Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
OpenZeppelin/openzeppelin-confidential-contracts
master @ 197d3cd
20
Fixes
0
CVEs
HIGH
Peak severity
52.9%
Coverage
Highlights
Access Control: 10 prior fixes. Scrutinize any change in this area.
contracts/token/ERC7984/extensions/ERC7984Rwa.sol: most-fixed (4 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: Multiple fixes address missing operator and isAllowed checks on confidential transfer functions, plus a wrong allow target in _update, indicating systemic authorization gaps on core transfer paths.
Auth Bypass: Fixes to unblockUser and allowance grants after mint/burn/forceUpdate show that authorization can be bypassed via state transitions, risking privilege escalation or unauthorized use of encrypted amounts.
Access Control: Removal of _forceUpdate to enforce restriction/pause checks, plus a fix that bypassed recipient restriction for force transfers, indicates a high-risk force-transfer path that repeatedly evaded access controls.