Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
XOXNO/rs-lending-xlm
main @ 5961508
39
Fixes
0
CVEs
CRITICAL
Peak severity
36.7%
Coverage
Highlights
Auth Bypass: 7 prior fixes. Scrutinize any change in this area.
(contracts/controller/src/positions/liquidation/math.rs): most-fixed (3 issues). Treat as high-risk during review.
30 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes target the cancel()/cancel_operation logic, indicating a recurring struggle with authorization hierarchy, revocations, and veto scope. Attackers can bypass governance through colluding cancellers or proposer self-revocation.
Access Control: Strategy path invokes caller-chosen contracts and mints debt on disabled markets without proper checks. Two distinct fixes add required flags and listed-asset validation, showing a high-risk surface where unvalidated external calls can drain funds.
Economic Exploit / Integrity: Liquidation fee math was repeatedly flawed: fees on notional bonus, unclamped fee bases, and HF-ratchets create unprofitable closes and bad debt. These are high-value economic exploits.