Security Scanner Found 2022 Wormhole $325M Bug, Missed Cashio $52M Flaw in Replay Test

·1 views

A security team ran their static analysis scanner against the pre-hack source code of two Solana protocols — Wormhole and Cashio — without prior knowledge of the vulnerabilities, publishing both results including the failure. For Wormhole's February 2022 breach, the scanner correctly identified within seven minutes the unverified instructions sysvar account that allowed attackers to forge guardian signatures and mint $325M in wrapped ETH from nothing. On the Cashio protocol, exploited for $52M in March 2022, the tool flagged a related symptom but missed the actual root cause. The team stressed these were 2026 re-runs on long-patched, publicly known code and made no claim the tool would have prevented either real-world incident. Of five total Wormhole findings, only two were rated genuinely valid after manual verification, highlighting that raw scanner output requires careful human review to separate real risks from false positives.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 24 free browser-based dev tools with no data uploads

A developer frustrated with ad-heavy JSON formatting sites has launched jsonkit.tools, a suite of 24 client-side browser tools that process data locally without requiring signups or file uploads. The platform covers JSON formatting, validation, format conversion between JSON, CSV, YAML, and XML, Base64 and URL encoding, JSON diffing, TypeScript generation, and more. Each tool has its own dedicated URL and is built with Astro for fast static page loads, using vanilla JavaScript to avoid framework overhead. Beyond the browser interface, the creator also released api.jsonkit.tools, offering 28 API endpoints that mirror the UI's functionality for use in automation workflows and LLM agent pipelines. The project is open for public feedback and is available free of charge.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo Devs Can Automate Nightly Code Reviews for Free Using a Shell Script

A lightweight, zero-cost code review pipeline has been outlined for solo developers who lack a second set of eyes on their pull requests. The method uses a scheduled overnight batch job rather than interactive AI sessions, significantly reducing token consumption and extending free-tier quotas. The script collects the past 24 hours of Git commits, generates a diff, and sends a single structured prompt to MonkeyCode's free API endpoint, which currently offers 10 million tokens. Output is written to a local review file in a parseable format, flagging issues visible within the diff without claiming full codebase comprehension. The pipeline is designed to be model-agnostic, requiring only two environment variables, so it can survive backend changes without modification.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AceRank Stretches a Fixed API Budget to Keep Live Tennis Scores Fresh

AceRank, a free unofficial tennis bracket and fantasy app for ATP men's tournaments, uses an adaptive polling system to keep live scores and standings current without exceeding a fixed upstream API request budget. Because different match data — such as scores, start times, and results — changes at different rates, flat polling wastes quota on idle courts while potentially missing active ones. The system prioritizes fetches based on how overdue a match is, its round, seed, and player ranking, ensuring higher-stakes matches receive more frequent updates during busy tournament days. A scheduled worker evaluates local match state and recent API usage telemetry on each run rather than following a rigid per-match schedule. Derived standings for brackets and fantasy groups are computed server-side from ingested results, keeping vendor credentials and upstream calls away from end users entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Protein Design Needs Literature-Backed Triage to Bridge Generation-Testing Gap

AI-driven lab-in-the-loop protein and antibody design can generate up to 30,000 candidates per lead molecule in a single round, yet only a few hundred are ever synthesised and tested. A documented Genentech and Prescient Design study across four rounds and four clinical targets showed roughly 45 variants assayed per lead molecule against a generation ceiling of 30,000 — a gap of nearly three orders of magnitude. Current ranking systems rely solely on model-internal signals such as predicted structure quality, binding affinity, and model confidence, which answer fundamentally different questions and can inadvertently deprioritise well-supported candidates. The proposed solution is a 'literature-in-the-loop' triage layer that retrieves published structural, sequence, and affinity data to rerank candidates before wet-lab slots are allocated. This layer would not eliminate novel designs but would enrich the assay queue with evidence-backed candidates while reserving dedicated capacity for genuinely novel architectures.

0 comments Read more at DEV Community