Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
openzeppelin/openzeppelin-contracts
master @ 5c70e56
82
Fixes
0
CVEs
CRITICAL
Peak severity
54.3%
Coverage
Highlights
Auth Bypass: 32 prior fixes. Scrutinize any change in this area.
contracts/token/ERC20/SafeERC20.sol: most-fixed (6 issues). Treat as high-risk during review.
54 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: Attackers could call upgrade functions directly on the implementation logic contracts rather than through their active proxies, triggering unauthorized state changes or self-destruct scenarios via delegatecall.
Auth Bypass: Using unvalidated state or target configurations (such as treating non-contract target addresses as successful transfers, or miscalculating allowance targets using msg.sender instead of address(this)) can lead to complete transaction authorization and logic bypasses.
Reentrancy: Executing external token hooks (like tokensToSend or tokensReceived callbacks) prior to modifying balances or allowances exposes contracts to classical and cross-contract reentrancy attacks, allowing double-spends.