Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

cosmos/cosmos-sdk

              main @ 24fb5ff
            

239

Fixes

CVEs

CRITICAL

Peak severity

52.9%

Coverage

Highlights

Denial of Service: 112 prior fixes. Scrutinize any change in this area.

x/auth: most-fixed (15 issues). Treat as high-risk during review.

159 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Verification Bypass: Flaws in curve point verification within the secp256k1 cgo fork allowed incorrect signatures to pass validation, undermining the cryptographic foundation of the entire chain. This required structural updates to the underlying scalar multiplication libraries.

Auth Bypass: A critical logical flaw in the slashing system enabled delegators to evade slashing penalties entirely by executing rapid redelegation and undelegation sequences before infraction evidence processed. This required refactoring the validator state retention and share calculation mechanics.

Denial of Service: Failures to validate block-level and transaction-level gas limits during the block proposal preparation phases permitted malformed proposals to exceed maximum thresholds, culminating in consensus halts. Enforcing gas limit checks early in the ABCI lifecycle is essential to prevent resource exhaustion.