Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

aave/protocol-v2

              master @ ce53c4a
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Access Control: 9 prior fixes. Scrutinize any change in this area.

contracts/libraries/logic/ValidationLogic.sol: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple fixes in this component address missing or incorrect validation logic, leading to bypass of protocol restrictions (e.g., frozen reserves, inactive reserves) and incorrect health factor calculations. This is the most frequently patched component, indicating a high risk of regression or variant bugs.

Access Control: Two identical fixes (97b014a and b4f8592) corrected the same bug in balanceDecreaseAllowed where the wrong balance parameter was used, allowing users to withdraw more than safely permitted. This indicates a persistent logic error in health-factor checks that could be reintroduced.

Auth Bypass: finalizeTransfer lacked health factor validation, enabling users to transfer collateral in a way that bypasses liquidation mechanisms. This is a critical flaw in the core lending pool transfer path, directly impacting protocol solvency.