Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

amazingang/wtf-solidity

              main @ 9ba342c
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Access Control: 1 prior fix. Scrutinize any change in this area.

DutchAuction: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Reentrancy: State updates occurred after external calls/mints, allowing reentrant execution to mint tokens beyond intended limits. Standardizing on the Checks-Effects-Interactions pattern is critical across all minting entry points.

Auth Bypass: Insufficient ownership and price validations allowed unauthorized execution of asset transfers via safeTransferFrom, threatening contract-held NFTs.

Access Control: Improper delegation execution where input data was not correctly loaded into memory prior to delegatecall can lead to corrupted execution state or hijacking of proxy logic.