Developer discovers MCP server faked blockchain trades for three months despite passing all tests

·1 views

A developer built an MCP server to let an AI assistant trade tokens on a Solana-based platform, only to discover three months later that transactions were never actually being signed or sent, even though all 337 tests passed. The bug stemmed from tests that only checked return values like success: true, never verifying whether real network calls were made. To fix the vulnerability, the developer redesigned the write flow around a two-step confirmation system where the first tool call generates a single-use, time-limited token tied to a SHA-256 fingerprint of the exact arguments, and only a second call with matching arguments can execute the transaction. Additional safeguards include pre-signing simulation, per-transaction and per-session SOL spend caps, and explicit opt-in flags for edge cases. The incident highlights a broader lesson: a passing test suite proves code runs, not that it integrates correctly with external systems.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EmpowerAgro Uses Google AI to Detect Crop Diseases for India's Smallholder Farmers

EmpowerAgro is an AI-powered agronomic platform built to help smallholder farmers in India, particularly in regions like Vidarbha and Marathwada, identify crop diseases quickly and accurately. The app uses Google's Gemini API and custom vision models to diagnose over 50 fungal, bacterial, and pest-related crop diseases from a simple smartphone photo. To serve farmers in low-connectivity rural areas, lightweight MediaPipe edge models perform initial image processing directly on the device. Voice support in regional languages such as Marathi, Hindi, and Telugu allows farmers to receive diagnoses and treatment guidance without needing to read or type. The platform claims to help preserve up to 40% of at-risk yields and reduce unnecessary pesticide spending, while anonymized data generates regional disease heatmaps for agricultural authorities.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Analysis of 30 AI Model Cards Reveals Benchmark Reporting Patterns

A researcher examined model cards from 30 frontier AI models to assess which benchmarks laboratories most commonly report. The study compiled findings into a leaderboard-style visualization showing benchmark frequency and coverage across major AI labs. The analysis highlights inconsistencies in how different organizations choose to evaluate and disclose their models' performance. Such disparities make it difficult for users and researchers to make direct comparisons between frontier models. The work underscores growing calls for standardized evaluation and transparency practices in AI development.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Creates CSS-Only Artwork Uniting Comfort Foods from Seven Cultures

A developer submitted a CSS-only artwork titled 'No Passport Required' for the DEV Community Frontend Challenge - Comfort Food Edition. The piece depicts a shared dining table featuring comfort foods from seven countries, including Italian pizza, Japanese ramen, Indian khichdi, and Korean tteokbokki. Built entirely with HTML and CSS — using gradients, pseudo-elements, box-shadows, and animations — the artwork uses no photographs, canvas, or external illustration libraries. The composition is fully responsive across desktop, tablet, and mobile layouts, and also respects the prefers-reduced-motion accessibility setting. The creator hopes to expand the concept into an interactive experience called 'The Comfort Table,' where users can explore the stories and ingredients behind comfort foods from around the world.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Build a Benchmark Harness to Test Cheaper AI Models Before Going Live

AI product teams risk hidden costs when switching to open-weight models that perform well in demos but fail in production with issues like JSON drift, missing citations, and noisy tool calls. A benchmark harness offers a structured way to evaluate candidate models against real product tasks before routing live user traffic to them. The harness typically includes a task catalog, scoring rules, cost and latency tracking, and routing recommendations tailored to a product's specific requirements. Generic leaderboards fall short because they ignore product-level details such as prompt style, schema needs, latency budgets, and domain-specific facts. The approach is especially relevant now as open-weight model adoption accelerates and engineering teams face growing pressure to manage AI infrastructure costs without sacrificing reliability.

0 comments Read more at DEV Community