Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
metaplex-foundation/metaplex-program-library
master @ cc09320
70
Fixes
0
CVEs
HIGH
Peak severity
51.7%
Coverage
Highlights
Auth Bypass: 45 prior fixes. Scrutinize any change in this area.
token-metadata: most-fixed (13 issues). Treat as high-risk during review.
56 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers can bypass metadata ownership verification or manipulate collection sizes if the code skips strict PDA derivation checks, account initialization validation, or program owner assertions.
Auth Bypass: Incomplete verification of seller trade states and PDA seeds in execution logic allows trading state spoofing or transaction bypasses via uninitialized accounts.
Access Control: Missing empty-account verification on metadata targets can permit unauthorized minting state overrides.