Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

informalsystems/hermes

              master @ 5e78a42
            

Fixes

CVEs

HIGH

Peak severity

41.7%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

relayer-cli/src/commands/tx/transfer.rs: most-fixed (2 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Counterparty channel ID was not set before proof verification, allowing channel opening without proper proof validation. This is a classic missing-state initialization bug in a handshake path.

Auth Bypass: Missing check that the channel's counterparty chain matches the destination chain enabled chain impersonation. This is a direct authorization gap in the core relaying link.

Auth Bypass: Two separate fixes (channel-open check and channel/connection/client path validation) were needed to prevent transfers to unintended chains. The transfer path is a high-value target for fund loss.