Security review flags governance risks in Venus Core Pool, including upgrade and timelock weaknesses

·1 views

A governance attack surface review of the Venus Core Pool, a cross-chain lending protocol with about $1.25 billion in total value locked, was published on 19 October 2026. The assessment examined pathways by which attackers could manipulate proposals, bypass safeguards, or stall decision-making. It identified nine issues, with the most severe being a single-signer upgrade admin lacking a multi-signature guard and a potential timelock bypass via re-entrancy. The reviewers assigned the governance layer an aggregate risk score of 7.4 out of 10, citing quorum and voting-power concentration as additional concerns.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Local AI model reads parking ticket photos to draft appeal letters

TicketBack is an open-source tool that turns two phone photos, one of a parking ticket and one of the sign it was parked under, into an appeal letter. A locally run open-weight model, Gemma 3 4B via Ollama, reads the images, while fixed rules rather than the model determine whether the driver has valid grounds to appeal. The model only drafts the letter after the user confirms the extracted facts, and if no ground exists the tool says so instead of writing a weak appeal. Everything runs on the user's computer, so photos and plate data are not sent elsewhere. The developer built it because small fines are often paid rather than contested, and the project targets individual drivers and small fleets.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GBase Database Typical Install: Fixing Connection Failures and Chinese Encoding Problems

After a typical GBase Database installation, users may encounter connection failures and garbled Chinese text during initial testing. Connection problems can be diagnosed by checking the instance name in the environment script, the port mapped in /etc/services, and whether the instance is online using onstat. The /etc/services entry only maps a service name to a port and does not confirm that the server is actually listening there. Garbled Chinese text often stems from the default en_US.8859-1 locale, which is designed for Western European encodings and may conflict with application requirements. The article advises resolving these issues by verifying configuration before modifying parameters or reinstalling.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

An Up-to-Date CAD Revision Doesn't Guarantee Current Project Information

A drawing can carry the latest revision number while still containing outdated details, such as an old appliance model or a superseded finish. Project information is typically spread across CAD models, material schedules, hardware specs, product data sheets, and approval comments, and updating one file does not update the others. The author argues that approved materials, hardware models, verified dimensions, open comments, and production release status all need to be tracked alongside the drawing revision. A simple status record linking these decisions to the correct product or drawing can reduce confusion, especially when several teams work on different parts of a project. The article closes by asking how software, CAD, and manufacturing professionals keep decisions synchronized across files and teams.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How ExamParser Turns Messy Word, PDF, and Google Docs Into Quiz Question Banks

The author built ExamParser, a tool that converts Word, PDF, and Google Docs files into Canvas-ready quizzes without requiring a login. The core challenge is that documents have no native concept of questions, so the parser must infer questions, types, and answers from layout, styling, and authoring conventions. The pipeline extracts format-specific blocks, normalizes them into a shared schema, segments them into questions, classifies question types, and emits QTI or spreadsheet output. For Word files, paragraph styles and list markers provide cues, while PDFs rely on character coordinates to detect columns and option labels, and scanned PDFs require OCR. The post also explains how a tolerant regular expression detects numbered question starts across inconsistent formats.

0 comments Read more at DEV Community