Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zkopru-network/zkopru

              main @ 340d5f3
            

Fixes

CVEs

CRITICAL

Peak severity

58.8%

Coverage

Highlights

Auth Bypass: 7 prior fixes. Scrutinize any change in this area.

packages/core/src/validator/offchain/offchain-tx-validator.ts: most-fixed (3 issues). Treat as high-risk during review.

21 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Asynchronous zk-SNARK proof verification was not awaited, causing cryptographic proof verification to always succeed regardless of validity. This completely broke the soundness of state transitions.

Signature Replay: Prepay requests lacked EIP-712 structured typed hashing and expiration checks, exposing the protocol to signature replay attacks where valid signatures could be re-submitted maliciously.

Auth Bypass: The slashed status of invalid proposals was not persisted in global storage, which allowed finalized states to progress on slashed chains and bypassed the protocol's core slashing guarantee.