Gemini DeFi Protocol Faces High Oracle Manipulation Risk, Up to $1B at Stake

·1 views

A DeFi security research team has assessed Gemini, a permissioned lending and borrowing platform with over $5.7 billion in total value locked across Ethereum and multiple Layer 2 networks, assigning it an oracle manipulation risk score of 7.4 out of 10. The report, dated September 22, 2026, identifies four key attack vectors: single-source price feed manipulation, flash-loan-based TWAP distortion, cross-chain bridge feed inconsistencies, and governance-controlled parameter abuse. In a worst-case scenario, the researchers estimate that up to approximately $1 billion in assets could be jeopardised if these vulnerabilities were exploited. Each vector was rated individually, with single-source feed manipulation scoring highest at 8 out of 10 due to its potential to trigger over $200 million in liquidations from a 5–10% price shift. The report concludes with a prioritised remediation roadmap designed to reduce exposure while minimising disruption to existing platform users.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

WordPress Click2Shell Flaw Enables PHP Execution via Theme Preview Chain

A high-severity vulnerability chain dubbed Click2Shell affects WordPress Core versions 7.1.0 and select releases across branches 7.0 through 4.8, allowing unauthenticated attackers to trigger remote PHP execution. By luring an administrator to a crafted URL, the flaw exploits a selector injection in WordPress Core that automatically installs an official theme from the WordPress.org catalog without any explicit admin action. When chained with a vulnerable theme, a follow-on request to admin-ajax.php causes the inactive theme's functions.php to load and fetch an attacker-specified plugin ZIP, ultimately executing arbitrary PHP under the server's web worker account. WordPress has released patched versions — including 7.1.1, 7.0.5, 6.9.8, and 4.8.31 — with fixes backported across all affected branches. Administrators are advised to update immediately, remove unused themes, and restrict outbound traffic and plugin installation permissions as additional mitigations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PR Tour v0.7.0 Adds Source Evidence Links Between Code Walkthrough Steps

PR Tour, an open-source code-review skill built for Codex and Claude Code, has released version 0.7.0 with a new transition feature that lets readers inspect the source evidence behind step-to-step explanations. The update was prompted by a GitHub suggestion from contributor imMamdouhaboammar, who noted that connections between steps were often left implicit even when individual steps were well-documented. Authors can now attach optional transition objects to each step, citing specific file paths and line ranges from Git — including unchanged files outside the diff — to justify why the guide moves from one section to another. Transitions fall into three categories: source-cited, includes-inference, and reading-order, giving authors a way to be transparent about what is verified versus interpreted. The release also introduces draggable desktop layout dividers with keyboard support and offline-readable source excerpts, while remaining backward-compatible with older guide manifests.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Percentiles Matter More Than Average Response Time in System Design

When measuring API or distributed system performance, relying solely on average response times can obscure how slow the system is for a significant portion of users. Percentiles such as P50, P95, P99, and P99.9 provide a clearer picture by showing the response time thresholds experienced by different proportions of users. For instance, a P99 of 3 seconds means 1% of requests exceed that time — which can translate to 10,000 affected users out of one million requests. These slower requests, known as tail latency, are especially critical in high-traffic systems like e-commerce platforms where even a small percentage of delays impacts real users. Percentiles also underpin Service Level Objectives and Service Level Agreements, making them a key tool for setting and enforcing performance standards.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Opens Free Technical Docs Hub With 100+ Articles on Systems Architecture

A software engineer has publicly launched a personal technical documentation hub built over two years, now hosting more than 100 articles on modern software engineering topics. The knowledge base began as a private note repository and has grown to cover distributed systems, enterprise integration patterns, and production observability. Key topics include OpenTelemetry, event-driven notification design, messaging troubleshooting, and real-world runbooks for complex production environments. The hub is hosted on GitBook and is described as a continuously updated resource, with some articles still in progress at launch. The author has invited the developer community to explore the hub and share feedback or suggestions.

0 comments Read more at DEV Community