Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
greymass/anchor
master @ 5444c52
7
Fixes
0
CVEs
HIGH
Peak severity
20.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
app/shared/utils/EOS/Handler.js: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The client failed to block dangerous EOSIO actions (like updateauth) within transaction templates, presenting a risk where malicious payloads could trick users into signing away account ownership. This requires strict client-side allowlist/denylist filtering for all signing operations.
Information Disclosure: Sensitive private keys could be inadvertently transmitted over the network during routine account and public key lookups. Secure handling of credentials must block private key formats before triggering network dispatchers.
Input Validation: Resource providers returning transaction data could spoof transactions if the returned payloads are not validated against the user's original request prior to signing.