MEXC DeFi Yield Products Flagged for Security Gaps Across Ethereum and L2 Networks

·2 views

A confidential assessment by a senior DeFi security researcher has rated MEXC's on-chain yield platform at 6 out of 10 on an overall risk scale, classifying it as medium-high risk. The platform manages over $5 billion in user capital across Ethereum Mainnet, Optimism, Arbitrum, zkSync Era, and Polygon zkEVM through products including liquidity mining, staking, and cross-chain yield portals. Auditors identified critical vulnerabilities including re-entrancy flaws in reward-claim contracts, a single-point oracle dependency, and an unaudited custom Merkle proof verifier in the bridge layer. Governance concerns were also raised, as the proxy admin key is held by a single hot wallet and the governance timelock stands at just 24 hours, below industry standards. Researchers warned that a worst-case combination of oracle manipulation and bridge proof spoofing could put up to $200 million in user funds at risk, and recommended multi-sig governance, composite oracles, and expanded smart-contract test coverage as priority fixes.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Stack Overflow's Slow Decline Predates the AI Era, One Engineer's Data Shows

A software engineer who built his debugging skills by answering questions on Stack Overflow between 2018 and 2024 has shared data showing his own activity collapsed well before AI tools like ChatGPT arrived. His annual answer count dropped from 150 in 2018 to just 3 by 2022, while the platform itself was still receiving over a million questions per year. The engineer argues the site's real turning point came around 2014, when Stack Overflow began aggressively closing questions for quality violations, discouraging new users from engaging. A 2022 study found roughly half of new-user posts received a closure, no answer, or an unexplained downvote, effectively stripping the platform of the human interaction that once made it valuable. By systematically eliminating conversation and context, the site inadvertently created the ideal conditions for an AI tool to replace it entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

One Git Repo Can Replace Jira, Confluence, and TestRail for Traceability

A software development pattern proposes storing tickets, wiki pages, test cases, and test runs as YAML files within a single Git repository, eliminating the need for multiple SaaS tools. The approach uses consistent file-based IDs — such as AUTH-102.yaml for tickets and W-XXXXXX.yaml for wiki pages — so that linking between artifacts means opening a local file rather than calling external APIs. Inline wiki-style references like [[AUTH-102]] or [[wiki:W-ABC123]] can be embedded in any Markdown body, with unresolved links visually flagged before changes are synced. Because all data lives on disk, search, related-item lookups, and navigation work offline and behave like switching files in an IDE. The trade-off is that it forgoes automatic bi-directional sync with tools like Jira, but gains a reviewable, grep-able graph that requires no account or login to browse.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Model Security Training Must Address Checkpoint Deserialization Risks

Most AI security training focuses on prompt injection and jailbreaks but overlooks a more fundamental threat: malicious code hidden inside model checkpoint files. PyTorch's .pt and .bin files contain Python pickle archives that execute arbitrary code when loaded, a vulnerability class known as CWE-502 deserialization of untrusted data. CVE-2025-24357 demonstrated this risk in vLLM, where checkpoints downloaded from a model hub were loaded without the weights_only=True safeguard, enabling remote code execution on the inference host. A parallel flaw, CVE-2024-11393, affected Hugging Face Transformers with a CVSS score of 8.8, reached through MaskFormer model file parsing. Security teams are advised to inspect checkpoint files using tools like pickletools and fickling, adopt safer formats such as safetensors, and mirror approved models into internal registries pinned by digest rather than pulling directly from public hubs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Handle Browser File Uploads Without Exposing Your API Key

Storing API keys in the browser is a security risk, as client-side code can be inspected and credentials copied by anyone. A safer approach involves the server generating a short-lived, scoped upload link using the API key, then passing only that link to the browser. The browser never sees the actual API key; it simply redirects the user to a hosted upload page via the temporary URL. Developers can enforce restrictions on the link, such as allowed file types, size limits, file count, and expiry duration. This pattern is suited for workflows like support forms, job applications, and document collection where users need to submit files securely.

0 comments Read more at DEV Community