Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

stacks-network/sbtc

              main @ 18caa9d
            

Fixes

CVEs

CRITICAL

Peak severity

29.2%

Coverage

Highlights

Auth Bypass: 9 prior fixes. Scrutinize any change in this area.

signer/src/stacks/contracts.rs: most-fixed (5 issues). Treat as high-risk during review.

23 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple authorization checks were missing or placeholder-based across signer and contract code, allowing unauthorized operations such as processing malicious contracts, initiating signing rounds, or bypassing fee validation.

Business Logic Bypass: Deposit and withdrawal lifecycle state checks were missing, enabling duplicate sBTC minting, premature withdrawal rejection, and incorrect state changes for already-completed requests.

Verification Bypass: DKG share verification was incomplete or bypassable, allowing signing with unverified or failed shares and enabling unauthorized transaction signing or key rotation.