 0x<calldata>

The key: I don't run these myself anymore. I give the agent an address and a question. "What does this contract do?" or "Who can call the withdraw function?" or "Trace the last 5 transactions and tell me where the funds went."

The agent decides what to query, runs the commands, reads the output, runs more queries based on what it found. Thirty to forty calls later, I get a summary.

Five minutes instead of a day.

Setting it up

The tool that makes this work: foundry-mcp-server. It wraps the entire Foundry toolchain (cast, forge, anvil) plus Heimdall (a bytecode decompiler) into MCP tools that any compatible AI agent can use.

If you're on Claude Code:

claude mcp add foundry-mcp-server -- npx @pranesh.asp/foundry-mcp-server

Set your RPC:

export RPC_URL=https://rpc.hyperliquid.xyz/evm

Now your AI agent can read contract state, trace transactions, decode calldata, decompile unverified bytecode, and deploy contracts. All through natural language.

There's also evm-mcp-tools if you want Etherscan and Moralis API integration for chains with decent explorer support.

Where it falls apart

Simple investigation: AI handles it. "What does this contract do?" "Who deployed it?" "What's the token balance at this address?" All fast, all correct.

Medium complexity: AI speeds you up. It does the grunt work (reading storage, tracing calls, decoding events) and gives you a starting point. You take it from there.

Hard stuff: AI hits a wall. Some examples from my own work:

Chain-specific infra bugs. HyperEVM had a phantom hash problem where the block explorer showed different transaction hashes than the official RPC. The cause: nanoreth (a community tool that reads Hyperliquid's S3 block data) encodes system transaction signatures differently from the official node. No AI would figure this out without that context.

Complex proxy patterns. AI can identify that something is a proxy. Understanding the upgrade path and storage layout across multiple implementations still takes manual work.

Business logic with external dependencies. I built a lottery contract that uses Pyth Entropy for on-chain randomness with a specific callback pattern. AI can read the code, but it can't tell you if the Pyth integration handles edge cases correctly without understanding Pyth's callback lifecycle.

Anthropic published a benchmark (EVMbench, March 2026) where the best AI model scored 45.9% on vulnerability detection. When given hints about where to look, that jumped to ~90%. The bottleneck is finding where the problem is, not understanding it.

That tracks with how I use it. Point the AI at something specific and it's fast. Ask it to find issues in a big project with no direction and it struggles.

Is it worth setting up?

Yes. This is the biggest quality-of-life change I've had as a Web3 developer this past year. Not because AI is better at contract analysis than me. But it removes the dumb, repetitive work that used to eat hours.

On newer chains where the tooling hasn't caught up (and on HyperEVM, it still hasn't fully), having an AI agent that queries the RPC directly and makes sense of raw data is the difference between a productive day and a wasted one.

Try it. Point it at a contract you already understand and see if it gets it right. Then point it at something you don't know.

I build DeFi products on Hyperliquid and work as a fullstack Web3 engineer. More at olafkrason.xyz.

I turned my private UI workflow into an open-source Agent Skill

carson — Fri, 06 Mar 2026 17:04:21 +0000

For a long time, this wasn't a skill.

npx skills add carson2222/skills --skill design-exploration

It was just a workflow I kept in my head.

Every time I used AI for frontend work, I ran into the same problem: the result often looked decent, but it rarely felt genuinely designed. Too much of it landed in the same visual territory - safe layouts, familiar patterns, polished but forgettable output.

So I started adjusting the way I worked.

Instead of asking for one result and trying to polish it, I pushed the agent to explore multiple real directions at once. Not tiny visual tweaks. Real variants with different structure, hierarchy, tone, and emphasis.

That changed a lot.

It made the process feel closer to actual design exploration instead of autocomplete with Tailwind.

Over time I kept refining that workflow. I changed what I asked for, what I forbade, how I framed constraints, how I handled existing design systems, and how I compared options. Eventually it became repeatable enough that it stopped feeling like "a good prompt" and started feeling like a tool.

That's where design-exploration came from.

A shoutout is deserved here too: one of Theo's design prompts was an early spark for this line of thinking. The idea of having the agent generate multiple variants instead of obsessing over one first try was a strong starting point. But the version I use today is something I tuned heavily through repeated real use.

Another reason I finally packaged it properly is simple: people kept asking for it.

