Security Report Flags High Oracle Manipulation Risk at Bybit's DeFi Platform

·1 views

A DeFi security assessment dated August 30, 2026, assigned Bybit's oracle infrastructure a risk score of 7 out of 10, classifying it as high risk. The report targets Bybit's multi-chain DeFi ecosystem, which holds over $16 billion in total value locked across Ethereum and Layer 2 networks. Researchers identified four key attack vectors, including single-source price feed dominance, flash loan-based time-weighted median manipulation, cross-chain feed desynchronisation, and gas-price manipulation on Layer 2 rollups. While existing safeguards such as multi-source aggregation, time-weighted medians, and Chainlink fallback feeds reduce the likelihood of a successful attack, the report notes significant residual exposure. The assessment recommends prioritised technical upgrades to harden Bybit's oracle pipeline, strengthen on-chain verification, and reduce the economic incentive for potential attackers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Airlock Tool Catches MCP Servers That Lie About Being Read-Only

A developer has built a security tool called Airlock to verify whether MCP (Model Context Protocol) servers accurately describe their own behavior, particularly their read-only claims. The core problem is that MCP servers self-report how dangerous they are, creating a conflict of interest that AI agent frameworks may blindly trust. Airlock tests each server's declared behavior against what it actually does, flagging discrepancies as evidence of deception rather than issuing a blanket safety score. In controlled testing, a deliberately dishonest fixture triggered 7 findings across 36 checks — uncovering planted behaviors like hidden file writes, scope escapes, and data exfiltration — while an honest fixture produced zero findings. The tool also audited real-world public MCP servers and found that some simply declare no annotations at all, meaning they neither lie nor inform, leaving agent approval workflows with nothing to act on.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Verdict Tool Forces Bug Reproduction Before Any Patch Using Evidence-Bound AI Agents

A developer has built Verdict, an AI agent harness designed to rigorously reproduce software bugs before any fix is attempted or claimed. The system converts a GitHub issue into a structured investigation, running approved commands repeatedly and logging every result in an evidence ledger that cannot be selectively edited. Three specialised subagents handle trigger identification, change localisation, and regression planning, with each step constrained to claim only what the recorded evidence supports. Verdict was tested on TrueForge issue #417, where a stalled endpoint caused indefinite waits, achieving a verified 10-of-10 reproduction under the faulty condition and zero failures under a responsive control. All findings are cryptographically bound to a specific runtime, commit, and package version, allowing any reviewer to independently verify the results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Community adapter paseo-agy-acp v2.3.0 connects Paseo to Google's Antigravity ACP kernel

Developer and maintainer of paseo-agy-acp has released version 2.3.0 on npm, enabling Paseo to use Google's official Antigravity ACP kernel as a multi-agent provider. The open-source adapter acts as a thin NDJSON proxy, handling Paseo-specific integration concerns such as agent identity, mode mapping, and MCP normalization, while leaving authentication, inference, and tooling to the official kernel. Users must supply their own locally installed Antigravity kernel, a compatible Antigravity account, Node.js 22+, and Paseo — the npm package itself contains only the Apache-2.0 proxy code. The project is an unofficial community effort and carries no endorsement from either Paseo or Google. Its design deliberately keeps the open-source surface narrow and inspectable to avoid reimplementing or redistributing any proprietary provider components.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Architect Private Image Storage and Signed Thumbnails in Node.js

A recommended architecture for Node.js SaaS applications stores private original images and generated thumbnails in object storage, while delegating resizing to a dedicated application worker. Each image variant is recorded in the application database using deterministic key naming conventions, such as originals/{tenant}/{asset_id} and thumbs/{tenant}/{asset_id}/{variant}.webp, ensuring consistent retrieval and avoiding duplicate objects. Clients receive short-lived presigned GET URLs for secure access, while backend workers upload variants via presigned PUT or authenticated calls, keeping authorization tokens separate from returned URLs. The design enforces two core invariants: all images remain private or signed-only, and every resize request maps to exactly one database record and one storage key to prevent race conditions. Developers are cautioned that object storage alone lacks features like conditional writes, versioning, object lock, and automatic multipart cleanup, making external coordination essential for production reliability.

0 comments Read more at DEV Community