ERC-4626 Vault Test Reveals How Attackers Can Wipe Out Depositor Shares

·17 views

ERC-4626 is a standard that gives tokenized vaults a shared interface for deposits, withdrawals, and share accounting, where users receive shares proportional to their contribution. A developer exploring vault behavior built a Foundry test suite, originally intended as a hardened base contract, to examine edge cases in exchange-rate fairness. One local test demonstrated a known attack vector: an attacker deposited one base unit of an 18-decimal token, then donated 10,000 tokens directly to the vault, causing the next depositor's 50-token deposit to yield zero shares. The test showed the attack is costly for the attacker too, who lost roughly 4,975 tokens due to OpenZeppelin's virtual asset accounting preventing full recovery of the donation. The project highlights that vault behaviors like donation accounting and post-redemption asset handling depend heavily on implementation choices, making a single universal protective base contract insufficient.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Fixing GitHub Actions 'reusable workflow was not found' errors

This error means a uses: reference was correctly formatted but could not be resolved to a workflow file. GitHub checks the file path, the ref on the target repository, read access for the caller, and whether the file declares workflow_call, stopping at the first failure. Runs with this error end instantly with no jobs or logs, and the annotation shows a chain of references where the last entry is the one that failed. That failing reference is often inside a nested workflow the user did not write. Developers are advised to read the chain bottom-up and verify the path, ref, and access against the owning repository.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indonesia's Official Port List Gets Coordinates via New Open Port API

A developer converted Indonesia's National Port Master Plan (RIPN), an official scanned PDF annex under ministerial decree KP 432/2017, into structured data covering 1,082 ports. The dataset adds latitude and longitude for 468 ports, matched against OpenStreetMap, the NGA World Port Index and UN/LOCODE. Coordinates are included only when they pass verification checks, such as multiple independent sources agreeing within 5 km or an exact name match within the same province and regency, and no estimated positions are used. Many ports, mostly small local and ferry ports, still lack coordinates, though they remain in the dataset with their official names and hierarchy. The data is offered through the Port API on API Indonesia, with some recent regulatory amendments not yet applied.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Critical Red Hat Quay flaw CVE-2026-123710 lets attackers take over registry signing keys

Red Hat has disclosed CVE-2026-123710, a critical vulnerability in Red Hat Quay's service key server, scored 9.8 out of 10. According to Red Hat, an unauthenticated network client can obtain an anonymous token, use it to install its own trusted signing key, and then access private images or overwrite existing tags. The flaw affects Red Hat Quay 3 and 5, including standalone deployments, the Quay Operator on OpenShift, and the mirror registry for OpenShift. Upstream fixes were merged on 11 November 2026, and Red Hat has published patched builds for several Quay 3 branches. Coverage reviewed so far reports no known in-the-wild exploitation, though the situation is described as developing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

csperf Episode Explains the Tool's Limits Using Doctor and List-Backends Checks

A DEV Community article argues that performance tools which silently refuse questions can erode user trust in their measurements. It presents csperf as a measurement observatory rather than an all-answering performance oracle. The episode uses the doctor and list-backends commands to reveal what the tool can and cannot assess, so missing answers are not mistaken for failures. Doctor checks the compilers, libraries, and runtime support csperf depends on, while list-backends shows which capabilities can be probed. The author ran these diagnostics on an Ubuntu 22.04 workstation with an Intel i7-12700K.

0 comments Read more at DEV Community