Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
OpenZeppelin/stellar-contracts
main @ 035da1a
33
Fixes
0
CVEs
CRITICAL
Peak severity
19.0%
Coverage
Highlights
Auth Bypass: 17 prior fixes. Scrutinize any change in this area.
packages/tokens/src/rwa/storage.rs: most-fixed (5 issues). Treat as high-risk during review.
27 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical rule-selection downgrade attack allowed unauthorized rule changes after signature collection; related signer duplication and last-signer removal bypasses compound the risk in the account's core authorization engine.
Auth Bypass: Multiple high-severity bypasses in RWA token transfers: missing compliance checks in transfer_from, missing recipient verification in forced_transfer, and freeze bypass during recovery—all allowing unauthorized token movement.
Authorization Bypass: All vault operations (deposit/mint/withdraw/redeem) lacked operator authorization, a fundamental access control failure on asset custody functions.