Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

renegade-fi/renegade

              main @ 744b3ab
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Auth Bypass: 14 prior fixes. Scrutinize any change in this area.

zk-circuits: most-fixed (2 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Zero-knowledge circuit verification bypasses in validity circuits allow unauthorized balance changes or state manipulation due to missing constraints, such as not verifying the match key pre-image in VALID COMMITMENTS or omitting signature checks in balance updates.

Auth Bypass: Authentication bypasses occur on HTTP and routing boundaries when signature verification fails to include the request query string or parses malformed raw header bytes rather than structured Base64-decoded signatures.

Double Spend: Processing orders without validating their nullifier status on-chain allows double-spending within the darkpool local orderbook state.