标签：#TC

Last week I was reviewing the staking engine of a protocol before its mainnet launch. Deep in a 1,400-line contract, I found what looked like a serious bug. The reward math multiplied three values before dividing: uint256 delta = (lot.amount * rBase * midpointRate) / (RAY * RAY); Multiply-before-divide. If that intermediate product overflows uint256 , the whole epoch settlement reverts — and since every stake , withdraw , and setStake runs it, the post's funds get permanently frozen . That's a High-severity, fund-locking DoS. I had the finding half-written. lot.amount can reach 10M tokens ( 1e25 ). rBase grows with elapsed time. midpointRate can hit RAY . Multiply those and you blow past 2^256 ... I was ready to send it. Then I did the one thing that separates a real audit from false-positive spam: I checked the actual constants before writing the claim. uint256 private constant RAY = 1e18; // I'd assumed 1e27 RAY was 1e18 , not the 1e27 I'd been carrying in my head. And the interest rate had a hard cap — MAX_RATE_MAX_RAY = 5e18 , enforced even against a fully-captured timelock. I ran the numbers with the real values: For that multiplication to overflow, the protocol would need to go 2.3 × 10¹⁵ years without a single state update. Not reachable. The bug didn't exist. I deleted the finding. Why this matters more than the bug would have If I'd sent that report, here's what happens: the team's engineer clones the repo, plugs in the real constants, and realizes in ten minutes that I flagged an overflow that can't happen. Every other finding in my report now gets read with a raised eyebrow. My credibility — the entire product — is gone. This is the dirty secret of automated smart-contract auditing: the bottleneck isn't finding issues. It's not drowning the real ones in false positives. Anyone can run a scanner and paste 40 "criticals." A team that has to triage 40 flags to find the 2 that matter will — correctly — stop trusting you. The bar I hold: zero false positives o

Written by Marlowe Finch, archival bloodhound at Bitcoin Institute. Bitcoin has been decentralized and trustless since block zero. No CEO, no committee, no kill switch, no single person who can rewrite the rules. That's the pitch. It's why the whitepaper still gets quoted like scripture. Block 74638 does not agree with the pitch. What actually shipped in that block On August 15, 2010, a transaction landed in the Bitcoin blockchain with two outputs. Each one paid out 92,233,720,368.54277039 BTC . Combined: over 184 billion BTC — roughly nine thousand times the 21 million BTC that will ever exist, created in a single transaction. The validation code, CheckTransaction() , checked that each individual output was non-negative. It never checked whether the sum of the outputs overflowed. Two values chosen just under INT64_MAX, added together, wrapped around to a negative number in signed 64-bit arithmetic. A 0.5 BTC input, compared against that negative sum, satisfied the "input covers output" check. The transaction validated. The block got mined. Every rule the network was running said this was fine. That's CVE-2010-5139. It is also, by any dollar value you want to apply, the most expensive missing bounds-check ever shipped to production. So who hand-builds a transaction engineered to overflow a signed 64-bit integer, and what does a currency with a hard 21-million-coin cap do when someone mints nine thousand times that in one block? The archive's full account of the incident lays it out block by block . The receipts 18:08 UTC, August 15 — Jeff Garzik opens a BitcoinTalk thread titled "Strange block 74638", pastes the raw block dump, and closes with one question: "92233720368.54277039 BTC? Is that UINT64_MAX, I wonder?" 20:38 UTC — Satoshi Nakamoto, to the bitcoin-list mailing list, network-wide: "*** WARNING *** We are investigating a problem. DO NOT TRUST ANY TRANSACTIONS THAT HAPPENED AFTER 15.08.2010 17:05 UTC (block 74638) until the issue is resolved." 20:39 UTC — Ga

Databricks has remade its image into an AI company and has published research on the cost savings of open weight AI models for coding.

If every meeting, watercooler conversation, and date gets transcribed and summarized, who's actually reading any of it?

An error with the cloud computing giant’s billing operation caused some customers’ monthly bills to rise from a few cents to billions of dollars.

Pebble founder Eric Migicovsky says buyers of its new e-paper smartwatches should know what they're signing up for and trust Pebble to make things right if they run into issues, despite the short warranty. "I think the most important thing is trust," Migicovsky told me in an interview this week. "Do people trust the product […]

From the best air fryer to frying pans to knife sharpeners anyone can use, these ideas will keep the curious home chef in your life tinkering away.

The Japanese Microwave measures food temperature directly, and stops cooking when food’s hot. It’s kinda terrific.

Swatch’s latest MoonSwatch is the Mission to the Moon 1969, a limited-edition model with components crafted from Omega’s 18K Moonshine Gold. To get one, you'll have to join a lottery.

