Security Audit Flags 11 Vulnerabilities in Aave V3, Rates Risk 7.4 out of 10

·11 views

A security audit of Aave V3, the decentralized lending protocol with approximately $17.7 billion in total value locked, identified 11 vulnerabilities across reentrancy and access-control domains, with three rated Critical. The review, dated September 2026, found improperly guarded external calls in flash-loan and collateral-withdrawal paths, as well as overly broad admin role assignments in the upgrade proxy. Auditors warned that a successful reentrancy exploit on the flash-loan entry point could theoretically allow an attacker to drain up to $1.2 billion before liquidation mechanisms respond. None of the vulnerabilities are currently exploitable on the live mainnet, as existing safeguards such as reentrancy guards and multi-signature governance provide interim protection. However, the audit stresses that any future upgrade or misconfiguration removing those defenses could expose the protocol to significant risk, making prompt remediation essential.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How SaaS Teams Can Build CSV Exports That Are Actually Useful to Customers

A practical guide published on DEV Community by developer Uriel Bitto outlines best practices for designing CSV exports in SaaS products. The guide emphasizes scoping exports to a specific user job, using clear column headers, and including stable record IDs so files remain useful outside the app. It recommends using established CSV libraries rather than manual string-joining, and testing output in the tools customers actually use, such as spreadsheets. Security concerns like CSV injection are also highlighted, with advice to apply access controls and sanitize untrusted values based on the intended destination. The core benchmark proposed is whether a customer can open the file, understand its contents, and complete their task without needing the app open beside them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds TikTok downloader, shares lessons on streaming and expiring URLs

A developer recently built a web service called FromTik that allows users to download public TikTok videos, slideshows, and audio files. Rather than saving full video files to disk before delivery, the service streams media in chunks directly from TikTok's CDN to the user, reducing disk usage and speeding up downloads. The developer avoided unnecessary re-encoding with FFmpeg, reserving it only for tasks like extracting MP3 audio or converting slideshows into video. A key technical insight was that TikTok CDN URLs are short-lived and signed, making long-term caching of extracted links unreliable. The article outlines how treating media metadata as request-specific rather than permanently stored leads to a more dependable architecture.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenBot enforces audit logging before any bot action executes, not after

OpenBot, an open-source agent framework described as a template rather than a finished product, routes every bot action through a single gateway that evaluates policy and writes an audit record before the action is carried out. The system uses CEL-based rules to inspect tool names, file paths, shell commands, and other parameters, and is designed to fail closed — a missing or broken policy blocks rather than permits. Sensitive data such as secrets are partially obscured in logs, recording only that a request was made and the length of the value, not its contents. Human takeovers during bot sessions — such as handling login walls or two-factor prompts — are also logged, and bot actions are refused rather than queued while a person is in control. The project is currently in alpha, has no hosted version, and is explicitly intended as a starting point for teams to adapt with their own configuration.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Model Jev Completes 60-Second Highway Drive Without a Single Crash

A developer used TypeSafe AI's decision-focused model Jev to control a simulated vehicle on a three-lane highway populated with 30 surrounding vehicles. After early attempts resulted in immediate crashes or the car stopping completely, the system was refined to ask Jev multiple simultaneous questions about lane changes, speed adjustments, and collision risk. The final run covered 1,203.72 metres in 60 seconds at an average speed of 72.3 km/h, with no collisions or full stops recorded. Jev, described by TypeSafe AI as a 'System One' model, returns typed decisions and probability values rather than conversational text, making it suited for real-time agent control. The experiment demonstrated that the model could apply roughly 2.73 driving decisions per second with a median response latency of around 311 milliseconds.

0 comments Read more at DEV Community