Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
compound-finance/comet
main @ f766f51
5
Fixes
0
CVEs
HIGH
Peak severity
40.0%
Coverage
Highlights
Integer Overflow: 2 prior fixes. Scrutinize any change in this area.
contracts/Comet.sol: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Integer Overflow: Math-rounding logic during supply or withdrawal of zero base tokens can trigger overflows, risking contract freeze or incorrect balance state tracking. Developers must enforce strict validation against zero-value operations.
Integer Overflow: Truncation and casting of price variables from signed integers to smaller unsigned integer representations can cause overflows. Standardizing internal present value representations to 256 bits is necessary to mitigate this risk.
Auth Bypass: Implicit self-allowance to the governor during initialization bypasses intended privilege separation. Explicit, granular access manager controls are required to prevent unauthorized contract control on deployment.