Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
symbioticfi/relay
main @ b76680c
17
Fixes
0
CVEs
CRITICAL
Peak severity
46.7%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
internal/uc/aggregator/aggregator.go: most-fixed (2 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes address the same root cause: using all validators instead of only active ones in membership, scheduling, and aggregation. This allows inactive validators to participate in consensus and proof generation, bypassing authorization controls.
Verification Bypass: Flaws in BLS signature verification logic, including G2 coordinate order, proof length, sorting, validator matching, and public key parsing, allow attackers to forge signatures or bypass verification. These are critical because they undermine the core cryptographic trust.
Signature Verification Bypass: Quorum signature verification was flawed by using hardcoded quorum thresholds, hardcoded epochs, and state-changing transactions. These issues allow forgery of quorum signatures and unauthorized on-chain modifications.