Developer finds Uniswap v3 TVL overstated by up to 25x due to virtual reserve bug

·2 views

A software developer discovered a critical bug in their paid DEX data API that caused Uniswap v3 total value locked (TVL) figures to be overstated by as much as 25 times the actual amount. The error stemmed from using virtual reserves — mathematical constructs that describe liquidity curve shape — instead of real token balances held by the pool contract. For example, one WETH/USDC pool on Base was reported at $2.84 billion TVL when actual on-chain balances showed roughly $111 million. The developer has since corrected the implementation to separately report real custody balances for TVL and virtual reserves for trade depth calculations. The incident also highlighted the inadequacy of basic API response-shape testing, prompting the addition of magnitude checks and cross-source validation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Android developers get updates to ConstraintLayout, Firebase, Intercom, and Auth0 SDKs

Four widely used Android dependencies have received new releases: ConstraintLayout 2.2.2 delivers a binary compatibility fix as the library enters maintenance mode in favor of Compose. Firebase's updated Bill of Materials (34.17.0) bundles fixes across multiple libraries, including auth timeout corrections, Firestore chunked caching for large documents, and improved Crashlytics crash reporting on Android API 37+. Intercom SDK 18.6.0 introduces pinch-and-zoom for image attachments, resolves an ANR caused by thread-blocking during initialization, and fixes keyboard overlap issues in Canvas Kit sheets. Auth0 4.0.1 builds on the 4.0.0 major release, which raised the minimum SDK to API 31, removed PasskeyProvider and redundant credential manager constructors, and added SSO deserialization support along with ephemeral session handling for Chrome Custom Tabs. Developers using Intercom should also note that the next major version will require Kotlin 2.0 or higher for binary compatibility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Journeymen fixes three pipeline bugs affecting job visibility and reliability

Developer grading platform Journeymen identified and resolved three backend bugs in its analysis pipeline this week. One issue caused stuck repository analysis runs to appear identical to slow ones on the developer dashboard, which was addressed by adding explicit progress-stage tracking. A second bug involved a Lambda worker timing out on larger repositories, causing jobs to silently never complete until the slow code path was identified and fixed. A third problem saw failed jobs landing in an SQS dead-letter queue with no alerts or in-product visibility, which has now been wired up for observability. The company shared the update publicly, noting that its core promise of verified over self-reported results must apply to its own infrastructure as well.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

React Hooks Explained: How useRef and useMemo Improve App Performance

The React Mastery Series continues with a deep dive into two widely used hooks: useRef and useMemo. useRef allows developers to store values that persist across renders without triggering component re-renders, making it useful for accessing DOM elements, tracking previous values, and managing timers or WebSocket connections. Unlike useState, changes to a useRef value are not tracked by React and do not cause UI updates. useMemo optimizes performance by memoizing the result of expensive calculations, recomputing only when specified dependencies change. Together, these hooks help developers build more efficient and responsive React applications in production environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why AI Safety Should Be Structural, Not Just Rule-Based

A developer argues that effective AI agent safety relies on structural constraints rather than solely on in-context rules or action-level guardrails. The author illustrates this by running an HTML renderer in a sandboxed environment with strict resource limits, ensuring unsafe behavior is prevented by design rather than by the agent's own judgment. Two self-imposed practices reinforce this approach: using a throwaway browser profile by default instead of a logged-in one, and passing secrets via file paths rather than exposing them in the conversation. The author acknowledges these structural choices come with real inconveniences but notes they have repeatedly overridden the more convenient option. The piece closes by inviting others to share what they have made structurally impossible for their agents, rather than simply instructed them to avoid.

0 comments Read more at DEV Community