Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

loopring/protocols

              master @ 425d152
            

121

Fixes

CVEs

CRITICAL

Peak severity

32.4%

Coverage

Highlights

Auth Bypass: 52 prior fixes. Scrutinize any change in this area.

contracts/LoopringProtocolImpl.sol: most-fixed (10 issues). Treat as high-risk during review.

91 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes target signature verification bypasses: null-address signers, legacy bytes-based ERC1271, magic-value confusion, and missing require on verifySignatures return. These are systemic across wallet and vault components.

Auth Bypass: Meta-transaction handling repeatedly allowed unauthorized operations: missing signer-owner checks, weak payload binding, and nonce/hash replay. Fixes enforce explicit signer lists, txAwareHash restrictions, and EIP-712 binding.

Auth Bypass: Wallet module authorization was bypassed via checking registered instead of enabled modules, missing guardian-count validation, and allowing owner as guardian. Fixes enforce module-enabled checks, sufficient-guardian requirements, and guardian-owner separation.