Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

lombard-finance/evm-smart-contracts

              main @ 7fe83e5
            

Fixes

CVEs

HIGH

Peak severity

51.5%

Coverage

Highlights

Access Control: 16 prior fixes. Scrutinize any change in this area.

contracts/LBTC/LBTC.sol: most-fixed (4 issues). Treat as high-risk during review.

27 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple fixes across LBTC components address missing or overly-broad role checks on critical functions like mint, setMinterLimit, and migration, indicating a systemic risk of unauthorized token creation or privilege escalation.

Signature Bypass: Multiple signature verification flaws in the consortium contracts allowed empty/malformed signatures to pass, and missing player/duplicate checks could permit unauthorized approvals or multisig bypass.

Access Control Bypass: Truncated calldata and non-canonical rule encoding could bypass Merkle allowlist constraints, allowing unauthorized operations. The fixes require full 32-byte words and canonical decimal validation.