Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

bnb-chain/bsc-genesis-contract

              master @ 041881a
            

Fixes

CVEs

HIGH

Peak severity

46.2%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

contracts/BSCValidatorSet.sol: most-fixed (5 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Cross-chain callback response and acknowledgment handlers can be invoked without proper authorization if access-control modifiers are missing or bypassed. This allows attackers to forge system messages and manipulate validator status.

Access Control: Sensitive system functions such as 'deposit' and 'distributeFinalityReward' are vulnerable to unauthorized execution parameters if they lack critical gas price modifiers, such as 'onlyZeroGasPrice', exposing the system to transaction-ordering manipulation and privilege escalation.

Access Control: A breakdown in state synchronization can occur when validator consensus key rotation does not propagate felony evictions to the active validator set. This allows jailed or slashed validators to continue participating in consensus.