Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

unionlabs/union

              main @ a76ef9e
            

Fixes

CVEs

CRITICAL

Peak severity

12.9%

Coverage

Highlights

Auth Bypass: 40 prior fixes. Scrutinize any change in this area.

cosmwasm/ibc-union/app/ucs03-zkgm/src/contract.rs: most-fixed (6 issues). Treat as high-risk during review.

65 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The UCS03-ZKGM application contract contains numerous logic and authorization flaws, including incorrect logical inversion in permission checks, nested proxy execution bypasses, and improper asset path validations. These defects allowed unauthorized callers to execute migrations or perform invalid token operations.

Auth Bypass: The NEAR light client initially contained a critical stub implementation for signature verification that unconditionally returned true, allowing arbitrary unauthenticated headers to pass block validation.

Cryptographic Signature/Verification Bypass: The Ethereum light client failed to properly validate that untrusted public keys matched trusted aggregate public keys, and lacked signature quorum checks during misbehavior verification.