Friends and coworkers saw the kind of output I was getting and wanted to try the same workflow themselves. At some point it became obvious that keeping it as a private mental prompt was silly. Wrapping it as a skill made it easier to reuse, easier to share, and easier to improve.

I mostly use it with OpenCode and Opus 4.6. That combination has been the most reliable for me by far. Other models can absolutely produce strong UI, but they tend to be less predictable. For this kind of work, predictability matters almost as much as quality.

One important thing, though: this is not magic.

You still need to give the model context. You still need to explain what the product is, who it is for, what kind of feeling you want, and what tradeoffs matter. If you have assets, references, or constraints, give them. The better the context, the better the exploration.

The skill helps structure the process.

It does not replace taste.

If you want to try it, the repo is here:
https://github.com/carson2222/skills

If there's interest, I'll write a follow-up on the exact workflow, what usually fails, and how I avoid the most common AI frontend traps.

How AI screws our projects

carson — Wed, 23 Jul 2025 11:01:35 +0000

As an efficient programmer, I've been using AI tools like Copilot or Cursor in my daily life. It definitely speeds up the whole process and makes it easier to ship real products.

However, there is a big problem with using tools that powerful.
Back in the day, when you encountered a problem, you just had to Google it. If there was no easy way to fix it, you'd either have to deep dive into the concept you were struggling with or get help from someone else.
Then someone else (or you, with more knowledge about the topic) could look deeper into the code and find that the whole problem was in your approach. Instead of just dully fixing the issue, maybe you should change the whole approach — use other tools, libraries, or re-write the whole structure in a more efficient way?

With AI, solving problems looks completely different.
When you encounter a problem you can’t solve on your own, you just prompt it to an AI and boom — it gets solved. AI just finds a way to fix it. The code itself might work, but it can be very poor.

Why am I writing this?
Recently, I was doing a freelance project for a client. Everything was going great, and I had a deadline I’d easily meet. But one day, when I was out of the house with not much free time, the client asked me to make a "demo" example for the next day. The app was working, with some flaws I had to fix ASAP. So I just opened a Gemini CLI and started prompting. After a few unsuccessful prompts, I was finally able to fix the issues and finish the demo version.
When I got back home, I started working on the project again. I looked at the code that AI had generated — it was awful. Then, on my own, I reviewed the whole codebase and realized the problem was much deeper. I just didn’t need that thing at all.
If I had trusted the AI fully, I would’ve ended up with a useless feature that just litters my app.

I believe I’m not the only one. Situations like this happen every day, and some people never realize how much AI screwed their code.
Let’s start being more like real programmers instead of vibe coders.

Build Your Own Twitter AI Bot: The Ultimate Guide

carson — Mon, 10 Mar 2025 19:29:05 +0000

How to Create Your Own Twitter AI Agent

Introduction

Recently, I received a freelance offer to create a Twitter AI Agent. It sounded like a cool experience, so I decided to take on the challenge. I used ElizaOS, a framework built by the ai16z community that makes creating AI Agents much easier. After spending some time with it, I can confidently say that it has great potential. It just needs a bit more polish. Its main focus is to make AI Agent creation super user-friendly. I didn’t have to do much "coding," but a non-programmer might run into some challenges.

One major issue I faced was the new update. Just a few days after I started working with ElizaOS, a major update was pushed. There were tons of guides, videos, and documentation on the old version, but I wanted to use the latest one since it had crucial new tooling. Since there were barely any resources on setting up the new version, I had to figure everything out through trial and error.

In this article, I aim to save you time and make the setup process much easier. I won’t explain the entire ElizaOS framework—it’s massive with tons of tools and use cases. Instead, I'll provide a straightforward starting point, from which you can expand your AI Agent as needed.

Project Initialization

Before cloning the ElizaOS project, make sure you have the following installed:

Node.js 23+: Download and Install
pnpm 9+: Installation Guide
Git
GitHub CLI

Clone the Repository

There are multiple ways to initialize the project. The following worked best for me:

gh repo clone elizaOS/eliza

git clone git@github.com:elizaOS/eliza.git

Navigate into the project directory:

cd eliza

Switch to the development branch:

git checkout develop

Install dependencies:

pnpm install

Build the project:

pnpm build

Handling `sqlite3` Errors

If you encounter an error related to sqlite3 during the build process, run the following command and retry the build:

pnpm exec npm rebuild better-sqlite3

If any other issues arise during initialization, check the AI documentation, GitHub issues, or ask for help on their Discord server.

