Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
iotexproject/iotex-core
master @ 8376864
60
Fixes
0
CVEs
CRITICAL
Peak severity
60.0%
Coverage
Highlights
Denial of Service: 27 prior fixes. Scrutinize any change in this area.
action/protocol/execution/evm: most-fixed (9 issues). Treat as high-risk during review.
36 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: EVM execution and tracing are prone to out-of-bounds slice panics and nil-pointer dereferences during transaction revert parsing and internal error logging of contract creation. Unbounded execution without proper parameter sanity checks consistently causes node-level panics.
Auth Bypass: Staking state transition handlers, such as candidate updates, bucket transfers, and bucket endorsements, have suffered from missing or premature permission checks. Actions were processed without properly verifying that the caller owned the asset or that the hardfork validating the state machine status had activated.
Auth Bypass: