Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

Strata-Markets/contracts

              tranches @ 6c6aeb3
            

Fixes

CVEs

CRITICAL

Peak severity

50.0%

Coverage

Highlights

Access Control: 2 prior fixes. Scrutinize any change in this area.

contracts/governance/AccessControlManager.sol: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Logical inversion errors in critical execution blocks can cause matching validation routines to exit early instead of reverting, allowing unauthorized or mismatched execution parameters to succeed. Developers must verify that parameter assertions trigger a hard revert on failure.

Access Control: Missing access modifiers on token transfer routines expose contracts to unauthorized fund withdrawals. Enforcing dedicated roles like COOLDOWN_WORKER_ROLE is crucial to lock down critical token movements.

Input Validation: Validating dynamic risk configurations against active, state-dependent variables instead of strict worst-case constants (such as 100% TVL scenario limits) can lead to invalid premium parameters being accepted during periods of low activity.