Setup the Environment File

Copy .env.example to .env:

cp .env.example .env

Start the Agent (Test Run)

To ensure everything is set up properly, let's run a sample chatbot. There’s already a built-in character sample we can use.

Start the AI Agent:

pnpm start

In a new terminal, start the built-in chat UI:

pnpm start:client

Now navigate to:

http://localhost:5173/

You should see a chatbot interface where you can interact with the default AI Agent.

Create Your Own Character

Creating a character personality file (.json) hasn't changed much in the new version, so the existing documentation is helpful. The best way to refine your AI Agent’s personality is through trial and error.

Here’s a tool to assist with character creation:

ElizaGen

Character examples for reference:

GitHub Character Repository

Save your character files in the /characters folder.

To use your custom AI Agent, start the program with a character flag:

pnpm start --character="characters/myai.character.json"

Download the Twitter Plugin

Adding plugins in ElizaOS is straightforward. Simply run one command and configure your character file.

Here’s the list of official ElizaOS plugins:

Plugin Registry
Or run:

  npx elizaos plugins list

To install the Twitter plugin:

npx elizaos plugins add @elizaos-plugins/client-twitter

Then, modify your character’s JSON file to enable the plugin:

{
    "clients": ["twitter"],
    "plugins": ["@elizaos-plugins/client-twitter"]
}

Set Up Your AI Provider

Running your own AI model locally (e.g., DeepSeek) would be great, but AI models require significant resources. Using an external AI provider is usually more practical.

I found Heurist to be the best provider:

Simple setup
Affordable
Accepts crypto payments
Offers various AI models, including uncensored ones

Steps to Set Up Heurist:

Sign in to Heurist
Deposit some credits (even a few cents are enough for testing)
Generate and copy your API Key
Add the API Key to your .env file:

HEURIST_API_KEY=YourApiKey

Set your preferred AI models:

SMALL_HEURIST_MODEL=deepseek/deepseek-v3
MEDIUM_HEURIST_MODEL=deepseek/deepseek-v3
LARGE_HEURIST_MODEL=deepseek/deepseek-v3
USE_HEURIST_EMBEDDING=true

For custom models, check:
Heurist's Model List

Configure the Twitter Plugin

To enable Twitter integration, set up the required credentials in .env:

TWITTER_USERNAME=
TWITTER_PASSWORD=
TWITTER_EMAIL=
TWITTER_2FA_SECRET=

Important Tip: Set the Twitter account to "Automated" in the account settings. This informs Twitter that the account is run by code, reducing the risk of being banned.

Optional Twitter Configurations

TWITTER_DRY_RUN=false
TWITTER_POLL_INTERVAL=600
TWITTER_TARGET_USERS=
TWITTER_RETRY_LIMIT=
TWITTER_SEARCH_ENABLE=false
ENABLE_TWITTER_POST_GENERATION=true
POST_INTERVAL_MIN=150
POST_INTERVAL_MAX=300
POST_IMMEDIATELY=false
ENABLE_ACTION_PROCESSING=true

To add a Discord approval system (so the bot doesn’t post anything dumb), create a bot in Discord Developer Portal and add these values:

TWITTER_APPROVAL_DISCORD_CHANNEL_ID=
TWITTER_APPROVAL_DISCORD_BOT_TOKEN=
TWITTER_APPROVAL_ENABLED=true
TWITTER_APPROVAL_CHECK_INTERVAL=1000000

Final Step: Run Your AI Agent

Run your bot with:

pnpm start --character="characters/myai.character.json"

Thanks for reading! I hope this guide was helpful. If you need any assistance, feel free to ask in the comments or DM me!

How to Secure Solana Tokens & NFTs - Updating and Revoking Authorities

carson — Wed, 19 Feb 2025 14:00:41 +0000

How to Secure a Solana NFT Collection - Updating and Revoking Authorities

Terminology

Mint Authority: Grants the ability to mint more tokens of an asset (irrelevant for NFTs, as they have a fixed supply of 1).
Freeze Authority: Allows an account to freeze and unfreeze assets, restricting their movement.
Update Authority (UA): The wallet that has permission to modify an NFT’s metadata.
Revoking Authority: The act of permanently removing control from any wallet to ensure security.
Liquidity Pool (LP): A decentralized reserve of tokens that facilitates trading.