Published to Dev.to — Bitcoin Development Series, Part 1 of 4_ Bitcoin is heading toward an August 2026 deadline for BIP-110, a proposed temporary softfork that would restrict Ordinals-style arbitrary data from being embedded in transactions for one year. As of today, miner signaling sits at effectively zero. The proposal is almost certainly going to fail but the mechanics of why and how are worth understanding if you work anywhere near the Bitcoin protocol. This post walks through how soft fork activation works, what BIP-110 specifically proposes, and how to inspect miner signaling yourself with code. What Is a Soft Fork? A soft fork is a backward-compatible change to Bitcoin's consensus rules. Nodes running old software still accept blocks from nodes running the new rules — but not vice versa. This is what makes soft forks safer than hard forks in a permissionless network: you do not force everyone to upgrade on day one. Hard forks, by contrast, change rules in a way that causes old nodes to reject new blocks entirely. They require near-universal coordination, which is why Bitcoin has avoided them. How Soft Fork Activation Works: BIP 9 The dominant activation mechanism used since 2016 is defined in BIP 9 . The process works like this: A proposal is assigned a version bit (bit 0–28) in the block header's nVersion field. Miners signal readiness by setting that bit in blocks they produce. Activation requires 95% of blocks in a 2,016-block retarget window to signal support. There is a starttime and a timeout . If the threshold is not met before timeout , the proposal fails and is discarded. # Simplified BIP 9 state machine logic THRESHOLD = 0.95 # 95% of blocks in a retarget window WINDOW = 2016 # one retarget period def check_activation ( signaling_blocks : int , total_blocks : int ) -> str : ratio = signaling_blocks / total_blocks if ratio >= THRESHOLD : return " LOCKED_IN " # activates after one more window return " STARTED " # still counting print ( check_activati

What Is My IP Address? IPv4 vs IPv6 Explained for Developers If you've ever debugged a CORS error, set up an IP allowlist, or wondered why req.ip returned something weird in your Express logs, you've run into the same question from a different angle: what actually is an IP address, and which one is "mine"? fastestchecker.com This post breaks down IPv4 vs IPv6, public vs private IPs, and how to reliably detect a user's IP address in your own code — plus a fast way to check yours right now. fastestchecker.com TL;DR IPv4 addresses look like 192.168.1.1 — four numbers, 0-255, separated by dots. There are about 4.3 billion of them, and we've run out. IPv6 addresses look like 2001:0db8:85a3::8a2e:0370:7334 — a much larger address space designed to replace IPv4. Your device usually has a private IP (local network) and shares a public IP (internet-facing) with everyone else on your router. You can check your current public IP instantly with a tool like FastestChecker's IP Checker — useful for confirming what your server or API actually sees. > IPv4 vs IPv6 : What's the Actual Difference IPv4 IPv4 has been the backbone of the internet since the 1980s. It's a 32-bit address, which caps the total number of unique addresses at roughly 4.3 billion. Given how many devices are online today, that pool has been effectively exhausted for years — which is why NAT (Network Address Translation) exists: it lets an entire household or office share one public IPv4 address. Example IPv4: 203.0.113.42 IPv6 IPv6 uses 128-bit addresses, which gives it an address space so large it's effectively unlimited for practical purposes (2^128 addresses). It was designed specifically to solve IPv4 exhaustion, and adoption has been climbing steadily — most major cloud providers and mobile carriers support it by default now. ** Example IPv6:** 2001:0db8:85a3:0000:0000:8a2e:0370:7334 Quick Comparison IPv4IPv6Address length32-bit128-bitFormatDotted decimal (192.168.1.1)Hexadecimal, colon-separatedTotal addre

Microsoft is looking to sell its in-house AI models as more efficient and cost-effective than its competitors' models.

Neko Health has developed proprietary body-scanning technology, which it couples with bloodwork, to assess a person's health.

OpenAI, which is in the middle of a legal battle with Apple over hardware trade theft allegations, just released a light-up keyboard designed to be paired with its agentic coding app.

It's the company's first public proof point after a year and a half spent building AI infrastructure largely out of public view.

The Codex Micro is designed to monitor multiple agentic threads at a glance.

I've been building AI agents for a while now, and streaming responses to a UI has always been the painful part. In previous projects I tried API Gateway streaming, Lambda response streaming, and even AppSync Events via an agent tool call to notify the UI. I also looked at adding my own WebSocket API through API Gateway, which requires managing $connect , $disconnect , and $default routes, storing connection IDs in DynamoDB, and posting messages back through @connections . All of these approaches felt like too much ceremony for what should be simple. That's when I found that AgentCore has built-in WebSocket support. The browser can just connect directly to the agent. No middleman. I built WearCast to demonstrate this functionality. This is an AI agent that helps you pick out what to where based on the weather. I've found this very helpfu when packing for a trip. The code for this application is public and you can find the full implementation on this GitHub repo . The problem with the traditional approach We usually build app applications as we do REST APIs User → REST API → Lambda → AI Service → Lambda → REST API → User Every message makes a round trip through multiple intermediaries. The response waits until the entire generation is complete, and then it all comes back at once. For a chat interface, this feels sluggish. Users stare at a spinner while the model generates hundreds of tokens they could already be reading. Even if you add Server-Sent Events or long-polling, you're still stitching together a real-time experience on top of infrastructure that seemed like overkill. I wanted something better. The architecture Here's what I ended up with: ┌─────────────┐ ┌──────────────────┐ │ React UI │─── JWT ─▶│ API Gateway + │──▶ Lambda (presigned URL) │ (Cognito) │ │ Cognito Auth │ └──────┬──────┘ └──────────────────┘ │ │ WebSocket (SigV4 presigned URL) │ ← No middleman! Direct connection → ▼ ┌──────────────────────────────────┐ ┌────────────────────┐ │ AgentCore Runtim

A number of social media posts claim that GPT-5.6 Sol deleted files and data without warning. OpenAI had basically disclosed the problem in June.

Microsoft Corp. today released software updates to plug at least 570 security holes in its Windows operating systems and other software, almost triple the number of vulnerabilities the software giant fixed in its record-smashing Patch Tuesday release last month. Microsoft attributed the burgeoning patch counts to vulnerability discoveries aided by artificial intelligence.

Spotify is rolling out a new AI-powered conversational feature that lets Premium subscribers chat with the app to discover music, podcasts, audiobooks, and more.