Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

consensys/teku

              master @ 9e51aa5
            

101

Fixes

CVEs

CRITICAL

Peak severity

38.9%

Coverage

Highlights

Denial of Service: 26 prior fixes. Scrutinize any change in this area.

-: most-fixed (4 issues). Treat as high-risk during review.

60 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Verification Bypass: Multiple fixes address using the wrong fork/epoch for signature domain computation, allowing invalid signatures to pass. This is a systemic issue across voluntary exits, sync committee messages, and attestations.

Denial of Service: The largest class (26 fixes) spans resource exhaustion from unvalidated peer data, unbounded requests, stack overflows, and missing timeouts. Many fixes add limits or reject malformed inputs early.

Validation Bypass: Multiple fixes add missing ancestry/finality checks for attestations and blocks, preventing acceptance of data from invalid chains. These are consensus-critical and were repeatedly patched.