Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
provablehq/leo
master @ 4f2aa45
29
Fixes
1
CVEs
HIGH
Peak severity
51.9%
Coverage
Highlights
Denial of Service: 16 prior fixes. Scrutinize any change in this area.
compiler/parser/src/tokenizer/lexer.rs: most-fixed (2 issues). Treat as high-risk during review.
11 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Zero-Knowledge Constraint Soundness: Conditional optimizations or early Rust-level returns in gadget logic skipped essential R1CS constraint generation, allowing mathematically invalid operations to produce valid-looking proofs. Developers must ensure that constraints are unconditionally generated for all execution branches.
Denial of Service: The lexer and parser are highly vulnerable to crashing due to improper input sanitization, such as unsafe string slicing or unvalidated Unicode code points. Malformed inputs can trigger panic conditions or infinite execution loops, leading to compiler denial of service.
Auth Bypass: The type-checking system historically allowed complex, unsupported payload types (such as mappings, tuples, or units) inside signature verification methods, leading to logical verification bypasses. Ensuring strict, validated type conformance during semantic analysis is critical.