Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

IPOR-Labs/ipor-protocol

              main @ 434327d
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

Access Control: 3 prior fixes. Scrutinize any change in this area.

contracts/amm/Milton.sol: most-fixed (4 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Liquidity pool balance manipulation was possible by any caller; now restricted to IporLiquidityPool via onlyLiquidityPool modifier. This is a classic missing-authorization bug on critical accounting functions.

Auth Bypass: Incorrect swap-state modifiers (onlyActiveSwapPayFixed/ReceiveFixed) allowed unauthorized closing of swaps. The fix removed these flawed checks, indicating state-machine validation must be carefully reviewed.

Access Control: Users could redeem tokens they never deposited; added per-user deposit tracking (userIporTokenVolumes) to enforce balance sufficiency. This is a broken-accounting access control issue.