Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lifinance/contracts
main @ 0fd909d
74
Fixes
0
CVEs
CRITICAL
Peak severity
41.0%
Coverage
Highlights
Access Control: 12 prior fixes. Scrutinize any change in this area.
script/deploy/safe/execute-pending-timelock-tx.ts: most-fixed (3 issues). Treat as high-risk during review.
49 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: Multiple facets and periphery contracts had missing or overly permissive access controls, allowing unauthorized configuration changes, arbitrary contract calls, or fund withdrawal.
Input Validation: Bridge functions frequently accepted arbitrary destination chain IDs, receivers, or refund addresses without validation, enabling fund misrouting or theft.
Command Injection: Untrusted GitHub context (PR titles, commit messages, actor names) and environment variables were interpolated into shell commands, allowing arbitrary code execution in CI.