Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

huff-language/huffmate

              main @ 4e2c9bd
            

Fixes

CVEs

CRITICAL

Peak severity

81.8%

Coverage

Highlights

Auth Bypass: 10 prior fixes. Scrutinize any change in this area.

src/tokens/ERC721.huff: most-fixed (4 issues). Treat as high-risk during review.

17 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Misaligned stack elements prior to invoking authorization validation macros (such as IS_OWNER_OR_APPROVED) allowed transactions to bypass validation checks completely. Developers must guarantee correct stack order duplication before delegating to validation sub-macros.

Auth Bypass: The lack of enforced access checks and misconfigured execution flow within authorization macros (like REQUIRES_AUTH) permitted unauthorized invocation of restricted functions. Verifying that all entry points correctly jump to revert structures on failed checks is crucial.

Logic Error: Routing malfunctions, such as empty calldata falling through into the allowance function or stack corruption caused by incorrect macro 'takes' and 'returns' definitions, can lead to severe operational failures. Exact tracking of gas, calldata structure, and stack sizes is required.