Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ithacaxyz/account

              main @ 767e973
            

Fixes

CVEs

HIGH

Peak severity

14.3%

Coverage

Highlights

Auth Bypass: 5 prior fixes. Scrutinize any change in this area.

src/EntryPoint.sol: most-fixed (2 issues). Treat as high-risk during review.

7 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Transient state corruption (using tstore) allowed bypasses when execution modes like SANS_VERIFY failed to reset internal flags. Developers must ensure transient state flags are explicitly reset or localized to prevent execution-mode pollution.

Signature Replay: ERC-1271 validation was susceptible to signature replays across different applications because it validated digests without domain-specific wrapping. Robust wrapping of external digests with account-specific EIP-712 domain separators is required.

Auth Bypass: Session keys could abuse transaction signing authorization when signature verification did not restrict ERC-1271 validation strictly to super admin or original EOA keys.