Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
orca-so/whirlpools
main @ 54f7fd5
2
Fixes
0
CVEs
HIGH
Peak severity
50.0%
Coverage
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
programs/whirlpool/src/util/account.rs: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Improper Control of Generation of Code or Account: Flaws in account generation logic can permit improper initialization of key accounts (such as position mints and token vaults) when pre-funded lamports exist in random keypairs. Attackers can leverage improper initialization sequences to disrupt state or gain unauthorized control over contract-deployed accounts.
Auth Bypass: Incomplete verification during Token-2022 TransferHook derivation can allow unauthorized callers to bypass check guards. Ensuring the authority and associated metadata accounts are rigorously validated prevents unauthorized transfer configurations.