Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ethereum-optimism/infra

              main @ 9a57fa3
            

Fixes

CVEs

CRITICAL

Peak severity

42.3%

Coverage

Highlights

Denial of Service: 9 prior fixes. Scrutinize any change in this area.

proxyd/server.go: most-fixed (7 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes re-enable or correct authentication checks that were disabled or misapplied, allowing unauthorized transactions or requests.

Auth Bypass: Interop validation can be bypassed via bundle submissions, fail-open defaults, or client-disconnect cancellation; fixes enforce fail-closed behavior and unified filters.

Denial of Service: Unbounded sizes (access list, request params, rate-limit keys) and concurrent websocket writes can cause resource exhaustion or process crashes.