Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

rainbow-me/rainbow

              develop @ 11c4107
            

Fixes

CVEs

CRITICAL

Peak severity

65.2%

Coverage

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

src/screens/SignTransactionSheet.tsx: most-fixed (2 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Biometric failure fallback mechanisms on Android devices allow PIN bypasses, leaving sensitive wallet components vulnerable to unauthorized device access. Biometric checks must securely fallback to mandatory PIN challenges.

Auth Bypass: Race conditions and origin mismatches in the dApp browser messenger can associate messages from one origin with the messenger instance of another. Strict origin verification must be performed dynamically per message.

Auth Bypass: EIP-712 structured messages can be injected with undeclared parameters to bypass user verification and trigger unauthorized token approvals. Input serialization must strip out any fields not explicitly defined in the typed data definition schema.