SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Security Analysis Flags Flash-Loan Attack Vectors in HashKey Exchange

0
·1 views

A technical security review of HashKey Exchange, a decentralized exchange with a reported $1.547 billion TVL, identifies four possible flash-loan attack vectors against its settlement contract. The platform's core trust point is a single settlement contract that processes batched trades, which makes it the main target for such manipulation. The vectors include oracle price skewing through large spot swaps, batch reordering and front-running, and state injection via crafted calldata in the batch execution function. The authors caution that none of the vectors works alone without breaking an existing safeguard, but a combined multi-step attack could extract losses of up to about 5% of TVL, and they rate the overall risk 7 out of 10. The report recommends immediate fixes for the most critical findings followed by a phased hardening plan.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Sparse federated learning aims to monitor soft robot wear without sharing raw sensor data

The article describes a method called Sparse Federated Representation Learning for maintaining bio-inspired soft robots, such as octopus-like tentacle grippers. The author was motivated by a personal project where a local anomaly detector produced false alarms because it had only seen one actuator under specific conditions. Soft robots pose unique challenges, including distributed nonlinear deformation, gradual material degradation, manufacturing variance, and sparse sensing. The approach trains models locally on each robot, shares only model updates, and learns compact shared representations of degradation patterns. Inverse simulation is then used to check whether the learned representations match known continuum mechanics.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why custom post type URLs return 404 until permalinks are re-saved, and how to automate the fix

Custom post type URLs often return 404 errors after registration because WordPress stores its compiled rewrite rules in the database and does not rebuild them when code changes. Only a flush, such as re-saving Settings → Permalinks, refreshes those rules. Flushing on every request is wasteful, and flushing only on plugin activation misses theme switches, deploys, and other changes. The author's approach is to hash the registered rewrite data on the wp_loaded hook and perform a soft flush only when that fingerprint changes. This keeps the per-request cost to one option read and one hash. The article also notes a complication with plugins that register post types only in the admin area.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How a State Machine Using AASM Fixed Recurring Payment Failures in Rails

A developer working on a Rails platform that handled recurring renewal payments across several regions found that payment statuses were being updated from controllers, background jobs, and webhook handlers without any shared rules. This allowed impossible transitions, such as moving from failed straight to paid, and let out-of-order or duplicate provider events overwrite newer state. The fix was to model the payment lifecycle as an explicit state machine using the AASM gem, so invalid transitions become visible, loggable errors. The approach was further hardened with row-level locking during transitions, idempotent webhook handling backed by a unique database constraint, and keeping side effects like emails out of the transition itself.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Android apps with native code must support 16 KB memory pages by February 2027

Google Play now requires apps to support 16 KB memory page sizes on 64-bit Android devices, a shift from the long-standing 4 KB default. The requirement applies to apps targeting Android 15 and above, and from February 1, 2027, non-compliant apps will be blocked from releasing updates. Even apps not written in C++ can be affected, since libraries for machine learning, video, audio, databases, and analytics often ship native .so files. Developers can check their release APK in Android Studio's Build > Analyze APK tool, and CI pipelines can verify library segment alignment and zip alignment with command-line tools. Testing on a 16 KB page-size emulator or device is recommended to confirm native code loads and runs correctly.

0 comments Read more at DEV Community