Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

paritytech/substrate

              master @ 033d4e8
            

208

Fixes

CVEs

CRITICAL

Peak severity

27.3%

Coverage

Highlights

Denial of Service: 157 prior fixes. Scrutinize any change in this area.

frame/contracts: most-fixed (16 issues). Treat as high-risk during review.

133 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Sandbox Escape: WebAssembly guest runtimes are highly privileged execution environments; deserializing precompiled runtime artifacts directly without explicit safety guards allowed bypassing sandbox containment. This was addressed by marking deserialization unsafe and defaulting to direct raw compilation.

Denial of Service: Smart contract execution routines previously processed lazy deletions of contract trie storage without bounds checks relative to block execution phases or queue depths. This allowed attackers to trigger block space saturation and CPU exhaustion, requiring the introduction of a budget-bounded queue with unified weight accounting.

Auth Bypass: A regression in the block-building flow bypassed mandatory transaction signature verification on block construction, allowing potentially forged or unverified extrinsics to be included. Signature validation was restored at the block builder level.