Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
lombard-finance/sol-svm-contracts
main @ 09d5e76
15
Fixes
0
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
programs/bridge/src/instructions/deposit.rs: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass / Authentication Bypass: Multiple fixes removed or replaced a shared messaging_authority account, indicating a systemic weakness in how cross-component message senders are authenticated. The GMP receive path also lacked a recipient check, allowing unauthorized message processing. This is the most frequently patched class.
Auth Bypass: The SetAuthority CPI used the program's token_authority as current_authority, allowing an attacker to change mint/freeze authority to an arbitrary account. This is the highest severity fix and a direct authorization bypass on a core token control function.
Business Logic / Authorization Bypass: Missing finalized flag check allowed posting metadata after payload creation, enabling unauthorized modification of validator set metadata. This is a state-machine authorization bypass.