Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

gnosis/gp-v2-contracts

              main @ 16e23ec
            

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Signature Verification Bypass: 2 prior fixes. Scrutinize any change in this area.

src/contracts/GPv2Settlement.sol: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Verification Bypass: Unified signing to EIP-712 hash; prior inconsistent schemes allowed bypasses.

Signature Verification Bypass: Added EIP-1271 contract signature support; missing this path previously allowed bypass.

Unauthorized Fund Extraction: Single-trade settlement allowed direct transfers; removed to stop fund extraction.