Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

status-im/nimbus-eth2

              stable @ 404a000
            

Fixes

CVEs

CRITICAL

Peak severity

42.4%

Coverage

Highlights

Auth Bypass: 18 prior fixes. Scrutinize any change in this area.

beacon_chain/gossip_processing/gossip_validation.nim: most-fixed (10 issues). Treat as high-risk during review.

58 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Verification Bypass: Multiple fixes address incorrect fork domain/version usage or missing signature checks, allowing forged messages to pass. This is the most common critical flaw.

Auth Bypass: Proposer/builder authorization and API token checks were bypassed due to incorrect index validation, missing active checks, or weak comparison.

Denial of Service: Unbounded resource consumption via oversized network messages, orphan pools, and missing size limits can crash or stall the node.