Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zeta-chain/node

              main @ 501fd44
            

Fixes

CVEs

HIGH

Peak severity

37.8%

Coverage

Highlights

Auth Bypass: 13 prior fixes. Scrutinize any change in this area.

zetaclient/chains/solana/observer: most-fixed (3 issues). Treat as high-risk during review.

26 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Attackers can bypass system message blocks by nesting restricted and disabled message types, such as MsgSubmitProposal or other arbitrary messages, inside Cosmos SDK authz.MsgExec/MsgGrant wrappers. This circumvents standard AnteHandler checks.

Denial of Service: Untrusted or malformed incoming Solana transactions cause node crashes (OOMs, nil pointer dereferences, or unhandled base58 parsing panics) during deserialization and parsing inside the Solana observer flow.

Auth Bypass: Unprivileged validators or callers could manipulate critical outbound transaction trackers or remove active trackers due to early return paths before signature verification or incorrect policy group mapping.