Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
fbsobreira/gotron-sdk
master @ 202a9d9
7
Fixes
0
CVEs
HIGH
Peak severity
14.3%
Coverage
Highlights
Input Validation: 2 prior fixes. Scrutinize any change in this area.
pkg/account: most-fixed (2 issues). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Bypass: The hardware wallet integration previously returned hardcoded nil values and improper errors during transaction signing instead of returning the actual generated signature slice. This resulted in a critical signature bypass that could let unsigned or incorrectly signed transactions proceed.
Signature Validation Bypass: A lack of signature length validation prior to parsing could allow malformed cryptographic inputs to bypass structural checks during public key unmarshalling. This can result in system panics or signature validation bypasses during transaction verification.
Path Traversal: The account import, export, and keystore retrieval workflows were vulnerable to path traversal through key file paths and account names, which could allow arbitrary file reads when loading keys.