SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Analysis Flags Centralised Control and Contract Flaws in Polygon Bridge

0
·1 views

A security researcher's review of the Polygon Bridge, which holds about $2.7 billion in total value locked across Ethereum and Polygon, has identified several vulnerabilities. The most serious concern is that a single multi-sig controls contract upgrades without a timelock, and a small validator set finalises state roots, creating a centralisation risk. Further issues include exit proofs that can be replayed after a withdrawal and predicate contracts vulnerable to re-entrancy. Lower-severity findings cover unchecked token decimals, deposit front-running, gas-based denial of service, and immediate token mapping changes. The report concludes the bridge's overall risk profile is high given the potential for asset theft.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Testing Live Watchlist Events Reliably by Modeling Presence, Not Timing

The article argues that flaky tests for a live trading watchlist stem from treating event time, batching, and delivery as timing problems rather than state. It recommends making event time an explicit dependency, flushing batches using a defined watermark, and asserting symbol presence as a state transition instead of relying on fixed sleeps. The author notes that batching delays are intentional and that transport ordering from protocols like WebRTC does not define what counts as current in the application. A deterministic reducer that tracks each symbol's latest sequence and status can be tested with an in-memory clock, while the network layer is tested separately. The approach keeps the production batching rules intact while removing sources of noise from CI runs.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Hearing words is not the same as understanding a request

Listening involves more than receiving words; it also requires checking understanding and making corrections usable in action. In a fictional kitchen example, a clarifying question prevents someone from handing over the wrong bowl. Research by Apperly and colleagues on adults interpreting instructions from another person's perspective is cited, though the article notes these experiments do not show how such abilities develop in childhood. The author suggests focusing clarification on differences that affect the outcome, and stating a brief summary of what was understood so mistakes can be corrected. The piece also argues that corrections should update the planned action rather than merely being recorded in memory.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Installing Python packages can run malicious code; teams urged to pin hashes and delay new releases

A recent compromised LiteLLM release on PyPI reportedly stole credentials and planted a backdoor, highlighting that installing packages can execute code. The article explains that malicious code can run before import through setup.py in source distributions, through .pth files in site-packages that execute at interpreter startup, or via transitive dependencies. Attackers typically target environment variables, cloud and SSH credentials, and CI secrets before exfiltrating them. The suggested defenses include pinning exact artifact hashes, avoiding source distributions, applying a seven-day cooldown on new releases, and running pip-audit in CI.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

PHP2Shell flaws and stolen UpdraftCentral keys threaten PHP and WordPress sites

Emergency PHP patches on October 21 address two remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, which score 9.2 and can let unauthenticated attackers run code on web servers. Nearly all PHP versions back to 5.4 are reportedly affected, with Apache mod_php carrying the highest risk, and the bugs can also leak memory containing other users' credentials. Separately, attackers breached the developer of the UpdraftPlus WordPress backup plugin and are using stolen UpdraftCentral keys to install backdoor plugins that create hidden admin accounts. Administrators are advised to check PHP versions against fixed releases, restart services after patching, and review sites for unexpected plugins and users. Updating UpdraftPlus and removing the connection key are recommended as immediate cleanup steps.

0 comments Read more at DEV Community