Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

smartcontractkit/chainlink-sui

              develop @ 6fc5cde
            

Fixes

CVEs

HIGH

Peak severity

44.4%

Coverage

Highlights

Access Control: 6 prior fixes. Scrutinize any change in this area.

contracts/ccip/ccip/sources/token_admin_registry.move: most-fixed (4 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Multiple fixes show recurring failures in enforcing administrator authorization and object lifecycle invariants (uniqueness, existence) in token pool registration and destruction.

Privilege Escalation: Malicious receivers could mutate transmitter-owned objects in PTB inputs due to missing ownership validation before encoding call arguments.

Privilege Escalation: Bypass action allowed execution of timelock-admin functions (update_min_delay, block_function, set_config) without proper allowlist, enabling privilege escalation.