Security audit flags critical reentrancy and access control flaws in Grove Finance

·1 views

A senior DeFi security research team published an audit report on October 26, 2023, reviewing Grove Finance, a yield optimization protocol with approximately $2.33 billion in Total Value Locked across Ethereum Mainnet and Layer 2 deployments. The audit identified two critical and three high-severity findings centered on reentrancy vulnerabilities and weak access control mechanisms. Key critical flaws include an unguarded cross-chain message function in GroveBridgeAdapter.sol that could allow attackers to double-spend bridged assets, and an admin role in GroveAdmin.sol that combines upgrade and pause powers, enabling a compromised key to drain all user funds. A high-severity issue was also found in GroveYieldDistributor.sol, where yield distribution logic violates the Checks-Effects-Interactions pattern, exposing the protocol to repeated reentrancy attacks. Given the protocol's massive TVL, auditors rated the overall risk as high and warned that even low-probability exploits could result in catastrophic financial losses.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Workstation splits chat, live discovery, and agent skills into three layers

A developer building AI Workstation found that questions requiring live data — such as trending topics or active open-source projects — did not fit well inside a general chat interface. This led to a three-layer architecture: a general workspace for everyday tasks, public discovery Radars for current evidence, and installable Agent Skills for structured follow-up. Two Radars were introduced — Global Topic Radar for content creators and Open-Source AI Radar for developers — each displaying sourced, dated information without overstating its reliability. Two open-source Agent Skills, Topic Intelligence and AI Open Source Intelligence, translate Radar findings into structured briefs covering research gaps, license checks, and project comparisons. The design philosophy centers on making model limitations visible by separating freshness, identity, and provenance checks into explicit, inspectable layers rather than burying them inside a single prompt.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Run True End-to-End Email Tests in Playwright Without Mocking

Most email testing tutorials only verify that a send call was attempted, leaving the actual delivery and content untested. A more robust approach uses Playwright to drive a real signup flow while routing messages to a disposable inbox provisioned via a REST API, such as MoeMail. The setup involves four components: a unique per-test email address, the browser flow that triggers the send, a polling mechanism to retrieve the delivered message, and code or link extraction with assertions. Wrapping inbox creation in a Playwright fixture keeps transport logic out of individual tests and ensures each test run gets a fresh, isolated address. Key reliability tips include never sharing addresses across tests, asserting on regex extraction before using the result, and checking the HTML email part when plain-text content may be out of sync.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FLOCK.md: A Single Root File to Help AI Agents Navigate Repo Knowledge

A developer on DEV Community describes how AI agents writing project documentation faster than teams can organize it leads to unfindable, scattered records across repositories. To address this, they propose FLOCK.md, a plain markdown file placed at the repo root that maps where different types of knowledge — decisions, design notes, specs — are stored. The system also defines a four-document lifecycle per unit of work, covering why something was built, what was planned, how it was implemented, and what actually happened. A key rule requires that reversed decisions are never deleted but marked superseded with dates, so agents re-reading the codebase do not confidently re-propose already-rejected ideas. The author argues the blueprint-versus-worklog split is critical because agents are prone to treating outdated plans as current reality when divergence goes unrecorded.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indie dev repositions Mac security app as an AI agent sensing tool via MCP

A solo developer building a Mac network security app called RoamSwitch found conventional discovery methods ineffective, as the tool cannot be listed on the App Store due to its need for privileged system access and has no advertising budget. The developer also noted that users rarely search proactively for security software, making organic reach nearly impossible. Reconsidering the app's core function — continuously monitoring Wi-Fi trust, exposed ports, and suspicious URLs — the developer realized AI coding agents like those in Cursor or Claude Code lack any awareness of the local network environment they operate in. To bridge that gap, an MCP (Model Context Protocol) server was embedded directly into the app binary, allowing AI agents to query real-time security data such as exposed ports, guard status, and URL safety with a single config line. The pivot reframes the app from a human-facing menu bar tool into a security sensing layer for autonomous AI agents.

0 comments Read more at DEV Community