Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

sparrowwallet/sparrow

              master @ 3dc5068
            

Fixes

CVEs

HIGH

Peak severity

60.0%

Coverage

Highlights

Man-in-the-Middle: 4 prior fixes. Scrutinize any change in this area.

src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java: most-fixed (7 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Man-in-the-Middle (MitM): The connection logic previously lacked endpoint identification, dynamic algorithm verification, and proper Trust-On-First-Use (TOFU) or CA trust-root verification, leaving user connections highly vulnerable to active intercept.

Information Disclosure: Standard socket resolution logic bypassed Tor isolation by triggering local DNS requests, leaking .onion destinations to local networks. Utilizing unresolved socket addresses is mandatory.

Authentication Bypass: Empty inputs allowed password-dialog authentication logic to erroneously succeed, potentially permitting unauthorized access to encrypted configurations.