Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
mystenlabs/fastcrypto
main @ b247b33
30
Fixes
0
CVEs
CRITICAL
Peak severity
37.5%
Coverage
Highlights
Cryptographic Issues: 9 prior fixes. Scrutinize any change in this area.
fastcrypto/src/bls12381/mod.rs: most-fixed (4 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Cryptographic Issues: Critical verification bypasses occurred due to disabled signature validation flags, missing subgroup verification checks on public keys/signatures, and stale byte caches during serialization. These flaws collectively allowed malformed or rogue signatures to pass batch and aggregate verification thresholds.
Auth Bypass: Both Ed25519 and BLS12-381 signature schemes suffered from verification bypasses where empty batches or empty aggregate signatures were accepted as valid because the verification loops exited early with a success code.
Auth Bypass: The presence of `Default` implementations returning predictable, hardcoded, or all-zero bytes for cryptographic structures like `blst::PublicKey` permitted security-critical code to inadvertently accept unitialized keys, leading to complete authentication bypasses.