Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
balancer/balancer-v2-monorepo
master @ f8b6f44
43
Fixes
0
CVEs
HIGH
Peak severity
43.6%
Coverage
Highlights
Auth Bypass: 18 prior fixes. Scrutinize any change in this area.
pkg/vault/contracts/authorizer/TimelockAuthorizer.sol: most-fixed (4 issues). Treat as high-risk during review.
33 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The TimelockAuthorizer and associated administrative functions historically suffered from authorization bypasses where administrative privileges (such as managing granters and revokers or scheduling delay changes) were not strictly restricted to the root account. This allowed unauthorized accounts to potentially delegate or escalate privileges.
Reentrancy: Read-only and callback-based reentrancy across several pool implementations and the Vault allowed rate manipulation and unauthorized state execution. During callbacks or balance updates, missing reentrancy guards permitted external code execution before internal state synchronizations were finalized.
Access Control: Critical external-facing methods (such as those managing pool configuration and balance updates in the Vault) lacked appropriate modifier constraints, exposing privileged functions to arbitrary external callers.