DeFi Platform Veda Flagged for Medium-High Risk With $1.9B TVL at Stake

·1 views

A security audit dated September 30, 2026, assessed Veda, a multi-chain yield-aggregation protocol with approximately $1.9 billion in total value locked across Ethereum and several Layer-2 networks. Researchers assigned the platform an overall risk score of 6.4 out of 10, citing vulnerabilities including flash-loan price manipulation, oracle feed delays, and a cross-chain bridge re-entrancy flaw. The audit also flagged that 73 percent of Veda's TVL is concentrated in just three liquidity pools, raising concerns about cascading liquidations during market stress. Current safeguards such as TWAP oracles, circuit-breakers, and snapshot-based governance voting were found to be inadequately configured for extreme conditions. Auditors recommended immediate hardening of oracle and bridge infrastructure, dynamic circuit-breaker thresholds, and rebalancing of liquidity caps as priority remediation steps.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Opinion: Anthropic Should Monetize AI Outcomes, Not Just Tokens, Analyst Argues

A commentary published on DEV Community argues that Anthropic's long-term revenue potential lies not in selling API tokens but in controlling an 'economic execution layer' built around autonomous AI agents. The author contends that as AI models become cheaper and more commoditized, the strategic value will shift toward orchestrating entire workflows and delivering measurable business outcomes. Under this vision, users would specify a goal — such as cutting procurement costs — and an agent system would autonomously determine the models, tools, data, and actions needed to achieve it. The piece proposes a 'Cognitive Cloud' abstraction where customers purchase cognitive capacity rather than raw compute, with revenue tied to verified work, cost savings, or economic throughput generated. The author also envisions a future where AI agents from different companies negotiate and transact directly with one another, making the orchestration infrastructure potentially more valuable than any single underlying model.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Git Worktrees Let AI Coding Agents Work Safely Without Disrupting Your Code

Running an AI coding agent in the same directory as your active work creates risks including mixed uncommitted changes, file collisions, and difficult-to-reverse edits. Git worktrees offer a practical solution by allowing multiple working directories to share a single repository, each checked out on its own branch. This means an agent's changes remain completely isolated until a developer reviews the diff and chooses to merge. The setup requires only a few commands to create, inspect, and clean up a worktree after the agent finishes its task. Many modern agent tools now handle worktree creation automatically, though understanding the underlying mechanics helps when sessions end unexpectedly or branches need manual cleanup.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Every AI request sends far more than your question — here is what travels

When you send a message to an AI model, the provider receives much more than just your typed question — including system instructions, full conversation history, attached files, and tool definitions. Because large language models have no memory between sessions, the application must resend the entire prior conversation with each new message, meaning a document pasted early in a chat is retransmitted repeatedly. In retrieval-augmented generation setups, the application may also silently attach several pages of relevant document excerpts before forwarding your request to the model. AI agents that operate in loops pose additional exposure risks, as file contents, command outputs, and even credentials can end up embedded in prompts sent to the provider. Understanding what the application is permitted to read — not the model itself — is central to assessing what data actually leaves your device.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Podman bug silently corrupts file ownership when exporting rootless keep-id containers

A confirmed bug in Podman 5.4.2 causes the 'podman export' command to silently shift all file ownership metadata when used with rootless containers created using the '--userns=keep-id' flag. The export process passes no ID mapping to its tar writer, meaning files that belonged to UID/GID 1000 inside the container are written as 0/0 in the tarball, while root-owned files shift to 1/1. The command exits with code 0 and produces no error output, making the corruption invisible until the imported image is actually used. Practical consequences include users being denied write access to their own home directories and setuid binaries like 'su' and 'passwd' becoming assigned to UID 1 (daemon), rendering them non-functional. A workaround exists via 'podman commit' followed by a fresh export, and a diagnostic script has been shared alongside an upstream bug report filed at podman#29856.

0 comments Read more at DEV Community