Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ChainSafe/lodestar

              unstable @ 76b167b
            

122

Fixes

CVEs

CRITICAL

Peak severity

44.7%

Coverage

Highlights

Denial of Service: 37 prior fixes. Scrutinize any change in this area.

packages/beacon-node/src/chain/validation/executionPayloadBid.ts: most-fixed (7 issues). Treat as high-risk during review.

63 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass / Signature Verification: Multiple fixes show that gossip block validation and block import paths historically skipped or misapplied proposer signature verification, enabling unauthorized block acceptance and equivocation.

Consensus Integrity / Domain Derivation: Incorrect domain or fork-version derivation in signature sets repeatedly caused signature verification bypasses, allowing invalid blocks/updates to be accepted.

Denial of Service: Unbounded resource consumption via malformed deserialization, expensive state regen, decompression bombs, and oversized arrays was a recurring DoS vector across SSZ, API, gossip, and validation layers.