Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
hiero-ledger/hiero-sdk-js
main @ 05d8e49
14
Fixes
0
CVEs
HIGH
Peak severity
46.2%
Coverage
Highlights
Cryptographic Key Derivation: 2 prior fixes. Scrutinize any change in this area.
packages/cryptography/src/Mnemonic.js: most-fixed (2 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Key Mismatch: Multiple fixes address key byte format confusion (DER vs raw, leading zeroes) causing public key mismatches and signature protobuf encoding errors. This is a systemic issue across key serialization and protobuf conversion.
Signature Verification Bypass: Two distinct verification paths were fixed: one falling back to ECDSA when ed25519 is null, another using the wrong transaction list for signature map construction. Both could allow invalid signatures to pass.
Cryptographic Key Derivation: Two commits fix the same mnemonic-to-ECDSA key derivation path, indicating repeated issues with derivation path handling and zero-padded hex encoding. This is a critical key-generation surface.