Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

radixdlt/radixdlt-scrypto

              develop @ 858c70f
            

111

Fixes

CVEs

CRITICAL

Peak severity

52.9%

Coverage

Highlights

Auth Bypass: 84 prior fixes. Scrutinize any change in this area.

radix-engine: most-fixed (27 issues). Treat as high-risk during review.

100 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Retrieving incorrect parent verification details from the call stack instead of the immediate parent allows nested transaction subintents to bypass security boundaries.

Auth Bypass: Flaws in authorization check caching where unverified states get indexed or early-returns evaluate zero-counts incorrectly can completely bypass downstream validation logic.

Sandbox Escape: Floating-point instructions or improper imports of host-level cryptographic utilities can compromise host-environment isolation if not disabled and strictly verified at the Wasm boundary.