Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
babylonlabs-io/finality-provider
main @ 4c55d4b
10
Fixes
0
CVEs
HIGH
Peak severity
22.2%
Coverage
Highlights
Denial of Service: 4 prior fixes. Scrutinize any change in this area.
eotsmanager: most-fixed (3 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Issues: EOTS signature requests containing duplicate block heights can allow an attacker to reconstruct and extract the underlying EOTS private key. Strong duplicate validation during batch operations is critical.
Cryptographic Slashing Protection Bypass: Lack of a signing record store allows double-signing at the same block height, presenting a critical risk of validator slashing. Checks must verify heights and message hashes globally before signing.
Auth Bypass: Using suffix/prefix matching for checking excluded RPC paths allows unauthorized callers to bypass HMAC security mechanisms and execute privileged actions.