Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
wormhole-foundation/native-token-transfers
main @ 250d810
16
Fixes
0
CVEs
HIGH
Peak severity
42.9%
Coverage
Highlights
Access Control: 5 prior fixes. Scrutinize any change in this area.
.github/workflows/claude.yml: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: Multiple admin and state-changing instructions lacked owner or authority checks, allowing unauthorized modification of critical parameters like lookup tables, rate limits, and upgrade authorities.
Logic Error: Transfer logic failed to verify post-transfer amounts, allowing fee-on-transfer tokens to create accounting discrepancies and potentially unauthorized token issuance.
Logic Error: Redeem could overwrite release status of already-released transfers, enabling unauthorized token release; also lacked threshold validation.