Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mellow-finance/mellow-lrt
main @ c37fad5
12
Fixes
0
CVEs
CRITICAL
Peak severity
42.9%
Coverage
Highlights
Access Control: 7 prior fixes. Scrutinize any change in this area.
src/Vault.sol: most-fixed (3 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control Bypass: Two critical fixes added permission checks (requirePermission/hasPermission) to validate, indicating this function was callable without authorization, enabling arbitrary external calls.
Access Control: Three fixes restructured proposer/acceptor/admin roles, showing repeated privilege-escalation vectors via role-management functions (propose, acceptProposal, setProposer, upgradeProposer, upgradeAcceptor).
Access Control Bypass: Validator received the full calldata including selector, allowing length/argument checks to be bypassed; a fix passed only the payload. Also removed nonReentrant from delegateCall, creating reentrancy risk.