Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

kadena-io/pact

              master @ 4208012
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

src/Pact/Types/Command.hs: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Weaknesses in command verification allowed signature bypasses, replay attacks, and signature malleability by failing to securely bind public keys to declared addresses and omitting critical execution metadata like chain ID in payload signatures.

Auth Bypass: Incomplete enforcement of keyset namespacing and validation rules allows potential keyset namespace spoofing, undermining the foundational access control mechanism of the platform.

Denial of Service: Unbounded resource utilization when loading or evaluating oversized modules could exhaust memory resources, leading to execution engine denial of service.