Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

smartcontractkit/chainlink-aptos

              develop @ 24c1cd3
            

Fixes

CVEs

CRITICAL

Peak severity

12.5%

Coverage

Highlights

Access Control: 9 prior fixes. Scrutinize any change in this area.

contracts/ccip/ccip/sources/auth.move: most-fixed (5 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Unauthenticated direct calls to ccip_send bypassed router-level access control, allowing unauthorized cross-chain message submission.

Access Control: Multiple fixes address incorrect argument ordering, missing self-registration checks, and missing owner assertions in onramp/offramp allowlist management, indicating a fragile authorization layer.

Integer Overflow: ABI decoding functions lacked range checks before casting u256 to smaller types, enabling integer truncation that could corrupt data.