Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
tronprotocol/tronweb
master @ b189154
7
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Transaction Substitution: 3 prior fixes. Scrutinize any change in this area.
src/lib/trx.ts: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Transaction Substitution: Multiple fixes pin different fields of the submitted transaction before validation, indicating an ongoing pattern of fullNode substitution attacks in multi-sign flows.
Transaction Substitution: Two fixes in trx.ts address transaction substitution via getSignWeight and txID consistency, showing the same attack vector persists across different code paths.
Transaction Validation: The multiSign flow adopted a returned transaction without verification, a critical gap that was fixed by adding txCheckWithArgs validation.