Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ChainSafe/forest

              main @ 56775a2
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Denial of Service: 35 prior fixes. Scrutinize any change in this area.

vm/interpreter/src/default_runtime.rs: most-fixed (4 issues). Treat as high-risk during review.

47 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Multiple fixes target unbounded memory allocation and integer overflows in bitfield deserialization, a core consensus data structure; failures can crash nodes or exhaust memory during sync.

Auth Bypass: Repeated gaps in JWT permission enforcement on RPC endpoints allowed unauthorized access to administrative write methods; multiple fixes were needed to fully gate privileged operations.

Auth Bypass: Chain sync paths repeatedly lacked proper signature verification or validation of peer-supplied data, risking acceptance of invalid blocks and chain corruption.