HTX Yield Protocol Audit Rates Risk High, Flags Reentrancy and Oracle Weaknesses

·1 views

A security audit of HTX, a cross-chain yield aggregator with about $4.17 billion in total value locked, has been published by an independent research team. The review examined its strategy-execution engine, asset-allocation oracle, cross-chain bridging, and governance controls. Auditors assigned the protocol an aggregate risk score of 7.2 out of 10, rated as high, while judging the design fundamentally sound. Key concerns include a possible reentrancy path in the withdrawal logic, unchecked external call returns, and a single-key upgrade authority without a timelock or multi-signature requirement. The report recommends targeted hardening of these components to reduce high-impact attack risks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Resume Tip: Use Problem-Action-Result Bullets with Numbers to Stand Out to Recruiters

A software engineer describes months of unanswered job applications and concluded that resumes were not conveying their impact clearly enough. Analyzing successful engineering resumes, the author found a recurring pattern: bullet points structured as Problem, Action, and Result, with a quantifiable outcome. The article contrasts vague task-list bullets with rewritten examples that cite specific latency reductions, recovered revenue, and test coverage gains. It also lists common pitfalls such as weak verbs, missing metrics, omitted tech stacks, and overly long bullets. The author recommends keeping each bullet to two lines and naming the tools used so both recruiters and applicant tracking systems can parse it easily.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

New l10n_health tool audits Flutter translation files for unused and missing keys

A developer built l10n_health, a tool that checks Flutter translation files alongside Dart code for problems the analyzer misses. It reports unused keys, missing or untranslated entries across languages, mismatched placeholders, hardcoded text that bypasses localization, and hidden invisible Unicode characters. The tool works with gen_l10n and flutter_intl and can be installed globally or as a dev dependency. It also includes a careful prune command that removes unused keys as a text edit after validating the JSON, and can produce HTML, GitLab, and GitHub reports for CI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Retry With Backoff and Jitter: A Reusable Pattern for Failed API Calls

A developer shares a retry function they reuse across projects, built to keep a single failed API call from overwhelming a backend. The article argues that naive retry loops, especially those with fixed delays, cause synchronized retry storms that prolong outages. The approach combines exponential backoff with full jitter so clients spread their retries out instead of firing together. It retries only on specific statuses like 429 and 503, respects Retry-After headers, and warns against retrying non-idempotent writes without idempotency keys. The author suggests starting with a 200ms base delay, a 30-second cap, and five attempts, then tuning based on observed failures.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Face Conflicting Fediverse Rules, from Bans to Fees

An AI agent spent two weeks testing websites to see whether any automated gate screens visitors by what they are rather than what they hold. The author found that some sites vary their responses based on the browser identity sent, while others only check whether a user has a login or key. The clearest statements about AI participation came from written policies on Mastodon-based Fediverse instances. These rules ranged from an outright ban on AI-operated accounts to a 100-euro account fee and a requirement for disclosure. The author concludes that community policy, not technical filtering, is what decides whether an AI agent is welcome.

0 comments Read more at DEV Community