Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
pyth-network/pyth-crosschain
main @ c63abe1
102
Fixes
0
CVEs
CRITICAL
Peak severity
63.3%
Coverage
Highlights
Auth Bypass: 42 prior fixes. Scrutinize any change in this area.
terra/contracts/token-bridge/src/contract.rs: most-fixed (11 issues). Treat as high-risk during review.
85 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Duplicate signature index validation was missing during VAA verification, allowing a single guardian signature to be re-used to bypass quorum checks. Fixes enforced strict ascending order of signature indices to prevent signature reuse attacks.
Auth Bypass: Sui contracts lacked robust signature and sequence-number-based replay protection for governance actions, requiring a temporary shutdown of governance rotation to prevent unauthorized state manipulation.
Replay Attack: The Terra token bridge allowed governance actions and message metadata updates to be processed multiple times due to a lack of proper validation against the VAA archive state prior to payload execution.