Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

berachain/polaris

              main @ 7cc5054
            

Fixes

CVEs

CRITICAL

Peak severity

57.1%

Coverage

Highlights

Denial of Service: 5 prior fixes. Scrutinize any change in this area.

cosmos/lib/conversions.go: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure caller verification within the Bank precompile can allow unauthorized actors to perform transfers and drain user funds. This represents a direct threat to ledger integrity and asset security.

Access Control: A lack of strict read-only guarantees on specific call paths allowed read-only EVM calls to execute state modifications through precompiles, bypassing standard transaction safety limits.

Denial of Service: Mismatches between EVM execution gas and the Cosmos SDK GasMeter can lead to state divergence or allow gas bypass attacks. Ensuring perfect alignment between both execution engines is paramount.