Introduction

In our previous article, we covered updating NFT metadata, migrating update authorities, and adjusting royalty share structures. If you haven't read it yet, I highly recommend checking it out: How to DeRug a Solana NFT Collection - Updating NFT Authority.

Now, let's dive deeper into another critical aspect of securing an NFT or token collection: updating and revoking the Mint Authority and Freeze Authority.

These authorities are crucial when dealing with SFTs (Semi-Fungible Tokens) and fungible tokens, as they can impact liquidity, security, and token economics.

Why Revoking Authorities Matters

For a token or NFT collection to be considered trustworthy, these authorities must be properly managed. A well-known practice in legitimate projects is burning the Mint & Freeze Authorities, meaning no one can mint extra tokens or freeze assets arbitrarily.

A Real-World Example

Imagine a liquidity pool with 100 tokens and $100 in liquidity. This means each token is worth $1. Now, if someone mints 100 billion more tokens for themselves, the token supply becomes 100,000,000,100, while the liquidity pool remains at $100. This person now owns nearly 100% of the supply and can drain the liquidity pool, rendering the token worthless.

Revoking these authorities ensures that such exploits are impossible, maintaining fairness and stability in the ecosystem.

Updating Authorities on Solana

To manage these authorities, we'll use Metaplex's mpl-toolbox, which provides a setAuthority function to update or revoke permissions.

Here, we'll build two transactions:

Updating the Mint Authority
Updating the Freeze Authority

Code Implementation

Setting New Authorities

let builder = await setAuthority(umi, {
      authorityType: AuthorityType.MintTokens,
      newAuthority: newAuthority,
      owned: itemMint,
      owner: umi.identity.publicKey,
    }).add(
      setAuthority(umi, {
        authorityType: AuthorityType.FreezeAccount,
        newAuthority: newAuthority,
        owned: itemMint,
        owner: umi.identity.publicKey,
      })
    );
builder = await builder.setLatestBlockhash(umi, { commitment: "confirmed" });
const tx = await builder.sendAndConfirm(umi);

Explanation of Parameters:

authorityType: Specifies which authority to update (Mint or Freeze Authority).
newAuthority: New owner’s public key. Set to null if you want to revoke the authority permanently.
owned: Mint address of the asset to update.
owner: The current authority owner’s public key.

Automating Authority Updates for Multiple Assets

To update a collection of SFTs, we need to retrieve and process them dynamically. Below is a script that:

Loads all SFTs belonging to a specific collection.
Updates their Mint & Freeze Authorities.
Skips assets that are already updated.

import bs58 from "bs58";
import { createUmi } from "@metaplex-foundation/umi-bundle-defaults";
import { mplCore } from "@metaplex-foundation/mpl-core";
import { createSignerFromKeypair, publicKey, signerIdentity } from "@metaplex-foundation/umi";
import dotenv from "dotenv";
import { AuthorityType, setAuthority } from "@metaplex-foundation/mpl-toolbox";
import { fetchAllDigitalAssetByUpdateAuthority, fetchDigitalAsset } from "@metaplex-foundation/mpl-token-metadata";
dotenv.config();

async function migrateSFTsAuthorities() {
  const privateKey = process.env.OLD_UA_SECRET_KEY as string;
  const umi = createUmi(process.env.RPC as string, "confirmed").use(mplCore());
  const signer = umi.eddsa.createKeypairFromSecretKey(bs58.decode(privateKey));
  umi.use(signerIdentity(createSignerFromKeypair(umi, signer)));

  const newAuthority = publicKey("PUBLIC_KEY");
  const collectionKey = publicKey("COLLECTION_KEY");
  const assets = await fetchAllDigitalAssetByUpdateAuthority(umi, signer.publicKey);
  const filteredAssets = assets.filter(
    (el) => el.metadata.collection.__option === "Some" &&
             el.metadata.collection.value.key === collectionKey &&
             el.publicKey !== collectionKey
  );
  console.log(`Total assets: ${filteredAssets.length}`);

  for (let i = 0; i < filteredAssets.length; i++) {
    const asset = await fetchDigitalAsset(umi, publicKey(filteredAssets[i]));
    const itemMint = filteredAssets[i].publicKey;

    if (
      asset.mint.mintAuthority.__option === "Some" &&
      asset.mint.freezeAuthority.__option === "Some" &&
      asset.mint.mintAuthority.value.toString() === newAuthority.toString() &&
      asset.mint.freezeAuthority.value.toString() === newAuthority.toString()
    ) {
      console.log(`#${i} is already updated`);
      return;
    }
    console.log(`Handling i: ${i}, mint: ${itemMint.toString()}`);

