Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mystenlabs/sui

              main @ fcffd35
            

254

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Denial of Service: 152 prior fixes. Scrutinize any change in this area.

crates/sui-core/src/authority.rs: most-fixed (23 issues). Treat as high-risk during review.

175 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A critical signature bypass vulnerability existed where zkLogin authenticators inside multisig configurations were not validated to derive the exact same address as their corresponding public key identifier. This allowed attackers to craft valid multisig wrappers that did not correspond to authorized addresses.

Denial of Service: The Move VM runtime was vulnerable to stack overflows and node crashes due to recursive calls and unchecked node size processing in type representation. This was addressed by bounding recursive types and applying explicit node depth and gas limits during evaluation.

Auth Bypass: Address balances could be modified in the execution accumulator without proper authorization. The fix introduced intensive consensus-level invariant checks to validate and authorize any net-negative balance modifications.