Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
1inch/limit-order-protocol
master @ 4ae43ed
4
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Access Control: 3 prior fixes. Scrutinize any change in this area.
contracts/LimitOrderProtocol.sol: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: The amount field could be misinterpreted as tokenId, leading to unintended NFT transfers. The fix added an explicit tokenId parameter, but variant paths may still rely on implicit conversion.
Access Control: A single owner controlled all token-type proxies, allowing cross-type unauthorized transfers. Separation into per-type immutable owners is required; any shared-owner fallback is risky.
Access Control: Non-exact selector matching allowed invoking other proxy functions, enabling unauthorized transfers. Only IERC20.transferFrom selector must be accepted; any wildcard or fallback is dangerous.