Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kroma-network/tachyon
main @ e7b1306
3
Fixes
4
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
tachyon/crypto/challenger/challenger.h: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Logic Error: A critical cryptographic verification bypass existed because the result of `CheckWitness` was silently discarded instead of being actively asserted or checked, potentially allowing invalid witnesses to pass validation.
Auth Bypass: Sorting dimensions lists without tracking original indexes caused values to go out-of-sync during Merkle opening proof verification, leading to potential proof bypasses.
Memory Safety: A use-after-free vulnerability occurred because temporary data returned by `ToVanishingVerificationData` was bound directly to an evaluator instead of being anchored to a local variable lifetime first.