Researcher Shows How Web3 Frontends Can Expose Unauthenticated API Endpoints

·4 views

A security write-up explains how analysts can reverse engineer a Web3 application's minified JavaScript bundles to locate hardcoded backend API URLs. The author argues that because blockchain transactions are slow and costly, many Web3 apps depend on centralized APIs for prices, fees, and user data. By mapping routes that the frontend calls, the researcher identified several endpoints, with some correctly rejecting unauthenticated requests. One endpoint listing all ecosystem tokens, however, responded with a large JSON payload to a request lacking any credentials. The piece warns that the exposed data, including internal testnet contract addresses and hidden tokens, could aid targeted attacks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Anthropic moves to stop Claude from being used to reverse-engineer video games

Anthropic has taken steps to prevent its Claude AI model from being used to clone or reverse-engineer video games. The measures aim to curb attempts to copy game mechanics and code through the assistant. The report was covered by Mashable and discussed on Hacker News, where it drew significant attention from users. The article provides limited detail beyond the company's general intent to restrict such uses.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Publishing an App Was Harder Than Coding It, Developer Says

A developer who built MacroScout, a calorie tracker for iPhone and Android, found that the difficulty of launching the app lay in meeting App Store requirements rather than writing the code. The account describes App Store rules as external standards that must be read, interpreted for the specific app, and then applied through changes. Key figures cited include a $99 annual Apple Developer Program fee, a one-time $25 Google Play registration fee, and Apple's typical review of 90% of submissions within 48 hours. The developer also notes that new personal Google Play accounts must complete a closed test with at least 12 testers over 14 days. The developer advises keeping a running list of platform rules from the start of development and checking it throughout the build process.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Two easily missed details in paginated ASP.NET Core CRUD: sort ties and duplicate emails

A customer CRUD application can appear finished through the UI, yet two less visible behaviors need careful attention. The first concerns sorting, where records with equal sort values have no guaranteed order unless the unique ID is added as a secondary key. The second concerns duplicate email addresses, which an existence check alone cannot fully prevent when concurrent requests race, so a database unique index and translation of the resulting SQL Server error into a 409 response are also needed. The author's example clamps page parameters and warns that offset pagination still does not provide a consistent snapshot when records change between requests. The duplicate-email translation also assumes any uniqueness failure means a duplicate email, which must be revisited if more unique constraints are added. These observations come from a local demo and prior verification, not a production-readiness claim.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Mirza Games Explains How Its Browser PDF Compressor Hits Exact File Sizes Without Uploads

Dubai-based indie studio Mirza Games, which publishes on Google Play as Sezarr, has detailed how its PDF compression tool reduces files to a user-specified size entirely within the browser. The tool targets common needs such as government forms and job portals that impose strict file size limits. Processing relies on WebAssembly builds of qpdf, pdf-lib and pdf.js running in Web Workers, so files never leave the user's device. The engine applies lossless optimisation first, then progressively more aggressive steps, returning the first result that meets the target. Memory-based render caps on weaker devices mean very large files may be slower or rendered at lower resolution.

0 comments Read more at DEV Community