Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

parallel-protocol/parallel-parallelizer

              main @ 28e1933
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Authorization Bypass: 2 prior fixes. Scrutinize any change in this area.

contracts/parallelizer/facets/Redeemer.sol: most-fixed (3 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authorization Bypass: Two distinct bypasses were fixed: one allowing silent no-op transfers (balance delta check) and one binding forfeitTokens to the EIP-3009 nonce. These show the authorization flow is complex and has been exploited in multiple ways, making it the top recurring risk.

Front-Running: Both the savings and parallelizer paths had front-running fixes: binding the receiver in Savings signatures and binding the full swap/redeem intent to the nonce. This shows a systemic gap in EIP-3009 signature binding across multiple components.

Fee Bypass: The normalizedStables==0 guard prevents a fee bypass, and a related rounding fix in getters/stablecoinsIssued shows the underlying accounting can be manipulated. This is a critical economic invariant that has been attacked twice.