Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

fiatjaf/lntxbot

              master @ e9f9a1f
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Business Logic Flaw: 2 prior fixes. Scrutinize any change in this area.

handle_callback.go: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Business Logic Flaw: Manual recheck of pending payments could mark indeterminate results as failed, enabling fund leakage in eclair.

Business Logic Flaw: Coinflip fee exploit: balance check omitted fee and sender check ran after transaction, allowing negative balances.

Authentication Bypass: Random challenge was predictable, enabling unauthorized withdrawals via LNURL.