Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

richardkiss/pycoin

              main @ a3a5caf
            

Fixes

CVEs

HIGH

Peak severity

33.3%

Coverage

Highlights

Auth Bypass: 4 prior fixes. Scrutinize any change in this area.

pycoin/tx/script/check_signature.py: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Signature Malleability: Trailing garbage bytes in DER signatures can lead to signature malleability. Strict checks must be applied to reject signatures with trailing data on verification while carefully managing legacy script exceptions.

Auth Bypass: Flaws in script interpretation, such as incorrect handling of the null dummy element in multisig or missing execution dispatch for operations like OP_CHECKLOCKTIMEVERIFY, can result in verification bypasses.

Signature Forgery: Failing to check if the message hash is zero allows attackers to forge valid ECDSA signatures. Verification and signing logic must reject zero values explicitly.