Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

across-protocol/contracts

              master @ 19e346a
            

Fixes

CVEs

HIGH

Peak severity

18.2%

Coverage

Highlights

Access Control: 5 prior fixes. Scrutinize any change in this area.

programs/svm-spoke/src/instructions/fill.rs: most-fixed (3 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authorization Bypass: Multiple high-severity authorization bypasses in the fill instruction, including incorrect exclusivity deadline checks and missing fill-deadline validation, allowing unauthorized fills or early closure of fill PDAs.

Access Control: Insufficient access control in _requireAdminSender allowed unauthorized admin actions; fixed by requiring msg.sender to be the Linea message service.

Access Control Bypass: Swap execution in periphery allowed frontrunning and approval abuse; fixed by isolating swap in a proxy and restricting exchange address.