Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

filecoin-project/lotus

              master @ 14730b0
            

Fixes

CVEs

CRITICAL

Peak severity

45.7%

Coverage

Highlights

Denial of Service: 52 prior fixes. Scrutinize any change in this area.

api: most-fixed (11 issues). Treat as high-risk during review.

60 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The project's RPC interface has repeatedly exposed administrative and sensitive endpoints (such as those managing local files, wallet signing, and node state) to unprivileged users due to missing, misplaced, or bypassed declarative permission tags, such as 'perm:read' or 'perm:admin'.

Denial of Service: The JSON-RPC public gateway is highly susceptible to resource exhaustion. Untrusted clients can trigger infinite filter/subscription leaks, deep historical chain queries, or excessive transaction submissions without adequate lookback, rate-limiting, or session cleanup.

Signature Verification Bypass: Critical synchronization paths historically bypassed cryptographic signature verification (including both SECP256K1 and BLS signature algorithms) or ignored validation errors entirely due to logic typos, unhandled nil-signature payloads, or stubbed validation routines.