Smart Contract Integration: Typed npm Package with TypeScript and CI/CD

The contract is deployed, and the frontend developer wants to work with it. The first option is to manually copy the ABI JSON and write calls via ethers.Contract with casting to any. The second is an npm package for smart contracts with typed wrappers imported in one line, providing autocomplete in the IDE. We specialize in the second approach: in 5+ years of working with Solidity and TypeScript, we have delivered over 30 such packages for DeFi protocols, NFT marketplaces, and L2 bridges.

The difference is especially noticeable during contract upgrades: in the first case, you have to find all places with the old ABI and hope you didn't miss any; in the second, just update the package version. If the contract changes a function signature, TypeScript throws compilation errors in all usage locations. According to our internal data, using a typed package reduces integration time by 5x (from 4 hours to 30 minutes) and lowers bug count by 70%.

Problems We Solve

Typical technical challenges teams face:

• Manual ABI copying — in a project with 50+ screens, the ABI may be pasted into 10 different files. Every deployment requires syncing all copies — one typo breaks the transaction.
• No autocomplete — developers spend up to 3 minutes per function constantly checking documentation. At team scale, that's hours per week.
• Type errors — casting with as any misses parameter mismatches; the transaction fails at gas estimation, debugging takes half a day.
• Address dispersion — contract addresses in .env or JSON, easy to mix up networks. In one project, a Sepolia address was accidentally used on mainnet — losing $15,000 worth of ETH.

Our packages eliminate these issues: ABI is automatically generated from build artifacts, addresses are centralized in a chainId → address map, types are checked at compile time.

How an npm Package Accelerates Smart Contract Integration

Consider a typical Foundry project. After forge build, artifacts are in out/. We use TypeChain with the Foundry adapter:

forge build
npx typechain --target ethers-v5 --out-dir src/typechain 'out/**/!(*.dbg).json'

This produces src/typechain/factories/MyContract__factory.ts with a typed connect() method. Then we build the npm package for smart contracts using tsup — it provides dual CJS/ESM output out of the box:

{
  "main": "./dist/index.cjs",
  "module": "./dist/index.js",
  "types": "./dist/index.d.ts",
  "exports": {
    ".": {
      "import": "./dist/index.js",
      "require": "./dist/index.cjs"
    }
  }
}

In one project, we added React hooks via wagmi CLI: the wagmi generate command with the foundry plugin generated ready-to-use read/write hooks. Frontend developers could call useReadMyContract() without writing a single line of ABI interaction. Result: integration time dropped from 4 hours to 30 minutes — 8x faster.

What's Included

When ordering the development of an npm package for smart contracts, you get:

1. Source code with typed wrappers (TypeChain or viem).
2. Address map for all networks (mainnet, testnet, L2).
3. Dual build (ESM + CJS) via tsup.
4. CI/CD on GitHub Actions: automated tests, build, and publishing on tag push.
5. README documentation with import and usage examples.
6. Integration support — we help set up imports.

Advantages of a Typed Package Over Manual ABI

TypeChain generates not only types but also factories with connect() and full autocomplete. Manual approach: 5 lines of code with casting; with TypeChain: 1 line with no any. Errors are caught at compile time, not on a test node. Our stats: TypeChain reduces integration bugs by 70%.

Build and Publishing

Build stack: tsup (recommended) or rollup. tsup can be configured in 5 minutes and supports dual ESM/CJS without extra plugins. For versioning, we use semantic-release — automatically increments the major version on ABI breaking changes.

For internal packages — GitHub Packages or Verdaccio. Configure .npmrc:

@myorg:registry=https://npm.pkg.github.com

Estimated Timelines and Pricing

• Basic package (one contract, ABI, types, addresses) — from 1 working day ($2,000).
• Full package (TypeChain, dual build, CI/CD, documentation) — from 2 to 3 days ($4,000–$6,000).
• Complex package (multiple contracts, cross-chain addresses, React hooks) — from 4 to 7 days ($7,000–$12,000).

Our many years of blockchain development experience (since 2019, with a team of 15+ engineers) guarantee a reliable and maintainable package. We've served 40+ clients and delivered 30+ packages, saving each client an average of $15,000 per year in integration costs.

Contact us to discuss details and order development.

Smart Contract Development

We faced a situation: a contract was deployed, two weeks later a message arrives—the pool drained for $800k. Looked at the transaction in Tenderly: attacker called deposit(), inside an ERC-777 callback re-called withdraw()—balance only updated after the second exit. Classic reentrancy, but not via ETH transfer—through an ERC-777 hook. ReentrancyGuard was only on withdraw().

