Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

minaprotocol/mina

              develop @ 94efcdb
            

177

Fixes

CVEs

CRITICAL

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 41 prior fixes. Scrutinize any change in this area.

src/lib/crypto/kimchi_backend/gadgets/foreign_field.ml: most-fixed (10 issues). Treat as high-risk during review.

134 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cryptographic Issues: Custom gate validation and foreign field arithmetic in ECDSA gadgets were historically under-constrained, dropping crucial range/bounds checks and allowing the potential forgery of signatures or witness generation bypasses.

Auth Bypass: Failures in zkApp command execution logic allowed bypass of token delegation tracking, delegate call caller authorization, and general transaction signatures. State transitions must strictly bind and verify caller credentials and public keys rather than relying on uninitialized state parameters.

Denial of Service: The SNARK and transaction pools were susceptible to concurrency race conditions and resource exhaustion due to unthrottled concurrent table updates and unverified transaction proof queues.