Solana Token-2022 Extensions Can Change Your Wallet Balance Without Any Transaction

·1 views

Solana's Token-2022 standard includes two extensions — interest-bearing mints and scaled-UI-amount mints — that alter the displayed token balance over time without any on-chain transaction occurring. The raw integer stored in a user's token account never changes; only the formula applied at display time shifts, based on a compounding rate or a multiplier tied to the mint's configuration. Because the displayed amount is calculated against a node's live clock at query time, the same account can return different balances when queried seconds apart or from nodes with slightly differing clocks. Most portfolio trackers, tax tools, and blockchain explorers rely on archived data that strips out this extension logic, meaning they may show balances that never actually existed. Notably, interest rates on these mints can be negative, allowing a token's displayed balance to silently decline over time with no visible transfer or burn in transaction history.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Switching Off Critical Thinking Never Pays Off

A piece published on danluu.com argues that there is no situation in which disengaging one's critical thinking leads to better outcomes. The article challenges the common notion that sometimes it is better to simply follow instructions without question. It suggests that active, engaged thinking remains valuable across all contexts, whether professional or personal. The post has gained early traction on Hacker News, accumulating points shortly after submission.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How SaaS Teams Can Build CSV Exports That Are Actually Useful to Customers

A practical guide published on DEV Community by developer Uriel Bitto outlines best practices for designing CSV exports in SaaS products. The guide emphasizes scoping exports to a specific user job, using clear column headers, and including stable record IDs so files remain useful outside the app. It recommends using established CSV libraries rather than manual string-joining, and testing output in the tools customers actually use, such as spreadsheets. Security concerns like CSV injection are also highlighted, with advice to apply access controls and sanitize untrusted values based on the intended destination. The core benchmark proposed is whether a customer can open the file, understand its contents, and complete their task without needing the app open beside them.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Ledger Researchers Break RP2350 Secure Debug Using Laser Fault Injection

Security researchers at Ledger's Donjon lab have demonstrated a method to bypass the secure debug protections on Raspberry Pi's RP2350 microcontroller. The technique, called Photon-Emission-Guided Laser Fault Injection, uses emitted light from the chip to precisely locate and target vulnerable transistors with a laser. By inducing carefully timed faults, the researchers were able to unlock secure debug access that is normally restricted. The findings highlight a hardware-level vulnerability relevant to embedded security and chip designers. Ledger published a detailed technical writeup on the method via their security research blog.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer builds TikTok downloader, shares lessons on streaming and expiring URLs

A developer recently built a web service called FromTik that allows users to download public TikTok videos, slideshows, and audio files. Rather than saving full video files to disk before delivery, the service streams media in chunks directly from TikTok's CDN to the user, reducing disk usage and speeding up downloads. The developer avoided unnecessary re-encoding with FFmpeg, reserving it only for tasks like extracting MP3 audio or converting slideshows into video. A key technical insight was that TikTok CDN URLs are short-lived and signed, making long-term caching of extracted links unreliable. The article outlines how treating media metadata as request-specific rather than permanently stored leads to a more dependable architecture.

0 comments Read more at DEV Community