Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

michaelhly/solana-py

              master @ 9cfc7a4
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Cryptographic Issues: 3 prior fixes. Scrutinize any change in this area.

src/spl/token/core.py: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Constructed SPL token operations such as transfer, transfer_checked, and creating wrapped native accounts failed to include all necessary keypairs and signers. This causes transaction signature verification to fail on-chain, preventing secure execution of token transfers.

Auth Bypass: Token freeze and thaw helper functions generated incomplete transaction signer lists by failing to correctly include the fee payer. This omission bypasses the required authority signatures or causes transaction rejection during fee settlement.

Cryptographic Issues: The transaction serialization engine skipped empty signatures instead of padding them with null bytearrays of the correct length, creating malformed wire transactions that violate protocol constraints.