Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

NexusMutual/smart-contracts

              release-candidate @ 9e88562
            

Fixes

CVEs

CRITICAL

Peak severity

47.4%

Coverage

Highlights

Access Control: 25 prior fixes. Scrutinize any change in this area.

contracts/modules/token/TokenController.sol: most-fixed (12 issues). Treat as high-risk during review.

59 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authorization Bypass / Access Control: Critical flaw allowed withdrawing any user's funds via caller-supplied member address; multiple other fixes restrict minting/burning to authorized callers.

Signature Replay / Verification: Multiple fixes address signature malleability, missing deadline/buyer binding, and hash collisions in cover and limit-order flows.

Access Control: Vote-weight miscalculations and missing role/seat checks enabled governance manipulation and privilege escalation.