Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

iost-official/go-iost

              master @ 74f5008
            

Fixes

CVEs

CRITICAL

Peak severity

37.1%

Coverage

Highlights

Auth Bypass: 39 prior fixes. Scrutinize any change in this area.

vm/host/authority.go: most-fixed (7 issues). Treat as high-risk during review.

48 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The VM authority component has repeatedly suffered from authorization bypasses where permissions (such as active vs owner keys) could be conflated, context-sensitive publishers were not correctly verified, and recursive checks skipped context arguments. Developers must strictly isolate and validate administrative levels.

Sandbox Escape: The JavaScript (V8) VM was vulnerable to sandbox escapes and unauthorized system access via the constructor property, global built-ins like 'Intl', and dynamic string execution. Developers should ensure the sandbox enforces a hardened global scope and strictly prevents arbitrary code compilation.

Auth Bypass: The VM Host Teller, which handles financial balances and transfers, frequently lacked proper validation of caller privileges. Failure to enforce sender authorization checks directly before executing transfers allowed unauthorized token transfers from third-party accounts.