Solana's Confidential Transfer Kill Switch: How It Works and What It Costs

·1 views

Solana's Token-2022 confidential transfers rely entirely on the ZK ElGamal proof program, a separate on-chain program that verifies zero-knowledge proofs for every confidential operation. Two validator feature gates exist to disable and re-enable this program, and both have already been used: a flaw in the verifier's Fiat-Shamir transcript discovered on June 10, 2025 triggered a disable at epoch 805, with the program restored at epoch 982 in June 2026 after audits. When the proof program is disabled, public token balances continue functioning normally, but confidential balances are frozen in place — holders cannot deposit, transfer, or even withdraw back to plain balances until the program is re-enabled. No state migration is required upon re-enablement, as the underlying ElGamal ciphertexts remain intact in accounts throughout the outage. Developers should also note that the older ZK Token Proof program still exists as an address but is a non-functional stub that silently returns success without verifying anything, meaning any tooling still referencing it provides no actual proof validation.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Insufficient source content to generate accurate headline

The provided source material contains only a URL and metadata, with no actual article text available for summarization. Generating a headline or summary without the full article would risk fabricating facts. Please provide the complete article text so it can be accurately reported. No summary has been produced in order to maintain editorial integrity.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Validate Address Data at Entry Point to Prevent Downstream System Errors

Incorrect or incomplete address data entered by users can quickly spread into billing, fulfillment, and mailing systems if not caught early. Experts recommend validating data as close to the point of entry as possible, rather than relying solely on batch cleanup processes that leave a window for errors to propagate. One effective approach uses real-time API-based validation, where a submitted address is checked and standardized before being saved to the database. This architecture keeps validation logic separate from core application code and supports use cases like ecommerce checkouts, CRM systems, and customer registration forms. Treating data quality as part of the application workflow — rather than an afterthought — reduces downstream cleanup and improves the reliability of connected systems over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

IoT Botnets Still Exploit Open Telnet and Default Passwords a Decade After Mirai

China's National Network and Information Security Notification Centre issued a notice in August 2026 identifying five active cross-border botnet families — Mirai, CondiBot, Gafgyt, TBot, and SoftBot — all gaining initial access through Telnet or SSH brute force against factory-default credentials and unpatched older vulnerabilities. Internet scanning tools like ZoomEye show that a significant number of devices continue to expose Telnet on port 23 to the open internet, forming the recruitment pool these botnets rely on. Analysts note that raw counts of reachable Telnet services overstate actual vulnerable devices, as the figures include honeypots, reconfigured network equipment, and lab systems hosted in cloud environments. Three structural factors keep the problem persistent: devices outlive vendor support cycles, ownership and maintenance responsibilities are often unclear in small organisations, and remote-access interfaces enabled for convenience are rarely disabled post-setup. While newer botnets like Dysphoria have adopted advanced techniques such as blockchain-based command infrastructure to resist takedowns, the initial entry method has remained unchanged since the original Mirai outbreak in 2016.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

APC Recommends 'model: inherit' to Keep AI Agent Definitions Portable

A design guideline for APC (a repository-owned context layer for AI agents) recommends using 'model: inherit' in agent definition files rather than hardcoding a specific AI model. The approach separates project knowledge — such as an agent's role, skills, and responsibilities — from operational details like provider accounts and available models, which can vary between contributors. When a model is set to 'inherit', the runtime resolves the actual model using its own configured defaults, rather than forcing every user who clones the repository to meet a potentially unavailable or unaffordable model requirement. Hardcoding a vendor-specific model is only advised when the task genuinely requires it, such as when a workflow depends on a model-specific capability agreed upon by the team. Project maintainers are encouraged to periodically audit agent files and replace incidental model choices with 'inherit', documenting any justified exceptions clearly.

0 comments Read more at DEV Community