Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mystenlabs/deepbookv3

              main @ ed1c054
            

Fixes

CVEs

HIGH

Peak severity

37.5%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

packages/margin_trading/sources/margin_manager.move: most-fixed (3 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers could historically mint custom owner capabilities or bypass application authorization check boundaries. Secure application patterns must utilize verified Registry witness parameters to ensure callers cannot spoof custom app identities.

Auth Bypass: Critical trading operations like repayment and balance management lacked rigid ownership and visibility constraints. Attackers could interact with unauthorized margin managers, which was solved by enforcing package-only visibility and validating owner checks on repay paths.

SQL Injection: Dynamic SQL execution via diesel::sql_query allowed potential arbitrary database compromise via order queries, corrected through parameterized query bindings.