Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

safe-global/safe-transaction-service

              main @ 3e0199c
            

Fixes

CVEs

HIGH

Peak severity

36.4%

Coverage

Highlights

Signature Validation Bypass: 5 prior fixes. Scrutinize any change in this area.

safe_transaction_service/history/serializers.py: most-fixed (3 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Validation Byp: Multiple fixes address incorrect EIP-712 preimage and validation logic, allowing unauthorized delegates or invalid multisig confirmations.

Signature Validation Bypass: Contract signature validation for Safe messages was bypassed due to incorrect preimage hash and missing owner checks.

Auth Bypass: Authorization bypasses were closed by enforcing banned Safe checks and replacing insecure SSO with verified OIDC JWT validation.