Security Audit Flags Oracle Manipulation Risks on Gemini DeFi Platform

·1 views

A confidential security audit dated September 11, 2026, assessed oracle manipulation vulnerabilities on Gemini's DeFi platform, which holds a total value locked of approximately $5.19 billion across Ethereum and Layer 2 networks. The platform's in-house Gemini-Oracle supplies over 80% of price data for key assets like ETH, BTC, and USDC, drawing from a limited set of exchanges and publishing a single signed price per block. Auditors identified several high-to-medium severity risks, including single-source price feeds, insufficient TWAP smoothing, absent circuit breakers, and weak fallback verification for Layer 2 price feeds. Simulations suggest that a 30% price swing within one to two blocks could result in losses of up to 15% of total locked value through manipulated liquidations or synthetic minting. The platform received an overall risk score of 7.2 out of 10, reflecting incomplete or unevenly applied mitigations across its various modules.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Dev Turns Old PC into Pi-hole Ad Blocker to Learn Linux and Networking

A developer learning Linux through MIT's Missing Semester course has decided to convert an old PC into a Pi-hole, a self-hosted DNS-level ad and tracker blocker. The project is intended as a hands-on way to build real skills in Linux system administration and networking rather than just completing coursework exercises. The old PC is expected to arrive on Tuesday, after which the developer plans to begin with OS installation and initial setup. Unlike typical write-ups, the process is being documented in real time, with mistakes included, to give an honest account of the learning experience.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust Gets WebForms Core Support via New webformscore Crate

A Rust implementation of WebForms Core, a server-driven UI technology developed by Elanat, is now available as the webformscore crate on Cargo. The library allows Rust developers to build interactive web interfaces by having the server generate commands that instruct the browser on how to update the HTML DOM, rather than manipulating it directly. On the client side, a separate JavaScript runtime called WebFormsJS receives and executes those commands against the DOM. The crate integrates with popular Rust web frameworks such as Actix Web and can be installed via the standard Cargo CLI. WebFormsJS is distributed independently through npm or its official repository, keeping the browser runtime decoupled from the Rust backend.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Uber Predicts Your Driver's Arrival Time With Remarkable Accuracy

Uber calculates ETAs by dividing roads into roughly 100 million segments and measuring real-time crossing times using GPS pings sent by drivers every four seconds, effectively creating a free, city-wide traffic sensor network. Because live data only reflects the recent past, Uber built a deep learning system called DeepETA in 2022 to forecast traffic conditions up to three hours ahead, processing around two million requests per second. The model prioritizes fresh signals — such as a new accident — over historical patterns, and infers conditions on quiet roads from surrounding traffic data. A second correction model, trained on millions of completed trips, then adjusts for systematic errors like slow left turns or unaccounted stop signs. Uber reports that deploying DeepETA improved long-trip arrival accuracy by 6 percent, which the company estimates translates to approximately $100 million annually in retained gross bookings.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AICOM and AIMarket launch as linked AI factory and agent marketplace platform

AICOM is a multi-agent pipeline platform that takes a plain-language brief and moves it through thirteen specialized roles — including analyst, architect, developer, QA, and DevOps — to produce a deployable page. AIMarket serves as the connected marketplace where agents can discover capabilities, invoke them, and receive signed, verifiable receipts of completed work. Both platforms share the same MIT-licensed stack and are currently live, with guest access available at magic-ai-factory.com without requiring a login for the first build loop. The project also includes seventeen live mathematical oracles at oracles.modelmarket.dev and a chain-estimation studio called HEPHAESTUS at forge.modelmarket.dev. The team highlighted a key early lesson: using asyncio.gather without return_exceptions=True caused a single LLM timeout to cancel all parallel agents, underscoring that model failures in multi-agent pipelines are correctness issues, not just operational ones.

0 comments Read more at DEV Community