Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
solana-foundation/surfpool
main @ b46c47e
7
Fixes
0
CVEs
CRITICAL
Peak severity
16.7%
Coverage
Highlights
Signature Verification Bypass: 2 prior fixes. Scrutinize any change in this area.
crates/core/src/surfnet/svm.rs: most-fixed (3 issues). Treat as high-risk during review.
6 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Verification Bypass: The platform relies on manual signature verification to compensate for disabled signature checks in the underlying LiteSVM engine. Failure to explicitly enforce these cryptographic validations during transaction processing and simulation leads to direct authorization bypasses.
SQL Injection: User-controlled JSON metadata was interpolated directly into raw Diesel SQL queries without proper sanitization or parameterization. Developers must base64-encode or parameterize any structured inputs handled by raw SQL queries to prevent remote database exploitation.
Authentication Bypass: Inadequate blockhash validation allowed transactions to bypass freshness and authenticity checks. Explicit verification of blockhashes against durable nonce accounts is required to ensure transaction validity.