Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Layr-Labs/eigenda

              master @ bfa451e
            

Fixes

CVEs

HIGH

Peak severity

42.1%

Coverage

Highlights

Denial of Service: 8 prior fixes. Scrutinize any change in this area.

contracts/src/integrations/cert/libraries/EigenDACertVerificationLib.sol: most-fixed (2 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Certificate verification was repeatedly bypassed: V2 certs accepted without verification, invalid offchainDerivationVersion allowed, and unauthenticated DA operations exposed. These fixes span contract, proxy, and client layers, indicating the checkDACert path is a persistent weak point.

Denial of Service: Certificate verification is DoS-prone: unbounded ABI decoding causes gas exhaustion, missing timeout allows indefinite hangs, and out-of-bounds panics from unchecked quorum lengths. These are distinct failure modes on the same verification path.

Replay Attack: Signed requests across disperser, node, and relay clients lacked timestamp protection, enabling replay of captured authenticated requests. The fix adds timestamps to signatures and server-side stale rejection, but this pattern must be consistently applied to all signed RPCs.