Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

swaponline/multicurrencywallet

              master @ 9eae354
            

Fixes

CVEs

CRITICAL

Peak severity

47.1%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

src/core/swap.auth/next.js: most-fixed (2 issues). Treat as high-risk during review.

16 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A critical key-derivation flaw occurred where the mnemonic passphrase argument was completely omitted during next-wallet generation, rendering the resulting keys highly insecure or completely broken. Parameter shadowing in related files further disrupted the core wallet derivation logic.

Auth Bypass: The underlying smart contract platform suffered from severe structural integrity risks, specifically including hardcoded administrator backdoors and emergency withdrawal overrides that circumvented the decentralized trust assumptions of the swap mechanism.

Logic Error: Flaws in swap state validation—such as inverting participant-owner addresses and failing to ensure the Ethereum swap transaction was mined and verified on-chain before executing secret extraction—directly exposed the swap participants to financial loss.