Tether Gold Bridges Rated High Risk 8.3/10, Nine Critical Vulnerabilities Found

·1 views

A security audit by a DeFi smart-contract research team, dated September 12, 2026, assessed the cross-chain bridge infrastructure of Tether Gold (XAU-T), which holds approximately $3.08 billion in total value locked across Ethereum, multiple Layer-2 networks, and non-EVM chains. The report identified nine critical attack vectors spanning smart-contract logic, bridge-relayer infrastructure, governance, and external dependencies, assigning an overall risk score of 8.3 out of 10. Among the most severe findings are a re-entrancy vulnerability in the mint function that could enable unlimited token creation, flawed Merkle proof verification susceptible to forged proofs, and an insufficiently secured multi-sig vault where two of five signing keys are controlled by the same legal entity. Additional risks include potential oracle manipulation that could trigger premature token releases and replay attack vulnerabilities allowing a single lock event to trigger minting across multiple Layer-2 networks. The researchers recommended immediate remediation of the highest-severity issues, followed by a phased security hardening roadmap.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bol's dev team shares hard lessons from migrating Backstage platform to pnpm

Developers at Dutch retailer bol migrated their internal Backstage developer platform from Yarn 4 to pnpm after five years, seeking better support for parallel Git worktree workflows used with coding agents. While the initial switch — pinning pnpm, replacing commands, and committing a new lockfile — was straightforward, CI pipelines repeatedly downloaded all 4,226 packages from scratch despite a cache being in place. The root cause was a mismatch between where pnpm wrote its store and where GitLab expected to find it, resolved by explicitly setting the store directory within the CI configuration. A further issue emerged when the cached archive ballooned to 1.42 GB across roughly 601,000 files because node_modules trees were included unnecessarily; dropping those reduced cache size by about 72%. The team concluded that package manager migrations surface hidden architectural assumptions, particularly around cache paths and what is actually worth caching.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Frontend Developers Need Stateful Mock APIs Over Static Ones

Frontend developers often rely on static mock APIs like JSONPlaceholder during backend development, but these tools fail to persist data across requests, causing issues such as newly created items vanishing after a page refresh. Static mock servers simply echo responses without storing any state, meaning POST, PUT, PATCH, and DELETE operations have no lasting effect on subsequent GET calls. This limitation breaks modern frontend patterns like query caching, optimistic UI updates, and reactive state management. Stateful mock APIs address this by maintaining a per-session overlay layer that merges mutations with baseline seed data, simulating real backend behavior. Tools built on this architecture allow developers to test full CRUD flows, conditional UI states, and multi-step navigation without needing an actual database.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How One Developer Ships a Real Mobile App Using an Entirely Free Tech Stack

A developer has built and deployed a fully functional mobile app with real users without incurring any monthly infrastructure costs. The stack combines Expo for mobile builds, Supabase for database and authentication, Render for background jobs, and Vercel for landing page hosting — all on free tiers. Each service comes with limitations, such as Supabase pausing idle projects after seven days and Render services experiencing slow cold starts after 15 minutes of inactivity. The developer works around these constraints using scheduled pings and strategic build timing rather than paid upgrades. The setup demonstrates that, as of 2026, free tiers from major cloud platforms are generous enough to support a production-grade mobile app from launch onward.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Agentless Home Server Orchestrator with 100 Pre-Built Stacks and Local AI

A developer has released NjordDeploy, an open-source, agentless deployment orchestrator designed for self-hosted home lab setups on devices like Raspberry Pi and Proxmox. The tool runs entirely from a control machine over SSH, leaving no background agents or daemons on the target server, preserving its full resources for user applications. It includes over 100 production-ready service templates, supports both Docker and rootless Podman, and generates configurations using a fully local AI engine powered by Ollama. NjordDeploy evolved from an earlier project called PiSelfhosting and was built to address common pain points such as port conflicts, bloated management platforms, and cloud-dependent DevOps tools. All deployments produce standard docker-compose files, ensuring no vendor lock-in even if the tool itself is discontinued.

0 comments Read more at DEV Community