Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

m0-foundation/solana-m-extensions

              main @ c22b6b8
            

Fixes

CVEs

HIGH

Peak severity

16.7%

Coverage

Highlights

Access Control: 6 prior fixes. Scrutinize any change in this area.

programs/ext_swap/src/instructions/whitelist.rs: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Admin-only whitelist management instructions lacked an admin authorization check, allowing any signer to modify extension whitelists.

Auth Bypass: Token transfer CPI did not properly validate the signer, allowing unauthorized unwrap operations; fixed by delegating to token program.

Access Control: wrap and unwrap instructions lacked signer authorization, enabling unauthorized token wrapping/unwrapping; fixed by requiring signer in wrap_authorities.