Quick static security review summary for public ARO Network testnet repositories.
Note: This is not a full formal audit. Findings are based on public files sampled during a quick review.
| No | Severity | Finding | Repository | File / Location | Risk / Impact | Recommended Fix | Priority |
|---:|---|---|---|---|---|---|---|
| 1 | HIGH | Agent permission bypass in lumii-harness
| aro-network/lumii-harness
| client.py:35
; security.py
| If used operationally, autonomous agent may run commands with reduced/disabled approval controls. Dangerous with untrusted prompts/files; may allow file modification, data exfiltration, or unsafe shell/network commands. | Do not use bypassPermissions
by default. Register bash_security_hook
. Run agent in sandbox/container with limited filesystem/network. Add tests for blocked commands. | P1 |
| 2 | MEDIUM | MerkleDistributor.withdraw
ignores recipient
parameter | aro-network/aro-evm-contract
| contracts/rewards/MerkleDistributor.sol:54-63
| Owner cannot withdraw to intended treasury/recipient. Event may be misleading and accounting can be wrong. Important before mainnet. | Transfer to recipient
instead of _msgSender()
. Add unit tests for recipient withdrawal. | P1 |
| 3 | MEDIUM | Withdraw emits success event even when transfer does not occur | aro-network/aro-evm-contract
| `RewardsDistributor.sol:104-113`
; `MerkleDistributor.sol:54-63`
| Monitoring/accounting may think funds were withdrawn although no transfer occurred when amount exceeds balance. | Use require(amount <= balance, "Insufficient balance")
before transfer. Emit event only after successful transfer. Add negative tests. | P1/P2 |
| 4 | MEDIUM | Potential secret exposure through NEXT_PUBLIC_*
build variable | `aro-network/aro-official-website`
| `.github/workflows/static.yml:61-63`
| Any NEXT_PUBLIC_*
value in Next.js may be bundled client-side and visible publicly. Risk depends on whether secrets.PUBLIC_KEY
is truly public or sensitive. | Audit the secret value. If sensitive, rotate immediately and remove NEXT_PUBLIC_
exposure. If public config, store as non-secret repo variable. | P2 |
| 5 | MEDIUM | Next.js 15.0.3
may be affected by known advisories | aro-network/aro-official-website
; aro-network/aro-official-shop
| package.json
| Potential exposure to Next.js vulnerabilities depending on deployment features like middleware/auth. Risk lower if static export, but should be upgraded before production/mainnet. | Upgrade Next.js to patched/latest version. Run dependency audit/Dependabot. Confirm middleware/auth usage. | P2 |
| 6 | MEDIUM | GitHub Actions supply-chain hardening gaps | aro-network/aro-official-website
| .github/workflows/static.yml
| Avoidable build/deploy supply-chain risk. Compromised action or dependency change could affect deployed site. | Apply least privilege per job. Pin third-party actions to commit SHA. Use pnpm install --frozen-lockfile
. Add dependency review/code scanning. | P2/P3 |
| 7 | LOW | window.open(..., "_blank")
without noopener,noreferrer
| aro-network/aro-official-website
| src/app/components/AJoinWaitlist.tsx
| Reverse tabnabbing/phishing risk in some browser conditions. Easy to fix. | Use window.open(url, "_blank", "noopener,noreferrer")
or <a target="_blank" rel="noopener noreferrer">
. | P3 |
| 8 | INFO | No obvious leaked private secrets found in quick public scan | Public repos sampled | Public GitHub code/files | Positive note. No immediate exposed .env
or private key patterns found in quick review, but not a complete secret audit. | Enable GitHub secret scanning/push protection. Run full repo history scan before mainnet. | Info |
- Fix
lumii-harness
permission bypass / hook enforcement. - Fix
MerkleDistributor.withdraw()
recipient bug. - Add insufficient-balance
require
to withdraw flows. - Audit
NEXT_PUBLIC_PUBLIC_KEY
/ GitHub Secret usage. - Upgrade Next.js.
- Harden GitHub Actions.
- Add tests and full audit before mainnet.