Security review flags concentrated voting power and short timelock risks in OKX governance

·1 views

A DeFi security researcher has published a governance attack surface review of OKX, which operates a hybrid on-chain and off-chain governance model with roughly $30.6 billion in TVL. The review examines core components including the OKB token, governor and timelock contracts, a multisig treasury, cross-chain bridges, and an oracle registry, most of which use upgradeable proxy patterns. Identified risks include concentrated voting power held by a small number of entities, flash-loan-based voting manipulation, a 24-hour timelock considered too short for community response, and the possibility of malicious upgrades if the governor is compromised. The author rates the overall risk at 7 out of 10 (high-medium), noting the system is well engineered but dependent on several critical design choices. The review is dated 20 October 2026.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Open-source Apify actor detects website tech stacks in bulk with one API call

A developer has published a Python-based Apify actor that identifies the technologies used by many websites in a single run. It sends one plain HTTP request per URL, without a browser, and returns detections labeled by category, such as CDN, JS framework, or UI framework. Each detection includes the evidence that triggered it, like a header, meta tag, or script, so results can be spot-checked. The tool recognizes about 60 common technologies without version numbers and can miss content that only appears after client-side rendering. The actor is pay-per-event and is not affiliated with Wappalyzer or BuiltWith.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to open Premiere Pro, After Effects and InDesign projects in the Craft apps

The Craft apps (FilmCraft, EffectCraft, DesignCraft and others in the ArtCraft suite) are free and open source, but projects from other editors don't open in them directly. Users should first check each app's File menu for a built-in importer, since Photoshop and Illustrator files already open in PhotoCraft and VectorCraft and InDesign's IDML export opens in DesignCraft. Premiere Pro projects must be converted before FilmCraft can read them, and bins, sequences, trims and most transitions carry over while clip keyframes, markers and titles often do not. After Effects compositions and layers transfer, but features such as Cinema 4D rendering and some plug-ins may not work in EffectCraft. The guide advises checking converted files thoroughly, comparing key sequences against originals, and always keeping the source file, and it notes that the author sells a paid converter tool, Craft Bridge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Shipment Exception Agent Blueprint Keeps Humans in the Approval Loop

A public reference blueprint describes an agent for handling logistics shipment exceptions, such as missed delivery windows. The design separates tasks: a model extracts facts from documents, while fixed code checks document fields, computes delay hours, and scores recovery options. Exception types are classified by ordered written rules, with a model's independent classification reconciled under a stated policy. Every run ends at a human approval gate, so no customer update or compensation is sent automatically. The authors argue that letting a language model write customer updates directly risks invented delivery times and unapproved offers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Pick the First Process to Automate With AI, Using a Simple Scoring Method

Teams starting automation often struggle to choose which task to tackle first, and a wrong choice can waste weeks of effort. The article proposes a deliberately simple method that scores each candidate task from one to five on four factors: how often it occurs, how clearly its rules can be written down, the volume of items handled, and how recoverable an error would be. Tasks with unrecoverable errors should only be automated up to the point of a human decision. Totals above fifteen mark strong first candidates, while scores under ten suggest reconsidering. The author also advises checking data access and assigning an owner for the exceptions automation cannot handle. In a finance example, a customer-email task scored 19 and beat the team's original priorities.

0 comments Read more at DEV Community