Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ava-labs/icm-services
main @ 403e14f
64
Fixes
0
CVEs
HIGH
Peak severity
71.4%
Coverage
Highlights
Access Control: 16 prior fixes. Scrutinize any change in this area.
contracts/src/TeleporterTokenDestination.sol: most-fixed (6 issues). Treat as high-risk during review.
41 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes address missing sender/owner authorization in critical functions like initiateValidatorRegistration, completeValidatorRemoval, and sendMessage, allowing unauthorized state changes or message forgery.
Signature Verification Bypass: Signature schemes lacked binding to network/blockchain IDs or domain separation, enabling cross-chain replay and proof reuse. Fixes added domain separators, length fields, and explicit chain ID checks.
Access Control: Cross-chain token bridges lacked source contract/chain validation, allowing unauthorized token movements or message processing from unregistered bridges. Fixes added source blockchain ID and contract address checks.