Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
itheum/data-dex
main @ 4b79c8d
3
Fixes
0
CVEs
HIGH
Peak severity
100.0%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
MultiversX: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The application failed to verify cryptographic message signatures before granting users access to data marshal resources via client-side redirection. Without signature verification, users could bypass access controls.
Auth Bypass: Hardcoding the devnet chain ID ('D') in transaction generation could allow transaction replay attacks or unauthorized execution across different network environments (e.g., testnet/mainnet). Dynamically resolving the active chain ID prevents cross-network transaction bypasses.
Input Validation: A logical operator flaw in input validation allowed unsafe protocols to bypass schemes check in `validateBaseInput`, exposing users to potentially insecure non-https/non-ipns URLs.