Security Audit Flags High-Risk Reentrancy and Access Control Flaws in Paxos Gold

·3 views

A security audit of Paxos Gold (PGX), a regulated gold-backed token protocol with roughly $1.91 billion in total value locked, identified critical vulnerabilities across its smart contracts as of August 30, 2026. The most serious flaw lies in the PGXBridge withdrawal function, where an external call is made to a user-supplied address before the withdrawal nonce is updated, enabling a classic reentrancy attack that could allow double-spending of gold-backed tokens. On the access control side, the PGXController contract allows any address to nominate a pending owner without restriction, and the proxy upgrade function is guarded by a multisig key that has not been rotated since launch. Additionally, the PAUSER_ROLE is delegated to a single external contract, PGXStaking, which itself carries upgrade-path risks that could allow an attacker to seize pause privileges. Auditors rated the combined risk at 8 out of 10, warning that a coordinated exploit could break the protocol's 1:1 gold peg, freeze user funds, or enable a rug-pull scenario.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Twitter's Architecture Handles 500 Million Tweets and Celebrity Fan-Out

A system design breakdown of Twitter-scale infrastructure explains how the platform manages 500 million daily tweets using Cassandra for write-heavy, time-series storage partitioned by user. Timelines are served through a hybrid approach: pre-computed tweet ID lists cached in Redis for regular users, combined with real-time fetches for high-follower celebrity accounts at read time. This hybrid fan-out model solves the celebrity problem, where a pure write fan-out to 100 million followers simultaneously is computationally impossible. Media uploads are handled via a dedicated service that stores originals in S3, asynchronously generates multiple resolutions, and serves all assets through CloudFront CDN. The overall design prioritises high availability and low latency, accepting eventual consistency of one to two seconds on timelines as an acceptable trade-off.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Git Success Messages Can Mislead: Four Behaviours Developers Should Verify

A developer writing for DEV Community has documented several Git behaviours where success messages do not accurately reflect the resulting repository state. The post, originally prompted by a request from developer Sylwia Laskowska, covers findings from both routine rebasing and a stacked-PR workflow tested on Git 2.39.5. Key issues include rerere failing to record conflict resolutions unless git commit or git rebase --continue is used, and rerere.autoupdate silently staging replayed resolutions without prompting the user to verify them. The --autosquash flag on git rebase can print a success message while leaving a fixup commit unreduced in history if the specified range does not reach the target commit. The author recommends checking actual repository state after these operations rather than relying solely on Git's output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

20-Year IT Veteran Builds Side Projects With No Frameworks or Build Tools

Felipe, an IT operations professional with over two decades of experience managing infrastructure at a Costa Rica-based organization, deliberately avoids modern frameworks and build tools in his personal web projects. Drawing on his day-job philosophy of long-term maintainability, he questions every dependency by asking what happens when it breaks with no one else around to fix it. His current side project is a bookmark manager featuring a nuanced link checker that distinguishes between dead links, login-gated pages, and redirects rather than flagging errors on a single failed request. The technical stack relies on vanilla JavaScript on the frontend and PostgREST with PostgreSQL row-level security on the backend, with background tasks handled by Python scripts on cron — no custom application server included. He acknowledges real trade-offs, noting that features like drag-and-drop reordering took far longer to build by hand than they would have with a framework, but argues that platform-native web standards increasingly reduce the need for external libraries.

0 comments Read more at DEV Community

ProgrammingHacker News ·

FreeCORE Project Aims to Continue TrueNAS Core Development

A community initiative called FreeCORE has emerged to continue development of TrueNAS Core, the open-source NAS operating system. The project appears to have launched its own website at freecore.org to support ongoing maintenance and development efforts. This follows concerns within the community about the future direction of TrueNAS Core after iXsystems shifted focus toward TrueNAS SCALE. The discussion was posted on Hacker News, though it attracted minimal engagement at the time of reporting.

0 comments Read more at Hacker News