Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cowprotocol/services
main @ 5766db4
41
Fixes
0
CVEs
HIGH
Peak severity
54.8%
Coverage
Highlights
Denial of Service: 23 prior fixes. Scrutinize any change in this area.
crates/shared/src/order_validation.rs: most-fixed (3 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Custom settlement interactions executed directly within the privileged context of the settlement contract allowed unauthorized privilege escalation and asset theft. The fix introduced trampolining of these operations through MultiSendCallOnly to guarantee sandboxing.
Denial of Service: Unbounded cache structures using standard HashMaps allowed unchecked memory consumption and eventual out-of-memory crashes under load. Replacing them with bounded LRU caches (using the moka crate) is critical to protect service availability.
Auth Bypass: Discrepancies in ECDSA signature 'v' parameter normalization between off-chain services and the Solidity ecrecover precompile permitted valid signatures to be rejected or bypassed. Forcing normalization to 27/28 prevents signature validation mismatches.