Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gnolang/gno
master @ 4c7eb15
134
Fixes
0
CVEs
CRITICAL
Peak severity
27.8%
Coverage
Highlights
Denial of Service: 69 prior fixes. Scrutinize any change in this area.
gnovm/pkg/gnolang: most-fixed (30 issues). Treat as high-risk during review.
84 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Shared standard libraries and packages running with missing or spoofed realm contexts could write to arbitrary foreign realms or bypass access control due to incorrect tracking of CurrentRealm vs PreviousRealm. Enforcing strict boundary rules and interrealm transition mechanics is vital.
Denial of Service: The VM engine is highly susceptible to CPU and memory exhaustion via unmetered allocations, deep AST recursion, and complex operations. Failure to unconditionally charge gas or enforce depth limits on parsing/evaluation directly threatens consensus stability.
Auth Bypass: A critical proof-forgery vulnerability in the IAVL tree could allow cryptographic proof validation bypasses if both child hashes are set within a single path node.