Skip to content

Stellar Soroban core v2.1 report #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
milah-247 wants to merge 88 commits into
base: main
Choose a base branch
from
Open

Stellar Soroban core v2.1 report #124

milah-247 wants to merge 88 commits into from

Conversation

@milah-247
Copy link

@milah-247 milah-247 commented Jan 23, 2026 •
edited
Loading

Closes #110 Soroban Stellar Core V2.1 Create individual vulnerability submissions for Report
22b352d

@milah-247
Add V-SOR-VUL-001 vulnerability markdown
22b352d
@milah-247
Add V-SOR-VUL-002 vulnerability markdown
40afbdc
@milah-247
Add V-SOR-VUL-003 vulnerability markdown
d370f9f
@milah-247
Add V-SOR-VUL-004 vulnerability markdown
dece955
@milah-247
Add V-SOR-VUL-005 Cargo Audit Warnings vulnerability markdown
236a295
@milah-247
Add V-SOR-VUL-006 vulnerability markdown
738dd0b
@milah-247
Add V-SOR-VUL-007 vulnerability markdown
80ba457
@milah-247
Add V-SOR-SPEC-001 fuzzed specification markdown
1d09fa1
@milah-247
Add V-SOR-SPEC-002 fuzzed specification markdown
c3c878d
@milah-247
Add V-SOR-SPEC-003 fuzzed specification markdown
16158b8
@milah-247
Add V-SOR-SPEC-004 fuzzed specification markdown
d2a0e0b
@milah-247
Add V-SOR-SPEC-005 fuzzed specification markdown
6fd3a74
@milah-247
Add V-SOR-SPEC-006 fuzzed specification markdown
4366cb4
@milah-247
Add V-SOR-SPEC-007 fuzzed specification markdown
b45cd2f
@milah-247
Add V-SOR-SPEC-008 fuzzed specification markdown
35c6032
@milah-247
Add V-SOR-SPEC-010 fuzzed specification
7b877e8
@milah-247
Add vulnerability entry: V-SOR-SPEC-009 - Primitive i64 conversion wo…
8a11431 
…rks as intended
@milah-247
Add vulnerability: V-SOR-SPEC-011 - Buffer to Xdr conversions cause n…
76e4de7 
…o crashes
@milah-247
Update: Edit V-SOR-SPEC-012
1db5ef1
@milah-247
Add vulnerability: V-SOR-SPEC-013 - Vector append function works as i…
59454be 
…ntended
@milah-247
Add vulnerability: V-SOR-SPEC-014 - Vector back function works as int…
c328d1e 
…ended
@milah-247
Add vulnerability: V-SOR-SPEC-015 - Vector front function works as in…
5c464ed 
…tended
@milah-247
Add vulnerability: V-SOR-SPEC-016 - Vector length function works as i…
48d485c 
…ntended
@milah-247
Add vulnerabilities: V-SOR-SPEC-016 and V-SOR-SPEC-017
5172c77
@milah-247
Add vulnerability: V-SOR-SPEC-018 - Vector push_back function works a…
27f8862 
…s intended
@milah-247
Add vulnerability: V-SOR-SPEC-019 - Vector push_back function
7ceba15
@milah-247
Add vulnerability: V-SOR-SPEC-020 - Vector push_front function works …
08242c3 
…as intended
@milah-247
Add vulnerability: V-SOR-SPEC-021 - Wasmi module works with no crashes
f9fbad3
@milah-247
Add V-SOR-APP-VUL-001: Possible Unmetered Clones
68243da
@milah-247
Add Soroban app-level vulnerabilities VUL-001 and VUL-002
9dd42a9
SurfingBowser
SurfingBowser reviewed Jan 29, 2026
View reviewed changes
Copy link
Collaborator

@SurfingBowser SurfingBowser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi I appreciate the changes!

It looks like time was spent on the actual code blocks as well as properly identifying variables & terms using backticks. Overall this has had a lot of progress since the first submission.

Please address the changes, it looks like some information was omitted on a few of the vulnerabilities or even altered.

Not every instance of errors I encountered has been marked but the formatting style needs to be consistent, so please update accordingly

@SurfingBowser SurfingBowser changed the title Add V-SOR-VUL-001 vulnerability markdown Stellar Soroban core v2.1 report Jan 30, 2026
@SurfingBowser
Copy link
Collaborator

SurfingBowser commented Jan 30, 2026

In order for the drips bot to see this and make sure your issue gets rewarded make sure to include the issue this solves in your PR @milah-247 #110

SurfingBowser
SurfingBowser reviewed Jan 31, 2026
View reviewed changes
soroban-security-portal Outdated
Copy link
Collaborator

@SurfingBowser SurfingBowser Jan 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hey @milah-247 please remove this file and then I can approve the PR

Copy link
Author

@milah-247 milah-247 Jan 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok

Copy link
Contributor

@0xGeorgii 0xGeorgii Feb 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

also, please locate files in a dedicated directory, not in the project root

@SurfingBowser
Copy link
Collaborator

SurfingBowser commented Jan 31, 2026

I made one comment to remove a file and then I can merge pr

0xGeorgii
0xGeorgii requested changes Feb 3, 2026
View reviewed changes
README.md Outdated
Copy link
Contributor

@0xGeorgii 0xGeorgii Feb 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please restore this file

Copy link
Author

@milah-247 milah-247 Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay

0xGeorgii
0xGeorgii requested changes Feb 3, 2026
View reviewed changes
@SurfingBowser
Copy link
Collaborator

SurfingBowser commented Feb 5, 2026

the file "soroban-security-portal" is still present. Please remove it
https://github.com/Inferara/soroban-security-portal/pull/124/changes#diff-139c54d64e18cae56ad51bcdf6abbb385413ea4c2e20d8fdada9f454e4ff43e6R1

@drips-wave drips-wave bot mentioned this pull request Feb 6, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SurfingBowser SurfingBowser SurfingBowser left review comments

@0xGeorgii 0xGeorgii 0xGeorgii requested changes

Requested changes must be addressed to merge this pull request.

Assignees

@milah-247 milah-247

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Soroban Stellar Core V2.1 Create individual vulnerability submissions for Report

3 participants

@milah-247 @SurfingBowser @0xGeorgii