Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
paritytech/polkadot-sdk
master @ 2a3365c
282
Fixes
0
CVEs
CRITICAL
Peak severity
31.3%
Coverage
Highlights
Denial of Service: 179 prior fixes. Scrutinize any change in this area.
pallet-revive: most-fixed (10 issues). Treat as high-risk during review.
178 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Sandbox Escape: Historically, compiling and running untrusted WebAssembly code within validation workers allowed host-level sandbox escapes. Mitigation required enforcing secure clone namespaces, Landlock filesystem containment, and seccomp system-call filtering to prevent compromised workers from accessing host networking or the global filesystem.
Denial of Service: Unmetered operations during smart contract execution (such as gas-free sandbox memory copying, underpriced storage reads/writes, or excessive debug log buffers) repeatedly allowed CPU and memory exhaustion attacks. Addressing these required pre-charging gas proportional to transfer sizes and bounding buffer capacities.
Auth Bypass: Flaws in trie path validation and receipt proof verification allowed malicious actors to bypass cryptographic proof checking on the Ethereum client bridge. Hardening required enforcing strict key, path, and root equality checks during proof verification.