Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

tintinweb/smart-contract-sanctuary

              master @ 5a7cf7f
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

FiresaleArt.sol: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Critical administrative functions, such as withdraw(), completely lacked ownership checks, allowing any external caller to drain contract funds. Developers must ensure all sensitive state-changing and withdrawal operations are strictly gated with onlyOwner modifiers.

Auth Bypass: The depositMultiERC721Batch function allowed whitelist bypasses and unauthorized rewards minting by validating the transaction sender instead of verifying the explicit NFT contract address. Multi-token batch operations must validate each individual contract address against an authorized whitelist using cryptographic proofs.

Arbitrary Transfer: A backdoored routing mechanism embedded inside helper logic redirected token transfers to an unauthorized hardcoded wallet address. This highlights the risk of unvetted mathematical or routing helper libraries executing arbitrary transfers.