Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

shardeum/archive-server

              dev @ 3011bac
            

Fixes

CVEs

CRITICAL

Peak severity

65.5%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

src/Data/Collector.ts: most-fixed (11 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address bypass of receipt verification via incorrect signature checks, missing txId validation, and a removed skip flag. These are the highest-impact issues as they allow acceptance of unauthorized transactions.

Signature Verification Bypass: Signature verification was bypassed by omitting voteTime or transaction ID from the signed hash, allowing forgery. The fix in ticketVerification also changed signing to payload directly.

Authentication Bypass: Inverted signature verification result and incorrect majority vote calculations allowed acceptance of invalid receipts. These logic errors are subtle and high-risk.