    let builder = await setAuthority(umi, {
      authorityType: AuthorityType.MintTokens,
      newAuthority: newAuthority,
      owned: itemMint,
      owner: umi.identity.publicKey,
    }).add(
      setAuthority(umi, {
        authorityType: AuthorityType.FreezeAccount,
        newAuthority: newAuthority,
        owned: itemMint,
        owner: umi.identity.publicKey,
      })
    );
    builder = await builder.setLatestBlockhash(umi, { commitment: "confirmed" });
    const tx = await builder.sendAndConfirm(umi);

    if (tx.result.value.err) throw new Error(tx.result.value.err.toString());
    console.log(`Success #${i}`, tx);
  }
}
migrateSFTsAuthorities().catch((err) => console.error(err));

Summary

Mint & Freeze Authorities play a vital role in asset security.
Revoking them prevents supply manipulation and freezing exploits.
Using Metaplex's mpl-toolbox, we can update or revoke authorities.
Automating the process ensures large collections are updated efficiently.

Conclusion

By properly securing the authorities of your NFTs and tokens, you can prevent exploits and reinforce trust in your project. If you're working with a Solana-based collection, taking these steps is essential for security and decentralization.

If you have any questions or need further help, feel free to reach out on X or GitHub.

How to DeRug a Solana NFT Collection - Updating NFT Authority

carson — Mon, 17 Feb 2025 17:56:23 +0000

How to DeRug a Solana NFT Collection - Updating NFT Authority

Terminology

Update Authority (UA): The wallet address that has the power to modify an NFT's metadata.
Creators: The list of wallets that are attributed as the creators of an NFT and can receive royalties.
Metadata: The stored data related to an NFT, such as its name, image, and attributes.
Unverify Creator: The process of removing a wallet's verification as a creator, necessary before updating metadata.
Mint: The unique identifier (public key) of an NFT or NFT collection on Solana.

Introduction

Let's take a scenario where you gain access to an NFT collection owned by someone else. In this case, it is not very safe to keep it as is. The previous owners still have access to the NFTs, royalties, etc. So what should you do? In this article, I'll show you my approach to handling this issue.

In my case, it wasn't exactly derugging a collection. Instead, I helped the Trippin' Ape Tribe NFT collection migrate all their NFTs to a new Update Authority wallet to ensure the previous developers no longer had access to them.

My Environment:

Language: TypeScript
Tools: Multiple @metaplex-foundation tools (check imports for details)

Find all functions in this GitHub repository: https://github.com/carson2222/sol-tools

What We'll Be Updating

To ensure the NFT collection is fully migrated to the new authority wallet, we will update:

The new update authority
The new creators
Verify/Unverify creators

This process needs to be done both for the collection itself and for each individual NFT.

Migrating Collection Authority

Initializing Wallets

First, we load two wallets and initialize a Metaplex Umi instance with them. The first wallet is the current NFT authority owner, and the second one is the new authority. Make sure both wallets have some SOL for transaction fees. Your wallet-loading method may vary depending on how your private key or seed phrase is stored.

For security reasons, I use a private key stored as a string in my .env file.

const privateKey = process.env.OLD_UA_SECRET_KEY as string;
const umi = createUmi(process.env.RPC as string, "confirmed").use(mplCore());
const signer = umi.eddsa.createKeypairFromSecretKey(bs58.decode(privateKey));
umi.use(signerIdentity(createSignerFromKeypair(umi, signer)));

const privateKeyNew = process.env.NEW_UA_SECRET_KEY as string;
const umiNew = createUmi(process.env.RPC as string, "confirmed").use(mplCore());
const signerNew = umi.eddsa.createKeypairFromSecretKey(bs58.decode(privateKeyNew));
umiNew.use(signerIdentity(createSignerFromKeypair(umi, signerNew)));

Setting Constants

Update mint with the public key of your collection. Since we are setting the new authority to the second wallet initialized, newAuthority remains as is.

