Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gmsol-labs/gmx-solana

              main @ 50c4d8d
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 15 prior fixes. Scrutinize any change in this area.

programs/data_store/src/instructions/exchange/execute_deposit.rs: most-fixed (4 issues). Treat as high-risk during review.

34 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A mismatched role key in the authentication check allowed unauthorized access to privileged operations; this is the most severe fix and indicates a systemic risk in role-based access control.

Auth Bypass: Missing signer restriction in instruction buffer creation allowed unauthorized signers to be used, enabling arbitrary privileged actions through the timelock.

Auth Bypass: Incorrect signer marking in instruction conversion could spoof the executor wallet, allowing unauthorized execution of timelocked instructions.