Such cases are not rare. A smart contract is financial logic with no possibility to patch it overnight. Our team develops turnkey contracts, embedding protection against reentrancy, MEV, and gas attacks from the early stages.

How We Develop Smart Contracts Turnkey

We start with business logic audit and stack selection. Solidity 0.8.x is the standard for EVM-compatible chains: Ethereum, Arbitrum, Optimism, Polygon, BSC, Avalanche C-Chain. For Solana, we use Rust and Anchor: the account and program model requires explicit declaration of all resources. For projects requiring formal verification, Move (Aptos, Sui) fits—linear types eliminate resource copying at the compiler level. Vyper is chosen for contracts where audit simplicity is critical (Curve Finance).

Gas optimization is not premature optimization—it is an architectural decision. On Ethereum mainnet, deploying a poorly designed contract can cost a significant amount of ETH due to suboptimal storage layout. Repacking a Proposal structure from 7 slots to 4 saved thousands of gas per vote—substantial savings when scaled across thousands of votes per day.

Typical gas mistakes: passing arrays via memory instead of calldata in external functions (2–3x more expensive); using require with long strings instead of custom errors like error InsufficientBalance(...). Custom errors are cheaper on revert and pass structured data to the frontend.

Why Smart Contract Audit Is Critical for Security

Audit is not a one-time check—it is a built-in development stage. We use three levels:

1. Static analysis—Slither (30 seconds in CI) detects reentrancy, uninitialized variables, dangerous delegatecall.
2. Fuzzing and invariant tests—Foundry with --fuzz-runs 50000 finds edge cases missed by hundreds of unit tests. Real case: an AMM contract with custom math passed 150 Hardhat tests; Foundry found an integer division truncation that allowed a dust attack to accumulate dust on the contract. Echidna checks invariants ("sum of all balances ≤ totalSupply").
3. Manual code review—our engineers with 10+ years in blockchain identify logic errors that tools miss. For protocols with TVL > $1M, external audit from Trail of Bits, Consensys Diligence, or OpenZeppelin is mandatory. Timeline: 2–4 weeks.

Any upgradeable protocol must have a timelock. TimelockController from OpenZeppelin: operation proposed → wait minimum delay (48–72 hours) → executed. Without timelock, one compromised deployer wallet means losing the entire pool.

What Upgrade Patterns Do We Choose?

Storage collision is the main danger of proxies. Implementation v2 must not add variables before existing ones. OpenZeppelin Upgrades plugin for Hardhat and Foundry checks this automatically, but only when using its API.

How to Protect a Contract from MEV and Front-Running

On Ethereum mainnet, transactions in the mempool are visible to all. MEV bots execute sandwich attacks on DEX, front-run mints and governance. Solution: commit-reveal scheme for auctions, private submission via Flashbots PROTECT RPC. EIP-7702 and PBS (proposer-builder separation) are changing the landscape but not yet widespread.

What Is the Development Process?

1. Analysis—functional specification, call diagram, edge case analysis. Without this, coding starts in vain.
2. Development—Solidity/Rust with tests in parallel. Test → code → refactoring. Use Foundry for fuzz and invariant tests.
3. Internal audit—Slither + Echidna + manual code review. Foundry invariant tests for protocol invariants.
4. External audit—for projects with real money. Timeline: 2–4 weeks.
5. Deployment—Foundry scripts or Hardhat Ignition with verification on Etherscan. Gnosis Safe for ownership transfer immediately after deployment.
6. Monitoring—Tenderly alerts, OpenZeppelin Defender, Forta Network.

What Is Included

• Architecture documentation and contract specification (NatSpec).
• Source code with repository and CI (Slither, Foundry, coverage).
• Deployed contract with verification on blockchain explorer.
• Audit results (internal and external upon request).
• Access to monitoring and management (Gnosis Safe).
• Code warranty: critical bug fixes within one month after deployment.
• Consultation on web integration (wagmi, RainbowKit).

Estimated Timelines

• ERC-20 token with basic functions: 1–2 weeks
• Vesting contract with cliff/linear schedule: 2–3 weeks
• NFT ERC-721/1155 with marketplace: 4–6 weeks
• AMM or lending protocol: 2–4 months
• Multichain protocol with bridge: 4–7 months

Audit adds 3–6 weeks and runs in parallel with final testing where possible. Cost is calculated individually—contact us for a free project evaluation.

Order smart contract development—get consultation on architecture and protection against reentrancy, MEV, and gas attacks. Want to discuss details? Write to us—we will select the optimal stack for your task.