Security Analysis Flags 19 Vulnerabilities in Bitfinex Smart Contracts

·75 views

A DeFi security research report dated September 15, 2026, identified 19 vulnerabilities across Bitfinex's on-chain smart contracts, which collectively secure approximately $18.7 billion in user funds on Ethereum and Layer 2 networks. The analysis categorized nine high-severity issues spanning access control, proxy upgradeability, and cross-chain bridge logic, alongside medium and low-severity flaws involving re-entrancy, oracle manipulation, and flash-loan exploits. Critical findings include an unguarded ownership transfer function, a missing multi-signature requirement for key lending pool operations, an open bridge operator setter, and a governance timelock bypass in the DAO contract. The protocol received an overall risk score of 7 out of 10, indicating a moderately high threat level given its complexity and asset value. Researchers called for immediate remediation of all high-severity items to reduce the protocol's risk posture to a low-to-medium level.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Does a Silent, Face-Down Phone Really Drain Working Memory? Replications Say Not Much

A 2017 study by Adrian Ward and colleagues at the University of Texas at Austin reported that people performed better on working memory tasks when their phones were in another room than when on the desk. Later direct replications, including a 2022 pre-registered study by Ruiz Pardo and Minda at Western University with 383 analysed participants, found no effect of phone location. Meta-analyses by Parry, Hartanto and colleagues, and Böttger and colleagues pooled dozens of studies and found effects that were either very small or near zero. Researchers have pointed to limited statistical power across the field as a factor in the mixed results. The original headline-grabbing claim therefore looks considerably weaker than first reported.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why some SPC control charts get used and others get abandoned

A quality manager contrasted two control chart binders from the same process, one maintained for over a year and one abandoned after three weeks. The difference came down to whether the chart's limits were computed from the correct subgrouping, so alarms reflected real events. The article explains matching chart type to data, such as I-MR for single measurements and Xbar-R for small subgroups, and warns against mixing shifts, cavities, or trays within one subgroup. It recommends at least 25 baseline subgroups and a small default set of Nelson or Western Electric rules, documented for audit. Each chart should also have a named owner and a clear response plan for when it alarms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing Docker invalid reference format errors in GitHub Actions

Docker invalid reference format errors in GitHub Actions occur when the client rejects an image name locally, before any connection to a registry, because it violates the required reference grammar. The cause is usually visible in the printed reference, such as an uppercase letter in the repository name, a variable that expanded to nothing, or a doubled separator in the tag. Because the check happens in the client, these failures appear within a second and do not clear on retry. The article recommends computing a lowercase image name once, publishing it as a step output, and reusing it across jobs, for example with docker/metadata-action.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Guide Shows How to Run Claude Desktop on Free Open-Source API Backends

A DEV Community article describes a method for using the Claude Desktop interface with a local open-source gateway instead of Anthropic's paid servers. The gateway, called Free LLM API, aggregates dozens of free AI providers under one local key and automatically switches to another model when a rate limit is hit. The guide walks readers through downloading the app and generating free keys from providers such as Google AI Studio, NVIDIA NIM, Cloudflare Workers AI, and OpenRouter. It also suggests adding custom endpoints for stronger coding models and claims the combined free capacity exceeds 7.4 billion tokens per month. The article's performance and capacity claims are presented by the author and have not been independently verified.

0 comments Read more at DEV Community