Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lidofinance/aragon-apps
master @ e44f928
22
Fixes
0
CVEs
HIGH
Peak severity
85.0%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
apps/token-manager/contracts/TokenManager.sol: most-fixed (11 issues). Treat as high-risk during review.
20 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes show token operations (mint, burn, assign, issue, forward) were reachable without proper per-parameter authorization or with the token address itself executable via forwarded scripts.
Access Control Bypass: ACL oracle trusted attacker-controlled _how[0] and an attacker-controlled parameter in hasPermission, allowing spoofed signer status or challenge authorization bypass.
Integer Overflow: Raw arithmetic on balances, owed salary, and transaction indices could overflow/underflow, leading to unauthorized token issuance or incorrect payouts.