Solo dev builds pay-to-message Telegram chat app with direct TON blockchain payments

·1 views

A mobile developer built Centence, a Telegram Mini App where sending a message costs cryptocurrency and the recipient earns the payment directly. The app runs on the TON blockchain, routing funds wallet-to-wallet via TON Connect, so the platform never holds user money. This non-custodial design was a deliberate workaround to avoid money-operator regulations, app store payment rules, and Telegram's Stars policy for digital goods. The developer takes a 10% fee as a separate output of each transaction, with the remaining 90% going straight to the recipient. The project was built solo over a few weeks, with an LLM assisting in coding, and all debugging was done using real on-chain transactions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Researcher Finds OpenSea Undocumented Server Leaking API Keys and Usernames

A security researcher discovered an undocumented MCP server at mcp.opensea.io/mcp while manually exploring OpenSea's internal tooling. Two exposed endpoints allowed anyone to generate a valid API key without authentication and then resolve any Ethereum wallet address linked to an OpenSea profile to its owner's username. The flaw raised serious privacy concerns, as pseudonymous wallet holders could potentially be identified and targeted through phishing or doxxing. Sensitive tools on the same server, such as order cancellation, were properly protected behind a wallet JWT, suggesting the exposure was limited to the discovery layer rather than a systemic architectural failure. The researcher reported the issue to OpenSea's Bugcrowd bug bounty program, where it currently awaits official severity triage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Adding LLM Descriptions to 1,245 Database Tables Made Search Retrieval Worse

A developer catalogued a 1,245-object database schema by generating LLM descriptions for every table, expecting improved search retrieval, but instead saw recall drop significantly. The problem stemmed from BM25 scoring mechanics: when a term like 'contact' appears in over 1,000 of 1,245 documents, its inverse document frequency collapses to near zero, stripping it of ranking power. Compounding this, BM25's length normalisation penalised the most important tables — which naturally have the most columns — pushing them further down rankings. Attempts to fix this by down-weighting prose fields helped marginally but sacrificed retrieval of rare, valuable terms like obscure view names. The author's solution was to maintain three separate BM25 indexes — one for identifiers, one for prose descriptions, and one combined — then fuse their rankings using reciprocal rank fusion.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Study finds all major text-to-SQL benchmarks ignore role-based access control

A new research paper titled 'Benchmarking Text-to-SQL under Role-Based Access Control' by Yang Fei and colleagues reveals that widely used benchmarks like Spider, BIRD, and LiveSQLBench evaluate AI systems without any user permission constraints. The researchers built a dataset spanning 53 databases, 399 tables, and over 21,500 role-annotated query instances with access policies defined at the individual column level. Testing existing text-to-SQL systems against this dataset showed significant performance degradation, with many generating SQL queries that are technically correct but violate access control rules — a category the paper terms 'RBAC-rejected' queries. The core problem identified is that standard AI pipelines apply database access controls only at query execution, meaning restricted tables and columns are still visible to the model during SQL generation. The paper argues that access control must be enforced earlier, at the schema-selection stage, so that restricted objects are never presented to the model at all.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

YINI Syntax Highlighting Extension Hits v1.0.0 on VS Code Marketplace

The official YINI Syntax Highlighting extension for Visual Studio Code has reached version 1.0.0 and is now publicly available on the Visual Studio Marketplace. Published by yini-lang, the extension targets YINI Specification 1.0.0 RC 6 and brings syntax highlighting support for .yini configuration files within VS Code. It covers a range of syntax elements including sections, keys, values, strings, numbers, comments, lists, objects, and directives. Developers can install it directly from VS Code by searching for 'YINI Syntax Highlighting' in the extensions panel. The release is described as one part of the broader YINI ecosystem, aimed at making .yini files easier to read and work with during everyday development.

0 comments Read more at DEV Community