Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Arcis-Protocol/core
main @ 256825b
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Access Control: 1 prior fix. Scrutinize any change in this area.
ArcisVault.sol: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The lack of adequate access delay or verification allowed unauthorized or sudden strategy shifts. Introducing a 24-hour timelock queue, withdrawal fees, and agent caps was necessary to prevent flash-loan exploits and unverified strategy registrations via addStrategy.
Logic Error: Relying on fluctuating, transient escrow balances for coupon distribution created a vulnerability where fair pro-rata sharing could be manipulated. The system was modified to track cumulative historical revenue instead.
Access Control: The contract defined a pause state flag to freeze operations under stress, but failed to enforce it on state-changing functions. This rendered the emergency pause mechanism ineffective across multiple operational entry points.