Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
setprotocol/set-protocol-contracts
master @ 7b9e564
38
Fixes
0
CVEs
CRITICAL
Peak severity
47.2%
Coverage
Highlights
Access Control: 7 prior fixes. Scrutinize any change in this area.
contracts/SetToken.sol: most-fixed (5 issues). Treat as high-risk during review.
24 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Access Control: The lack of caller validation in core operations allowed arbitrary actors to directly mint and burn Set tokens, bypassing the authorized Core contract controller. Ensure all token mint/burn entry points strictly enforce authorized-only access.
Auth Bypass: Critical assets could be drained through the transfer proxy without authorization checks. Restricting caller access to approved modules is vital to prevent unauthorized transfers of user-approved collateral.
Reentrancy: State variables were modified after external contract calls during redemption, making the contract highly vulnerable to reentrancy. Strictly follow the Checks-Effects-Interactions pattern for all external transfer paths.