Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kodadot/nft-gallery
main @ f6fd1be
19
Fixes
0
CVEs
HIGH
Peak severity
55.6%
Coverage
Highlights
Auth Bypass: 8 prior fixes. Scrutinize any change in this area.
composables/useChainRedirect.ts: most-fixed (2 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Inconsistent representation of blockchain addresses between Substrate and EVM chains allowed unauthorized actions when validating asset ownership. Future development must enforce uniform, chain-specific normalization before comparing identity keys.
Auth Bypass: Profile modifications and deletion requests were susceptible to authorization bypasses if signature payloads were not explicitly required or fully verified in the request body.
Denial of Service: Greedy regular expression matching on template strings allowed for potential ReDoS attacks. This was mitigated by limiting pattern matching lengths and using non-greedy operators.