Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
paritytech/polkadot
master @ 52209dc
63
Fixes
0
CVEs
HIGH
Peak severity
38.9%
Coverage
Highlights
Denial of Service: 41 prior fixes. Scrutinize any change in this area.
node/core/pvf: most-fixed (7 issues). Treat as high-risk during review.
32 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Untrusted WebAssembly code execution in workers represents a high-severity threat. Attackers escaping the WASM VM could access the host filesystem or system resources. Hardening requires strict process isolation, Landlock-based sandboxing, memory page limits, and reading compilation artifacts directly into memory rather than opening paths within sandboxed threads.
Denial of Service: The PVF subsystem is susceptible to resource exhaustion attacks via complex WASM execution. Defensive measures must enforce strict thread CPU clock timeouts instead of wall-clock time, WebAssembly stack depth metering, NaN canonicalization, and native stack allocation limits to prevent thread crashes.
Auth Bypass: Flaws in slashing or dispute logic allow malicious validators or backers to submit invalid votes or escape economic penalties. This directly threatens the consensus safety of the network, necessitating early chain block-reversion when threshold thresholds are crossed and robust validation of backing votes.