Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cosmos/ledger-cosmos

              main @ 351d43d
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Buffer Overflow: 7 prior fixes. Scrutinize any change in this area.

app/src/tx_display.c: most-fixed (6 issues). Treat as high-risk during review.

22 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Bypass / Unauthorized Signing: Closed-world allowlists were added to reject unknown SignDoc/StdFee keys, preventing signing of hidden data. A bypass here directly enables unauthorized signing of attacker-controlled fields.

Buffer Overflow: Multiple overflows in hex-escape and translation buffers were fixed with bounds checks and strlcpy. These are classic memory-corruption vectors in display code.

Signature Bypass: Displayed amounts or review screens could differ from what was actually signed (scalar amounts shown as 'Empty', oversized text transactions partially reviewed). This undermines user trust in the signing prompt.