Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
BitGo/eth-multisig-v4
master @ 8855f34
3
Fixes
0
CVEs
HIGH
Peak severity
0.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
contracts/WalletSimple.sol: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: An authentication bypass vulnerability occurred when an invalid signature yielding the zero address (0x0) could be accepted as a valid authorization if the zero address was inadvertently registered or initialized as an allowed signer in the multisig contract.
Auth Bypass: The onERC721Received function was incorrectly exposed with public visibility rather than external visibility, deviating from the IERC721Receiver standard and introducing a risk of unexpected internal call paths.
Cryptographic Vulnerability: Standard ECDSA signature malleability was possible because the contract did not validate that the 's' value of the signature was in the lower half order, potentially allowing replay or transaction identifier manipulation.