PancakeSwap AMM Faces Moderate-High Flash Loan Risk, Security Analysis Finds

·1 views

A security assessment dated September 2, 2026, by a senior DeFi researcher identified six flash loan attack vectors targeting PancakeSwap's AMM, which holds approximately $1.86 billion in total value locked across Ethereum and multiple Layer-2 networks. The protocol received an overall flash loan risk score of 6 out of 10, indicating moderate-high exposure. The most critical threat involves price oracle manipulation, where an attacker borrows a large flash loan to artificially inflate token prices within PancakeSwap pools, exploiting downstream protocols that rely on those prices before restoring the original price to repay the loan. This attack is made possible because PancakeSwap's core swap function lacks a time-weighted average price guard, leaving external protocols using it as a price source particularly vulnerable. Other identified vectors include liquidity pump-and-dump schemes, re-entrancy risks via malicious token callbacks, and cross-chain state-injection through Layer-2 bridges, though these were rated lower in likelihood and impact.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

PostgreSQL Group Roles: Manage User Permissions in Bulk with Simple SQL

PostgreSQL group roles allow database administrators to assign and revoke permissions for multiple users simultaneously, eliminating the need to manage each account individually. A group role is created using CREATE ROLE without login privileges, while individual users are created with CREATE USER and then granted membership in the group. Permissions assigned to the group role take effect immediately for all member users, with no need to restart active sessions. Revoking a group role from a user also removes associated permissions instantly, even during an ongoing session. Administrators can query system tables with custom SQL to list all group role assignments, as no built-in directory view exists for this purpose.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mileage Tracker App Driversnote Faces User Backlash Over Battery Drain and High Pricing

Driversnote, a mileage tracking app with nearly 3.8 million installs, automatically logs driving trips and generates IRS-compliant reports for tax deductions and reimbursements. Despite widespread praise for its near-perfect tracking accuracy, users consistently report that the app consumes 15–20% or more of daily battery life due to continuous background GPS polling. Pricing of up to $17–20 per month has drawn repeated criticism, with reviewers citing cheaper named competitors such as TripLog and MileIQ as better value. The app's free tier, capped at just 15 trips per month, has also frustrated users who feel the limit is not clearly communicated upfront. Analysts note an opportunity exists for a competing product built around battery-efficient APIs and a lower annual price point in the $20–30 range that reviewers say they would willingly pay.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Team Fixed Three Critical Jenkins Agent Security Flaws After Near-Miss

A software team discovered serious security gaps in their Jenkins CI/CD setup after a pull request from an external contributor briefly exposed a live network path to an internal metadata endpoint. Their core mistake was treating Jenkins agents as trusted infrastructure, when in reality agents execute arbitrary code — including from third-party contributors — and are not protected by controller-level access controls. The team had been routing both internal and untrusted fork-PR builds through the same agent pool, inadvertently giving external code access to internal deployment credentials. They had also mounted the Docker socket into agent containers for convenience, which effectively granted any running build root-level access to the underlying host machine. Following a thorough audit, the team separated build infrastructure by trust tier and moved away from docker.sock mounting to eliminate these critical attack surfaces.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer open-sources Kleinanzeigen's full 634-category tree after reverse-engineering it

A developer reverse-engineered the complete category structure of Kleinanzeigen.de, Germany's largest classifieds platform, after finding no public API or category reference existed. The tree spans 634 categories across three levels — 15 top-level, 143 second-level, and 476 third-level — each mapped with numeric or slug-based IDs. The dataset was compiled while building a tool called AnzeigenBoost and has now been released on GitHub under the MIT licence. The repository includes a full hierarchical tree, a flat names-only version, and a lookup code example. Contributors are welcome, as the maintainer acknowledges categories may shift over time as Kleinanzeigen updates its platform.

0 comments Read more at DEV Community