Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
WalletConnect/walletconnect-monorepo
v2.0 @ e0a7174
41
Fixes
0
CVEs
HIGH
Peak severity
73.5%
Coverage
Highlights
Auth Bypass: 24 prior fixes. Scrutinize any change in this area.
packages/sign-client/src/controllers/engine.ts: most-fixed (14 issues). Treat as high-risk during review.
27 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Dominant vulnerability class with 24 fixes, many in the sign-client engine. Recurring failures include not awaiting async validators, missing signature verification, and insufficient namespace/chain permission checks.
Auth Bypass: Multiple fixes address authorization bypasses in session proposal, respond, update, and notification flows, including inverted equality checks and missing chain validation.
Auth Bypass: JWT attestation verification had multiple bypasses: missing signature result checks, missing identifier validation, and fallback to insecure paths.