Security Report Flags High Flash Loan Risk on MEXC DeFi Platform Worth $5.24B

·1 views

A DeFi security assessment dated August 30, 2026, identified five significant flash loan attack vectors targeting MEXC, a decentralized finance platform with a total value locked of approximately $5.24 billion across Ethereum and Layer 2 networks. The report, prepared by a senior DeFi security researcher, assigned MEXC an aggregate flash loan risk score of 7.4 out of 10, placing it in the 'High-Risk – Immediate Mitigation Required' tier. The most critical vulnerabilities include oracle price-feed manipulation on L2 AMM pools, a re-entrancy flaw in the liquidity mining reward contract, and a cross-chain bridge race condition, with potential losses estimated at up to $300 million per vector. Additional risks involve governance token oracle manipulation and a collateral-ratio bypass in the lending module that could trigger under-collateralised liquidations worth $50–$100 million. The report recommends immediate remediation across the affected smart contracts, including MEXCPerpetual.sol, MEXCOracle.sol, MEXCRewardDistributor.sol, and related modules.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds AI tool to validate planning objections at NSW council hackathon

A developer built Setback, an AI-powered tool, over a weekend for Google's All Things Agentic Hackathon, designed to help residents craft legally valid objections to development applications in New South Wales. The tool analyzes a resident's submission against the statutory list of grounds councils are permitted to consider under NSW planning law, filtering out irrelevant concerns such as property value impacts or personal grievances. Each rejected ground is explained to the resident in plain English, along with guidance on what would make it legally viable. The project was built using a multi-agent AI coding workflow, where several agents worked concurrently on separate parts of the codebase rather than the developer writing code line by line. The build surfaced critical bugs — including silently discarded uploaded evidence and a misconfigured API fallback — that only became apparent through end-to-end testing on live infrastructure, not unit tests or code reviews.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Benchmark an AI Code Reviewer Before Switching to a Free-Tier Model

A developer has shared a structured regression-testing approach for validating AI code review bots before migrating to free-tier infrastructure, published on DEV Community as part of MonkeyCode's product outreach. The method involves creating a benchmark suite of ten pull request diffs, each paired with manually written 'golden' review comments that serve as expected outputs. A comparison script then measures precision, recall, and F1 scores by checking how closely the new model's responses match the golden set. The reviewer bot is packaged as a Docker container and deployed on a free Linux server, with the API key passed as an environment variable. The author argues that skipping this validation step risks silent quality regressions, where a model returns responses without flagging real code issues.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OSDU Lite lets developers run the OSDU data platform locally without cloud infrastructure

A developer has released OSDU Lite, an open-source, LocalStack-style emulator that runs the Open Subsurface Data Universe (OSDU) data platform entirely on a local machine. The tool is implemented in a single Python file and exposes key OSDU service APIs — including Storage, Search, Legal, Schema, and Entitlements — accessible at localhost with no cloud, authentication, or database setup required. It is designed for three common pain points: local development, CI pipelines, and demos where provisioning a real OSDU deployment is impractical. The emulator replicates realistic platform behaviors such as ingest validation and a simulated asynchronous indexing delay, and ships with a complete Well 360 integration demo using the official Java OSDU SDK. The project is available on GitHub at github.com/sohaibqasem/osdu-lite and can be launched with a single Docker command.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Free LLM Tiers Need Load Testing Before You Ship to Production

Developers using free large language model quotas in production risk unexpected latency spikes and service disruptions, as shared queues and rate limits are outside their control. Two engineering teams recently adopted free model access for core features, only to face performance failures when traffic doubled, costing one team an entire sprint of rework. Open-source project MonkeyCode offers free model access and a free server tier suited for experiments, prototypes, and delay-tolerant background jobs, but the same risks apply. Experts recommend running concurrency-based load tests before adoption, tracking metrics like latency percentiles, success rates, and retry overhead to determine whether a free tier is viable. Additionally, developers should treat free capacity like a staging environment, keep endpoints configurable for easy switching, and always maintain a clear exit path to paid or self-hosted alternatives.

0 comments Read more at DEV Community