Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tatumio/tatum-js

              master @ cf7f150
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Input Validation: 2 prior fixes. Scrutinize any change in this area.

src/service/rpc/generic/LoadBalancerRpc.ts: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The RPC load balancer previously failed to strictly parse and validate target hostnames, rendering the client vulnerable to SSRF bypasses when sending requests via fetch. Subsequent fixes introduced proper URL API parsing and strict domain suffix checks.

Cryptographic Issue: Improper BIP32 key derivation for TRON HD wallets previously led to incorrect address generation, introducing cryptographic inconsistencies and risk of lost funds during address derivation.

Input Validation: A critical flaw in parameter passing made the class-validator 'isUUID' check ineffective for signatureId, allowing invalid or malformed identifiers to bypass validation logic.