Security context

Highlights

Auth Bypass: 62 prior fixes. Scrutinize any change in this area.

src/commands.cpp: most-fixed (52 issues). Treat as high-risk during review.

100 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Cryptography: The SDK was historically vulnerable to a critical cryptographic decryption oracle attack (originally discovered by ETH Zurich) where corrupted or maliciously constructed RSA private key parameters could act as an API-exploitable oracle, leaking the private key over multiple login sessions. Proper validation of private key parameters must be checked during initialization.

Auth Bypass: Key validation and authentication-ring state verification suffered from critical logic bypasses. The client accepted untrusted keys or promoted pending shares without enforcing strict signature verification on Cu25519 and Ed25519 public keys, or failed to invalidate cached keys, creating authentication bypass paths.

Use After Free: Memory management errors frequently manifested as Use-After-Free (UAF) issues when processing asynchronous callbacks, network transfers, or node manipulations where raw pointers were held after the target object was destroyed or mutated. Transitioning to smart pointers and zeroing out invalid cross-reference pointers is required.