Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Veda-Labs/boring-vault
main @ a3fc204
27
Fixes
0
CVEs
CRITICAL
Peak severity
44.4%
Coverage
Highlights
Access Control Bypass: 13 prior fixes. Scrutinize any change in this area.
src/base/Roles/TellerWithMultiAssetSupport.sol: most-fixed (5 issues). Treat as high-risk during review.
22 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control Bypass: Multiple critical fixes show that merkle proof verification was incomplete, allowing managers to bypass argument validation by omitting decoder/sanitizer addresses or failing to verify addresses in the proof. This is a core authorization primitive for vault management.
Access Control Bypass: Multiple fixes target missing checks in bulk deposit/withdraw and transfer paths: missing isSupported checks, missing pause checks, and an operator allowlist bypass. These are high-traffic user-facing functions where incomplete validation can lead to unauthorized asset movement.
Access Control Bypass: Multiple protocol-specific sanitizers (BoringSwapper, ITB, Odos, Pendle, EigenLayer, UniswapV3, OneInchOwned) had gaps allowing unauthorized token movements or bypassing validation, often by not binding the decoder/sanitizer address to the leaf or missing checks on nested parameters.