If you want the new UA wallet to receive 100% of the royalties, leave the configuration unchanged. Otherwise, add more elements and adjust the share percentages, ensuring the total sum is 100%.

const mint = publicKey("DmL46V46U5VM4UgrJbVQvWhVyD1zjZGGVRWeMv46eWt9");
const newAuthority = signerNew.publicKey;
const newCreators = buildNewCreators([{ address: newAuthority.toString(), share: 100 }]); // Sum of shares must be 100%

Loading Collection Metadata

const initialMetadata = await fetchMetadataFromSeeds(umi, { mint });

Unverifying the Old Creator

On Solana, you cannot remove a wallet from receiving royalties while it is still verified. To unverify it, you need access to this wallet.

In this example, I assume there is only one verified creator—the UA wallet. Adjust the code if needed.

let tx = await unverifyCreatorV1(umi, {
    metadata: initialMetadata.publicKey,
    authority: umi.identity,
}).sendAndConfirm(umi);

Migrating the Authority & Creators

Here, we update the metadata to set the new authority wallet and apply the new creator structure. If you want to change other metadata properties, update the object accordingly.

Be sure to include all existing metadata fields when updating, or you might accidentally reset the entire data object.

tx = await updateV1(umi, {
    mint,
    authority: umi.identity,
    data: { ...initialMetadata, creators: newCreators },
    newUpdateAuthority: newAuthority,
}).sendAndConfirm(umi);

Verifying the New Creator

tx = await verifyCreatorV1(umiNew, {
    metadata: initialMetadata.publicKey,
    authority: umiNew.identity,
}).sendAndConfirm(umiNew);

Complete code

Migrating NFTs Authority

Since a collection is technically an NFT, we will repeat a similar process. However, we need to do this for EVERY NFT in the collection. Doing this manually would be inefficient, so we automate the process.

Getting a List of All NFTs

There are multiple ways to retrieve all NFTs in a collection. My approach was to load all assets owned by a specific wallet and then filter them by symbol to target the ones I wanted to update.

const assets = await fetchAllDigitalAssetByOwner(umi, signer.publicKey);
const filteredAssets = assets.filter((el) => el.metadata.symbol === "ReSHAPE" && el.publicKey != collectionMint);

Then, we loop through the filtered list and repeat the same steps as we did for the collection:

Unverify the creator
Update authority and creators
Verify the creator

Complete code

Summary

In this guide, we covered how to migrate an NFT collection's update authority to a new wallet, ensuring that the previous owner or developer no longer has control over the assets. We went through:

Initializing and setting up wallets
Unverifying the old creator
Updating the update authority and creators
Verifying the new creator
Automating the migration process for all NFTs in a collection

By following these steps, you can safely migrate an NFT collection and secure its ownership under a new update authority.

Conclusion

Migrating an NFT collection's authority is a crucial step in securing ownership and preventing unwanted access. Whether you're taking over a project or assisting in a migration, automating this process can save time and ensure a seamless transition.

If you found this guide helpful, consider checking out the full implementation on my GitHub: https://github.com/carson2222/sol-tools.

DEV Community: carson

AI + Foundry's cast: how I investigate smart contracts now

The old way

What changed

Setting it up

Where it falls apart

Is it worth setting up?

I turned my private UI workflow into an open-source Agent Skill

How AI screws our projects

Build Your Own Twitter AI Bot: The Ultimate Guide

How to Create Your Own Twitter AI Agent

Introduction

Project Initialization

Clone the Repository

Handling sqlite3 Errors

Setup the Environment File

Start the Agent (Test Run)

Create Your Own Character

Download the Twitter Plugin

Set Up Your AI Provider

Steps to Set Up Heurist:

Configure the Twitter Plugin

Optional Twitter Configurations

Final Step: Run Your AI Agent

How to Secure Solana Tokens & NFTs - Updating and Revoking Authorities

How to Secure a Solana NFT Collection - Updating and Revoking Authorities

Terminology

Introduction

Why Revoking Authorities Matters

A Real-World Example

Updating Authorities on Solana

Code Implementation

Setting New Authorities

Explanation of Parameters:

Automating Authority Updates for Multiple Assets

Summary

Conclusion

How to DeRug a Solana NFT Collection - Updating NFT Authority

How to DeRug a Solana NFT Collection - Updating NFT Authority

Terminology

Introduction

My Environment:

What We'll Be Updating

Migrating Collection Authority

Initializing Wallets

Setting Constants

Loading Collection Metadata

Unverifying the Old Creator

Migrating the Authority & Creators

Verifying the New Creator

Migrating NFTs Authority

Getting a List of All NFTs

Summary

Conclusion

Handling `sqlite3` Errors