Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
curvefi/curve-contract
master @ 574f440
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
contracts/pool-templates/meta/DepositTemplateMeta.vy: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: A privileged bypass in the transferFrom function allowed the minter to transfer arbitrary user balances without standard approval, breaking core ERC20 trust assumptions. Ensure all transfer paths uniformly enforce allowance checks regardless of caller roles.
Out-of-bounds Write: An incorrect offset mapping for the base pool coin index led to an out-of-bounds write when writing to base_amounts. This can cause state corruption or transaction reversion during deposits.
Memory Corruption: The use of older Vyper compiler versions (specifically 0.2.8) exposed contracts to known compiler-level memory corruption bugs, requiring a mandatory upgrade of the pragma version.