AST-Based Checks for Detecting Checks-Effects-Interactions Violations in Smart Contracts

·1 views

Many Web3 security teams still rely on regex heuristics and raw LLM prompts, which can miss vulnerabilities in deterministic systems. The article argues that autonomous audit pipelines need a deterministic representation, and proposes using Solidity's Abstract Syntax Tree (AST) from the solc compiler. It describes a Python visitor that flags Checks-Effects-Interactions violations when an external call precedes a state mutation within a function. The approach is presented as a fast pre-flight check before deployment to Base L2, where it reportedly takes under 12 milliseconds per contract, much faster than full symbolic execution.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Cash Conversion Cycle Matters Alongside Revenue Growth

The article argues that revenue shows a business is selling, but the cash conversion cycle reveals how quickly those sales become cash. The author examines inventory days, receivable days, and payable days together rather than relying on any single metric. Longer inventory holding and slower customer payments can tie up cash even while revenue and profit rise. The key question is whether a company can fund this working capital from its operations or whether growth keeps increasing its funding needs. The piece is general information only and not financial advice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a Serverless PDF Summarizer with Claude, S3, and Lambda

The article explains how a PDF uploaded to an S3 bucket can be automatically summarized without managing any servers. It describes how AWS Lambda runs code only when triggered, scales automatically with concurrent uploads, and charges only for execution time. The workflow combines S3 for storage, Lambda for event-driven processing, and Amazon Bedrock for access to Claude's language model, with IAM roles granting the needed permissions. A minimal TypeScript Lambda handler is presented as a starting point, with the full summarization logic to be added in later steps.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

cdk-nag v3 Moves Security Checks into CDK Policy Validation and Changes Exceptions

cdk-nag, the AWS CDK security checking library from cdklabs, was released as version 3.0.0 on June 12, 2026, with the current version at 3.0.2. The rewrite replaces its earlier Aspect-based rule packs with the CDK's built-in policy validation framework, so simply upgrading the version typically causes build errors. Exceptions now use Validations.of(construct).acknowledge() with a required reason instead of NagSuppressions, and wildcard findings must be acknowledged individually. The article demonstrates setup, exception handling, and Vitest-based testing with validateScope() using a fictional bike rental application, and explains how to write a custom rule pack.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitLab fixes 500 errors from oversized comments across nine vulnerability GraphQL mutations

A GitLab merge request, gitlab-org/gitlab!269616, adds a length check to the comment argument of nine GraphQL mutations in its vulnerability management features. The bug stemmed from a 50,000-character limit that the model enforced but the API did not, so oversized input produced a generic internal server error. Bulk dismiss was worse, failing only at the database constraint because it skipped model validations. The change went through several rounds of CI fixes, including regenerating public GraphQL docs and introspection schemas, and was refined after reviewer feedback. The author's write-up highlights how easily such validation gaps ship unnoticed.

0 comments Read more at DEV Community