Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

use-ink/ink

              master @ 08083f6
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

GitHub: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Flaws in contract instantiation dispatch allowed callers to bypass `deny_payment` checks on non-payable constructors, leading to unauthorized funding or state inconsistencies during contract deployment.

Auth Bypass: Failure to unconditionally revert the blockchain state upon returning a `Result::Err` allowed contract calls to fail gracefully while retaining state changes, triggering transactional inconsistency and authorization bypasses.

Logic Error: Neglecting to propagate `LangError` within `DelegateCall` invocations caused silent execution failures in delegate contexts, potentially leading to unauthorized or unverified control-flow progression.