Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

smartcontractkit/chainlink-evm

              develop @ 05ecd89
            

100

Fixes

CVEs

CRITICAL

Peak severity

81.6%

Coverage

Highlights

Auth Bypass: 29 prior fixes. Scrutinize any change in this area.

contracts/src/v0.8/dev/ArbitrumValidator.sol: most-fixed (5 issues). Treat as high-risk during review.

77 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: All GQL resolvers were previously unauthenticated, allowing unauthorized access to sensitive data and operations. This is a broad, high-impact gap.

Signature Verification Bypass: Signature verification was skipped for all paths, allowing unauthorized transactions. This is a critical flaw in a core registry.

Auth Bypass: Credential verification result was not checked, allowing unauthorized access to job run endpoints.