Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
onflow/fcl-js
master @ 62d01ad
13
Fixes
0
CVEs
HIGH
Peak severity
77.8%
Coverage
Highlights
Auth Bypass: 9 prior fixes. Scrutinize any change in this area.
packages/fcl/src/exec/verify.js: most-fixed (3 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multi-signature threshold calculations in the Cadence verification script failed to validate key uniqueness, allowing duplicate keys to bypass weight thresholds. Future signature verification logic must validate key uniqueness and weight inside verification scripts.
Signature Verification Bypass: The verification system was vulnerable to multi-account signature aggregation bypasses where signature payloads could be mixed across different accounts instead of being validated against a single consistency scope.
Auth Bypass: Lack of explicit configuration enforcement allowed signature replay across multiple networks. Signatures must be explicitly tied to a designated network or contract to prevent validation logic from evaluating them on an unintended chain state.