Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ethereum/sharding
master @ 09b8f3a
7
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 3 prior fixes. Scrutinize any change in this area.
sharding/contracts/validator_manager.v.py: most-fixed (4 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: External entities could directly execute `add_used_receipt` and prematurely mark receipts as consumed. Restricting this action to the contract itself ensures only authorized workflows can modify receipt states.
Auth Bypass: Collation headers could be submitted by arbitrary validators instead of the designated eligible proposer. Correcting the signature verification source prevents unauthorized block and collation proposals.
Input Validation: Missing upper-bound validation checks on `shard_id` allowed operations on out-of-bounds shard identifiers, risking contract state corruption.