Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dapphub/dapptools

              master @ a782a9d
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

hevm-cli: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: The 'ffi' cheatcode allows smart contracts running inside hevm to execute arbitrary system commands on the host machine. Without explicit command line flags gating this execution, loading untrusted contracts could result in immediate host compromise.

Auth Bypass: Case-sensitive address matching failures resulted in a silent fallback from local, secure offline signing to insecure RPC-side signing. This fallback mechanism bypasses intended local key guards.

Auth Bypass: Defaulting to RPC-side transaction signing delegating to the node can result in unauthorized transaction execution. Explicit user consent via a dedicated flag is required to delegate signing safely.