Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ethereum/btcrelay

              develop @ 3cdf41a
            

Fixes

CVEs

HIGH

Peak severity

85.7%

Coverage

Highlights

Auth Bypass: 6 prior fixes. Scrutinize any change in this area.

btcrelay.se: most-fixed (6 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Untrusted parameter validation in transaction verification can lead to arbitrary transaction processing. Specifically, relying on user-supplied transaction hashes instead of computing them internally allows attackers to pass fabricated proofs.

Auth Bypass: Flawed identification of the transaction caller (using msg.sender rather than the original tx.origin or delegating permissions via sendCoin instead of sendCoinFrom) allows intermediaries or contract relays to bypass payment and authorization policies.

Auth Bypass: Incomplete destination verification allows funds to be released upon receiving any valid Bitcoin transaction of sufficient value, without confirming that the transaction was actually intended for the contract.