Security Report Flags High-Risk Flash Loan Vulnerabilities in EigenCloud DeFi Protocol

·1 views

A technical security audit of EigenCloud, a DeFi liquidity-aggregation protocol managing approximately $7.04 billion across Ethereum and multiple Layer 2 networks, has identified six flash loan attack vectors as of its v2.3.1 mainnet deployment. The report, dated September 25, 2026, assigns EigenCloud an aggregate flash loan risk score of 7.4 out of 10, classifying it as high risk. The most severe findings include unprotected price oracle updates that can be manipulated within a single flash loan transaction, a re-entrancy vulnerability in the flash loan router's callback function, and insufficient slippage controls on internal batch swaps. Auditors noted that EigenCloud's oracle aggregation logic lacks time-weighted price smoothing, making it susceptible to temporary price manipulation that could trigger under-collateralized liquidations or erroneous reward payouts. The report recommends immediate remediation of the oracle integrity, re-entrancy, and slippage issues, alongside a longer-term security hardening roadmap.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer finds SDK retried LLM calls twice despite explicit retry disable setting

A developer building an AI coding agent discovered that disabling retries at the harness level did not prevent the underlying OpenAI Node SDK from making its own default two retries, resulting in three server requests instead of one. To enforce a strict single-request policy, they implemented a fetch-level guard injected via NODE_OPTIONS, which initially passed local tests. However, end-to-end testing revealed the guard was being silently overwritten at startup by undici.install(), which reassigns globalThis.fetch, rendering the protection ineffective. The fix involved using Object.defineProperty to make the fetch property non-configurable, ensuring all requests always pass through the guard while still allowing the underlying fetch implementation to be swapped internally. The investigation also surfaced an unplanned analytics request to a PostHog telemetry endpoint, highlighting the importance of testing the full binary rather than individual library components in isolation.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Vowel estimator accuracy skewed by audio order and duration, developer finds

A developer building a browser-based vowel estimator for VRM avatar lip-syncing discovered that evaluation results were being distorted by the measurement method itself rather than true estimator performance. Because the estimator tracks a long-term average of frequency-band levels that updates with each audio input, the same sound produces different feature values depending on what was heard before it. Evaluation audio was synthesized using Style-Bert-VITS2 across three speakers and five Japanese vowels, then mechanically screened for length, RMS, peak, voicing rate, and formant quality before use. Pitfalls included misleading peak normalization flagged as clipping and LPC-based formant estimation picking up harmonics for high-pitched speakers, prompting a direct spectral analysis instead. A leave-one-speaker-out validation scheme was also applied to ensure results were not artificially inflated by speaker overlap between template design and evaluation data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds 23% of Dev.to articles silently deleted after building custom data scraper

A developer discovered that 235 of their 847 supposedly published Dev.to articles had been quietly soft-deleted by the platform between 2019 and 2023, with no user notification. The discrepancy only came to light after the developer built a custom Python scraper using the standard library alone, bypassing third-party packages to pull nine years of personal posting history. The project also exposed a memory management problem with Dev.to's API, where joining article data with reactions and comments caused in-memory JSON to balloon from roughly 510 MB to several gigabytes, crashing an 8 GB cloud instance. To solve this, the developer restructured the workflow as a streaming pipeline with bounded queues, batched writes, and a token-bucket rate limiter, all without external dependencies. The build highlighted how platform-reported metrics can diverge significantly from a user's actual content record.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev builds Python scraper to track Google Hotels prices without an API key

An 18-year-old engineering student has created a Google Hotels Scraper, available as a paid tool with a free trial on the Apify platform. Since Google offers no official API for its hotel pricing data, the scraper fetches prices by parsing embedded script blobs directly from hotel search pages over plain HTTP, requiring no headless browser. A typical query returning 50 hotels completes in under a minute and delivers structured data including nightly price, taxes, ratings, deals, and coordinates. The tool can be called via Python or Node.js using the Apify client library, and each hotel record includes a stable entity token that allows price comparisons across multiple runs over time. The developer also demonstrated a practical use case: automatically logging daily Charlotte hotel prices into a Google Sheet to track price movements over several weeks.

0 comments Read more at DEV Community