Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mantlenetworkio/mantle

              main @ 5cda5f8
            

Fixes

CVEs

HIGH

Peak severity

64.3%

Coverage

Highlights

Access Control: 5 prior fixes. Scrutinize any change in this area.

packages/contracts/contracts/L1/tss/TssStakingSlashing.sol: most-fixed (2 issues). Treat as high-risk during review.

10 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple high-severity auth bypasses across the TSS subsystem: case-sensitive culprit comparison, missing election ID verification, and absent JWT authentication on RPC endpoints. These indicate systemic weakness in identity and request authentication.

Access Control: Multiple high-severity access control flaws in L1 contracts: unrestricted setClaimer, wrong staker slashed, missing pauseOwner, and incorrect challenge winner assignment. These affect core staking, rollup, and fraud-proof logic.

Authorization Bypass: Slashing could target addresses not in the unjailed list, allowing unauthorized slashing of valid stakers. This is a critical authorization gap in the slashing workflow.