Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

velocity-exchange/protocol-v2

              master @ 13e8e9b
            

Fixes

CVEs

HIGH

Peak severity

41.9%

Coverage

Highlights

Auth Bypass: 19 prior fixes. Scrutinize any change in this area.

programs/clearing_house/src/controller/orders.rs: most-fixed (7 issues). Treat as high-risk during review.

43 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The SWIFT order execution path has repeatedly suffered from signature validation bypasses, lack of payload bounds checking, and failure to bind delegate signatures to target accounts, allowing spoofing or unauthorized order placements.

Denial of Service: Borsh and Anchor deserialization logic of SWIFT payloads repeatedly triggered panics and crashes due to insufficient zero-padding on short message slices.

Oracle Manipulation: Lack of validation checks against oracle price divergence, TWAP deviations, and stale feeds during liquidation led to high vulnerability to artificial liquidations driven by temporary price spikes.