Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lidofinance/core

              master @ 2da0f48
            

Fixes

CVEs

CRITICAL

Peak severity

57.9%

Coverage

Highlights

Access Control: 36 prior fixes. Scrutinize any change in this area.

contracts/0.8.9/DepositSecurityModule.sol: most-fixed (9 issues). Treat as high-risk during review.

60 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple fixes add missing role checks or ownership checks on privileged functions (deposit, exit, tier change, hub detach), indicating systemic gaps in authorization enforcement across vault operations.

Auth Bypass: canDeposit() repeatedly returned true for unregistered or paused modules, and deposit() lacked pause/status checks, allowing unauthorized deposits. Multiple fixes were needed to close the same gate.

Signature Bypass / Replay: Critical signature bypasses: incorrect zero-signature root in predeposit, missing block context in signed messages, and missing contract address in EIP712 domain allowed replay and unauthorized deposits.