Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

scrtlabs/secretnetwork

              master @ 9f08b0e
            

177

Fixes

CVEs

CRITICAL

Peak severity

43.3%

Coverage

Highlights

Auth Bypass: 94 prior fixes. Scrutinize any change in this area.

cosmwasm/enclaves/execute/src/registration/offchain.rs: most-fixed (18 issues). Treat as high-risk during review.

149 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical logical inversions in the SGX EPID GID verification logic (check_epid_gid_is_whitelisted) historically allowed non-whitelisted platforms to pass attestation validation, presenting a severe risk to the network's decentralized root-of-trust.

Auth Bypass: Signer identity mapping failures where MsgExecuteContract tracked incorrect signer fields permitted complete transaction signature verification bypass and sender impersonation.

Cryptographic Error: A critical variables-use error caused the enclave to seal the inactive 'genesis' consensus seed instead of the 'current' rotated seed, jeopardizing the confidentiality and forward secrecy of the chain state.