Immute's BUY_LOCK_BLOCKS Mechanism Aims to Stop Same-Block Sandwich Attacks in DeFi

·1 views

Sandwich attacks in DeFi allow bad actors to profit by placing buy and sell orders around a victim's pending transaction, exploiting public mempool transparency and manipulating AMM pricing. Immute has introduced a smart contract feature called BUY_LOCK_BLOCKS, which enforces a per-address cooldown window measured in block numbers after any buy transaction. During this window, the same address cannot execute another buy, making it structurally impossible to complete the front-run and back-run sequence from a single wallet. Two on-chain functions, isLocked() and lockedUntil(), provide transparent enforcement and allow external interfaces to display remaining cooldown time. Unlike approaches such as batch auctions or commit-reveal schemes, this mechanism operates at the contract level without introducing significant latency or complexity for regular traders.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

MongoDB vs PostgreSQL: A Practical Guide to Picking the Right Database in 2026

PostgreSQL and MongoDB are both mature, production-ready databases suited to different use cases rather than competing on quality. PostgreSQL is a relational database that enforces strict schemas, supports complex joins, and offers strong ACID transaction guarantees, making it ideal for financial systems, e-commerce, and SaaS platforms. MongoDB is a document-based NoSQL database that stores flexible JSON-like records, making it a natural fit for rapidly evolving data models, content management, and high-throughput applications. The key deciding factor is the shape of your data: highly relational, structured data favors PostgreSQL, while fluid, document-shaped, or object-driven data favors MongoDB. Developers are advised to treat the choice as a practical one based on data structure and access patterns rather than a high-stakes debate.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WebSocket Error 1006 in Trading Bots: Causes, Diagnosis, and Reconnect Fixes

Trading bots frequently disconnect with WebSocket close code 1006, an abnormal closure that carries no error message or close frame, making it difficult to debug. The code appears when a TCP connection drops unexpectedly due to causes such as proxy idle timeouts, connection resets, network partitions, or rate limiting by exchanges. Because 1006 is reserved by the WebSocket protocol and cannot be sent in a close frame, the bot's library generates it internally to signal that the connection simply vanished. Engineers are advised to treat 1006 as a reconnect trigger rather than a critical error, and to implement application-level ping/pong heartbeats since TCP keepalive alone is too slow to detect dead connections. Logging the time gap between the last received message and the disconnect can help distinguish idle timeouts from sudden drops and guide the appropriate infrastructure fix.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How a Raw-Body Bug Silently Breaks Paddle Billing Webhook Verification

Paddle Billing webhooks use HMAC-SHA256 signatures delivered via the Paddle-Signature HTTP header, requiring verification against the exact raw request bytes Paddle originally sent. A common developer mistake occurs when web frameworks auto-parse the JSON body, and the code re-serializes it before verification, producing different bytes that cause every legitimate webhook to fail. The signed string Paddle constructs combines the timestamp and raw body in the format ts:raw_body, meaning omitting the timestamp prefix also invalidates the computed digest. Paddle Billing, the default for accounts created after August 2023, uses a per-destination secret for signing and is entirely different from the legacy Paddle Classic scheme, which relied on PHP serialization and a public key. The fix requires capturing and preserving the raw, unparsed request body before any framework processing, then parsing it only after the signature has been successfully verified.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why B2B RAG Chatbots Need Multi-Vendor LLM Design After Claude Outage

In June 2026, Anthropic's Claude was pulled from availability for 20 days in several regions due to export-control regulations, causing RAG-based support chatbots built on a single vendor to go offline. A small studio specializing in B2B RAG systems recounts how this real disruption — not a hypothetical — affected teams that had hard-coded a single LLM provider into their pipelines. The studio now architects a thin provider abstraction layer so that swapping one LLM for another requires only a configuration change, not a code rewrite. The release of LongCat-2.0 under a full MIT license this month has added a regionally unrestricted fallback option, particularly relevant for clients outside the US. The broader lesson for businesses evaluating RAG development partners is to ask upfront whether the pipeline can switch models without rebuilding retrieval logic — otherwise, they are buying a demo rather than a resilient system.

0 comments Read more at DEV Community