Security context

Highlights

Denial of Service: 126 prior fixes. Scrutinize any change in this area.

consensus: most-fixed (21 issues). Treat as high-risk during review.

202 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Auth Bypass: The Groth16 Zero-Knowledge ID (zkID) and keyless validation pipelines contained critical implementation flaws, including failure to consistently verify public input hashes, missing signature expiration checks, and omitting validation of the Groth16 Verifying Key against the on-chain configuration, potentially enabling full authentication bypasses.

Denial of Service: Recursive parsing and formatting operations during Move VM execution (such as nested Struct drops, Value Display formatting, type building, and SignatureToken deserialization) are highly susceptible to stack exhaustion and memory exhaustion crashes. The project has had to repeatedly enforce maximum recursion/nesting depth limits and replace recursive logic with heap-allocated iterative loops.

Auth Bypass: Consensus message validation flaws (such as missing block/payload epoch consistency validations, unverified inline transaction batch ciphertexts, and decoupled dummy QC verification) historically allowed cross-epoch replay attacks and execution state spoofing.