Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rsksmart/rskj
master @ d987a4c
86
Fixes
0
CVEs
CRITICAL
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 51 prior fixes. Scrutinize any change in this area.
rskj-core: most-fixed (6 issues). Treat as high-risk during review.
52 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Critical entry points failed to validate caller addresses before executing state modifications, or checked state flags before checking authorization. Developers must ensure that all administrative and release interfaces in Bridge components validate the caller address first.
Denial of Service: The JSON-RPC interface was repeatedly vulnerable to memory and CPU exhaustion due to unbounded recursion and nested arrays that bypassed batch limits. Guarding RPC entry points requires enforcing strict request nesting depth and total element constraints before parsing.
Signature Verification Bypass: Using object identity instead of cryptographic hash values for caching signatures allowed potential signature bypasses and cache key confusion under concurrent execution.