Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kava-labs/kava
master @ 917cc32
22
Fixes
0
CVEs
HIGH
Peak severity
47.4%
Coverage
Highlights
Auth Bypass: 7 prior fixes. Scrutinize any change in this area.
x/bep3: most-fixed (2 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The integration of the Cosmos SDK authz module allowed attackers to execute restricted message types (such as Cosmos and EVM transactions) inside nested context wrappers, bypassing standard AnteHandler limiters. Ensure strict, recursive validation of nested messages.
Business Logic Bypass: Flaws in validation during token withdrawals and borrowing operations allowed users to violate required Loan-to-Value (LTV) limits, potentially leading to undercollateralized positions and pool insolvency.
Auth Bypass: Permission and parameter checks in governance committees could be bypassed by exploiting incorrect comparisons (e.g., matching asset Denom instead of Type) or logically inverted expiration conditions, permitting unauthorized parameter modifications.