Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
anza-xyz/kit
main @ 34053c5
12
Fixes
0
CVEs
HIGH
Peak severity
55.6%
Coverage
Highlights
Auth Bypass: 4 prior fixes. Scrutinize any change in this area.
src/stake-program.js: most-fixed (2 issues). Treat as high-risk during review.
7 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Stake authorization instructions (such as AuthorizeWithSeed) were constructed without including the required Clock sysvar public key. This caused critical staking transactions to fail or execute under incorrect runtime assumptions.
Auth Bypass: Transactions could be serialized without valid signatures. Enforcing signature presence and verification during serialization is required to prevent downstream execution of unauthorized payloads.
Denial of Service: Deserializing truncated or malicious network messages without bounds checks allowed index out-of-range operations, leading to process crashes via shift and splice operations.