Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

near/nearcore

              master @ acf0224
            

297

Fixes

CVEs

CRITICAL

Peak severity

32.0%

Coverage

Highlights

Denial of Service: 216 prior fixes. Scrutinize any change in this area.

runtime: most-fixed (18 issues). Treat as high-risk during review.

199 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Vulnerabilities in third-party runtime runtimes (such as Wasmtime and rkyv) have historically threatened the integrity of the host runtime sandbox via memory unsafety and validation bypasses during the execution of untrusted WebAssembly contracts.

Auth Bypass: Failure to properly validate block score heuristics and verify the cryptographic signature of optimistic blocks during fork choice selection can lead to arbitrary fork manipulation and consensus hijacks.

Denial of Service: WebAssembly contract compilation and execution paths are highly susceptible to resource exhaustion (CPU/Memory) if the runner fails to enforce strict limits on local variables, function quantities, operand stack sizes, or table elements.