Security Analysis Flags High-Risk Flash Loan Vulnerabilities in DeFi Protocol Portal

·1 views

A security assessment of Portal, a DeFi lending platform with approximately $1.54 billion in total value locked across Ethereum and multiple Layer 2 networks, has identified six significant flash loan attack vectors. The most critical finding involves oracle price manipulation, where an attacker could borrow hundreds of millions in stablecoins to skew Portal's price feeds and open under-collateralised positions, potentially draining up to 30% of TVL. Additional vulnerabilities include re-entrancy risks in flash loan callbacks, liquidation front-running, and a cross-chain bridge flaw that could allow double-spending of collateral between L1 and L2. The protocol's overall risk was rated 7.8 out of 10, described as high, due to its large liquidity pool, permissive callback design, and reliance on a single decentralised exchange for price data. Researchers reviewed the latest audited contract version and recommended stronger oracle safeguards, longer time-weighted average price windows, and stricter flash loan caps on low-liquidity assets.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GSoC 2025: CircuitVerse contributor adds JSON Schema and AJV validation in Week 14

A Google Summer of Code contributor working with CircuitVerse completed two major milestones during the week of August 24–30, after having two stacked pull requests merged over the weekend. The developer built a canonical JSON Schema for CircuitVerse project files, starting from auto-generated TypeScript types and refining them into a strict, reusable contract covering component IDs, port references, routing, and metadata. On top of that, a two-pass runtime validation layer was added using the AJV library — the first pass checks structural correctness against the schema, while the second performs cross-reference checks that schema validation alone cannot catch, such as verifying that net IDs and subcircuit references point to entities that actually exist. Validation errors now include precise JSON paths to help pinpoint issues, and the importer is designed to leave project data unmodified until both passes succeed. The work also ensures layout data remains optional, allowing the ELK Auto Layout feature to generate it on the fly when absent.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GSoC 2025 Week 13: CircuitVerse Gets Auto Layout Feature Using ELK.js

During the thirteenth week of Google Summer of Code (August 17–23), contributor worked on completing the Auto Layout feature for CircuitVerse using the ELK.js layered algorithm. The feature ensures circuits with missing layout data open in a clean, readable state rather than stacking all components at the same position. ELK.js arranges components left to right with orthogonal wire routing, while a temporary junction node handles fan-out nets without altering the canonical circuit format. A Git challenge arose because the Auto Layout branch depended on an unmerged Editor's Picks branch, making a direct PR against main impractical. The contributor resolved this by obtaining push access to the CircuitVerse repository and using GitHub's stacked pull requests workflow for the first time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Blazor Hybrid Apps Can Hide Route Conflicts That Only Surface at Runtime

In Blazor Hybrid multi-head applications, duplicate route declarations across a shared Razor class library and a host-specific assembly can go undetected until the router initializes at runtime. Both components compile cleanly, meaning a green CI build offers no guarantee that the combined route table is conflict-free. This is a broader modularity problem where individually valid modules can produce an invalid application graph after composition. For web-facing hosts, post-deploy smoke tests can catch such failures cheaply, but MAUI targets lack an equivalent lightweight startup check. A practical static guard that scans source files for duplicate @page directives across all scanned assemblies can turn this late runtime failure into an early, deterministic signal without requiring a browser, emulator, or running server.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vibe Engineering: A Disciplined Approach to AI-Assisted Software Development

Developer Pratik Batra argues that while AI-assisted 'vibe coding' dramatically accelerates prototyping, it produces inconsistent, insecure codebases that break down when pushed to production. He cites a 2025 internal tool built in five days with AI help that required near-complete rebuilding due to conflicting patterns and absent security architecture. Industry incidents, including the Lovable security breach and a Replit database deletion, reflect broader trust issues: developer confidence in AI-generated code fell from 40% to 29% even as AI now accounts for 41% of global code output. Batra proposes 'vibe engineering' as a middle path that retains AI's generative speed while applying genuine software engineering discipline around consistency, security, and maintainability. The core argument is that the gap between a prototype and a production-ready product is not more code, but better architectural decisions made by engineers who remain in control.

0 comments Read more at DEV Community