Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

near/intents

              main @ 6cfce73
            

Fixes

CVEs

CRITICAL

Peak severity

46.2%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

borsh-utils: most-fixed (1 issue). Treat as high-risk during review.

11 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Access-key management operations (add_full_access_key and delete_key) lacked the 1 yoctoNEAR deposit assertion (assert_one_yocto), allowing unauthorized users to make state-changing administrative calls.

Financial Logic Error: Refund calculations on token notification failures were not properly capped by the original deposited amounts, presenting a risk of system fund exhaustion.

Double Deposit / Logic Error: Failing to restrict total supplies to 1 when depositing non-fungible tokens allowed duplicate deposits of unique NEP-171 assets.