Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
unlock-protocol/unlock
master @ 6e681fa
65
Fixes
0
CVEs
CRITICAL
Peak severity
34.2%
Coverage
Highlights
Auth Bypass: 37 prior fixes. Scrutinize any change in this area.
locksmith: most-fixed (4 issues). Treat as high-risk during review.
43 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The backend accepted client-provided wallet addresses during access token generation without validating that they matched the actual identity authenticated by Privy. This is a severe identity spoofing vector that bypasses the entire authentication flow.
Auth Bypass: Failing to await the asynchronous promise returned by `web3Service.isLockManager` meant that the promise object evaluated as truthy, leading to a complete bypass of lock management authorization checks.
Auth Bypass: Missing the standard `initializer` modifier allowed malicious actors to re-initialize contracts and assume contract ownership, representing an existential threat to deployed proxy contracts.