Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

valory-xyz/open-autonomy

              main @ efd8c30
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 39 prior fixes. Scrutinize any change in this area.

packages/valory/skills/abstract_round_abci/base.py: most-fixed (11 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The system recovered public keys from signatures without verifying that the recovered key matched the declared sender address, allowing attackers to forge valid signatures.

Denial of Service: A boot-time race condition allowed requests to access uninitialized round sequence state, resulting in uncaught exceptions that crash the Tendermint handler.

Auth Bypass: A logical flaw in the transaction type comparison expression allowed unvalidated transactions to bypass check_transaction constraints.