cd /news/ai-safety/aro-network-security-review-summary · home topics ai-safety article
[ARTICLE · art-73578] src=gist.github.com ↗ pub= topic=ai-safety verified=true sentiment=· neutral

ARO Network Security Review Summary

A security review of the ARO Network testnet repositories found a high-severity agent permission bypass in the `lumii-harness` that could allow autonomous agents to run commands without approval controls. Additional medium-severity issues include a bug in `MerkleDistributor.withdraw` that ignores the recipient parameter and potential secret exposure through Next.js build variables. The review recommends fixes such as not using `bypassPermissions` by default and auditing secret usage.

read3 min views6 publishedJul 25, 2026

Quick static security review summary for public ARO Network testnet repositories.

Note: This is not a full formal audit. Findings are based on public files sampled during a quick review.

| No | Severity | Finding | Repository | File / Location | Risk / Impact | Recommended Fix | Priority |

|---:|---|---|---|---|---|---|---| | 1 | HIGH | Agent permission bypass in lumii-harness

| aro-network/lumii-harness | client.py:35

; security.py

| If used operationally, autonomous agent may run commands with reduced/disabled approval controls. Dangerous with untrusted prompts/files; may allow file modification, data exfiltration, or unsafe shell/network commands. | Do not use bypassPermissions

by default. Register bash_security_hook

. Run agent in sandbox/container with limited filesystem/network. Add tests for blocked commands. | P1 |

| 2 | MEDIUM | MerkleDistributor.withdraw

ignores recipient

parameter | aro-network/aro-evm-contract | contracts/rewards/MerkleDistributor.sol:54-63

| Owner cannot withdraw to intended treasury/recipient. Event may be misleading and accounting can be wrong. Important before mainnet. | Transfer to recipient

instead of _msgSender() . Add unit tests for recipient withdrawal. | P1 |

| 3 | MEDIUM | Withdraw emits success event even when transfer does not occur | aro-network/aro-evm-contract

| `RewardsDistributor.sol:104-113`

; `MerkleDistributor.sol:54-63`

| Monitoring/accounting may think funds were withdrawn although no transfer occurred when amount exceeds balance. | Use require(amount <= balance, "Insufficient balance")

before transfer. Emit event only after successful transfer. Add negative tests. | P1/P2 |

| 4 | MEDIUM | Potential secret exposure through NEXT_PUBLIC_*

build variable | `aro-network/aro-official-website`

| `.github/workflows/static.yml:61-63`

| Any NEXT_PUBLIC_*

value in Next.js may be bundled client-side and visible publicly. Risk depends on whether secrets.PUBLIC_KEY

is truly public or sensitive. | Audit the secret value. If sensitive, rotate immediately and remove NEXT_PUBLIC_

exposure. If public config, store as non-secret repo variable. | P2 |

| 5 | MEDIUM | Next.js 15.0.3

may be affected by known advisories | aro-network/aro-official-website

; aro-network/aro-official-shop | package.json

| Potential exposure to Next.js vulnerabilities depending on deployment features like middleware/auth. Risk lower if static export, but should be upgraded before production/mainnet. | Upgrade Next.js to patched/latest version. Run dependency audit/Dependabot. Confirm middleware/auth usage. | P2 |

| 6 | MEDIUM | GitHub Actions supply-chain hardening gaps | aro-network/aro-official-website

| .github/workflows/static.yml

| Avoidable build/deploy supply-chain risk. Compromised action or dependency change could affect deployed site. | Apply least privilege per job. Pin third-party actions to commit SHA. Use pnpm install --frozen-lockfile

. Add dependency review/code scanning. | P2/P3 |

| 7 | LOW | window.open(..., "_blank")

without noopener,noreferrer

| aro-network/aro-official-website | src/app/components/AJoinWaitlist.tsx

| Reverse tabnabbing/phishing risk in some browser conditions. Easy to fix. | Use window.open(url, "_blank", "noopener,noreferrer")

or <a target="_blank" rel="noopener noreferrer"> . | P3 |

| 8 | INFO | No obvious leaked private secrets found in quick public scan | Public repos sampled | Public GitHub code/files | Positive note. No immediate exposed .env

or private key patterns found in quick review, but not a complete secret audit. | Enable GitHub secret scanning/push protection. Run full repo history scan before mainnet. | Info |

  • Fix lumii-harness

permission bypass / hook enforcement. - Fix

MerkleDistributor.withdraw() recipient bug. - Add insufficient-balance require

to withdraw flows. - Audit NEXT_PUBLIC_PUBLIC_KEY

/ GitHub Secret usage. - Upgrade Next.js.

  • Harden GitHub Actions.
  • Add tests and full audit before mainnet.
── more in #ai-safety 4 stories · sorted by recency
── more on @aro network 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
Live at https://your-agent.zahid.host
Get free account → Pricing
from €0/mo · no card required
LIVE [news/aro-network-security…] indexed:0 read:3min 2026-07-25 ·