Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rooch-network/rooch

              main @ bd35b33
            

Fixes

CVEs

HIGH

Peak severity

25.0%

Coverage

Highlights

Denial of Service: 25 prior fixes. Scrutinize any change in this area.

crates/rooch-executor/src/actor/executor.rs: most-fixed (8 issues). Treat as high-risk during review.

44 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: L1 transactions could be executed or replayed without proper validation. The fix introduced strict state validation checks via Move smart contracts prior to transaction execution.

Auth Bypass: Expired or non-existent session keys were incorrectly treated as active or unexpired, allowing unauthorized operations due to inverted option checks and missing timestamp constraints.

Denial of Service: Underpriced or free gas functions and static gas cost schedules allowed resource exhaustion. The fix transitioned validators to dynamic, on-chain gas parameters and disabled free execution paths.