Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nervosnetwork/ckb
develop @ 3d33b44
126
Fixes
3
CVEs
CRITICAL
Peak severity
60.0%
Coverage
Highlights
Denial of Service: 91 prior fixes. Scrutinize any change in this area.
script: most-fixed (22 issues). Treat as high-risk during review.
103 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Virtual machine execution via script verification is highly susceptible to resource exhaustion and thread blocking. Attackers could bypass execution cycle limits, trigger infinite execution loops, or cause VM-spawned child processes to ignore execution pauses. Robust cycle tracking, nested VM boundary checks, and proper mapping of CyclesExceeded are critical.
Auth Bypass: Consensus-level validation is prone to bypasses near hardfork epoch transitions. Under certain conditions, VM Version 2 script execution was enabled prematurely during the block proposal window before the activation epoch, potentially causing consensus splits and double-spends.
Auth Bypass: A critical proof-of-work difficulty comparison logic flaw inverted mathematical relations, enabling invalid block headers to bypass cryptographic difficulty verification checks entirely.