Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ethereum/py-evm

              main @ ffce74f
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

eth/_utils/bls.py: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: Failure to enforce the ensure_no_static check on the SSTORE instruction in the Constantinople VM allowed unauthorized state modification during static calls, violating the sandbox invariants of STATICCALL.

Auth Bypass: Improper math when verifying transaction costs allowed validation to pass without confirming the sender had sufficient funds (failing to multiply the effective gas price by the gas limit).

Auth Bypass: Flawed extraction of the signature V value and chain ID for EIP-155 transactions can bypass signature validation and lead to incorrect verification.