Six Smart Contract Exploits That Fake 'Firm' Liquidity on On-Chain Order Books

·1 views

A developer has demonstrated six smart contract techniques that bypass a common on-chain order book security check, EXTCODESIZE, which is used to verify that a resting order cannot be withdrawn. The check confirms code exists at an address but reveals nothing about what that code can actually do, creating a false sense of liquidity firmness. The exploits include hiding a cancel function behind an innocuous method name, using upgradeable proxies, delegating calls to attacker-controlled contracts, and granting external operators cancel rights post-order placement. All six contracts were deployed to a public testnet and their withdrawal escapes executed as real transactions. The findings highlight that EXTCODESIZE alone is an unreliable guarantee of order permanence and can mislead traders into trusting depth that can still be pulled.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Password Reset Email for Property Compliance: Node.js API or SMTP Relay?

Choice Best fit Main trade-off Direct email API A new Express or Next.js reset flow with one server-side integration You own an external API contract and its delivery events SMTP relay An organization with a monitored relay and established sender operations Connection, authentication, and relay diagnostics stay in your workload Email plus SMS A recovery design that genuinely needs two channels Abuse controls, consent, and audit evidence become two systems Short answer: use a server-side email API for a simple Node.js password reset when template ownership and an auditable delivery record matte

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Most AI Code Guards Never Proven to Fail, Developer Audit Finds

A software developer audited 204 automated checks across their repositories and found that 89% had never been tested to confirm they could actually detect a failure. To address this, they wired a known-bad test case through each reviewer's live execution path — not a separate unit test — requiring every guard to reject broken input, accept valid fixes, and reject a deliberately re-introduced bug. The approach caught real breakage, including in guards written that same week to handle the same class of problem. The developer also converted ten real incident records into runnable test cases, all of which passed validation without any being discarded. The broader concern raised is that a reviewer proven capable of saying 'no' on setup day provides no ongoing guarantee it will do so the next day.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Docker Compose Health Checks Improve Startup Order and Self-Healing

Docker Compose health checks help distinguish between a container that is merely running and one that is genuinely ready to serve traffic. A well-configured health check tests real readiness — such as querying a live HTTP endpoint — rather than just confirming a process exists. Services that depend on others can be gated using the depends_on directive, ensuring they only start once upstream containers pass their health checks. This setup also enables self-healing by pairing checks with restart policies, so a broken container is automatically replaced instead of silently serving errors. Defining a health check on every service that handles traffic or has dependents is considered a simple but high-impact reliability practice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Revamps Open-Source QR App with Google's Material 3 Expressive Design

A developer has overhauled their open-source Flutter app, Easy QR Toolkit, using Google's Material 3 Expressive (M3E) design framework. The update introduces tactile button groups with spring-physics animations, real-time Bézier shape morphing, and adaptive card lists with dynamic corner radii. Material 3 Expressive is designed to make mobile interfaces feel more personal and responsive through fluid motion and playful visual elements. The developer also contributed bug fixes and unit tests back to the material_3_expressive package on pub.dev. The updated app is available on Google Play, with source code publicly accessible on GitHub.

0 comments Read more at DEV Community