Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

buildonspark/spark

              main @ 0b3a32a
            

182

Fixes

CVEs

CRITICAL

Peak severity

51.5%

Coverage

Highlights

Auth Bypass: 46 prior fixes. Scrutinize any change in this area.

spark/so/handler/base_transfer_handler.go: most-fixed (20 issues). Treat as high-risk during review.

130 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authorization/Auth Bypass: Recurring missing session identity checks, allowlist gaps, and authorization gates on RPCs and state transitions; often enables unauthorized fund movement or data disclosure.

Transaction Validation Bypass: Client-supplied refund/withdrawal transactions signed via FROST without full canonical reconstruction, allowing fund redirection or theft.

Consensus Decision Binding Bypass: Consensus decisions not bound to prepared operations, allowing forged commits, cross-resource attacks, or state divergence.