# ARO Network Security Review Summary

> Source: <https://gist.github.com/Mamat9q/543b0bae7c5930004d3328b8463bd0b7>
> Published: 2026-07-25 18:17:04+00:00

Quick static security review summary for public ARO Network testnet repositories.

Note: This is not a full formal audit. Findings are based on public files sampled during a quick review.

| No | Severity | Finding | Repository | File / Location | Risk / Impact | Recommended Fix | Priority |

|---:|---|---|---|---|---|---|---|

| 1 | HIGH | Agent permission bypass in `lumii-harness`

| `aro-network/lumii-harness`

| `client.py:35`

; `security.py`

| If used operationally, autonomous agent may run commands with reduced/disabled approval controls. Dangerous with untrusted prompts/files; may allow file modification, data exfiltration, or unsafe shell/network commands. | Do not use `bypassPermissions`

by default. Register `bash_security_hook`

. Run agent in sandbox/container with limited filesystem/network. Add tests for blocked commands. | P1 |

| 2 | MEDIUM | `MerkleDistributor.withdraw`

ignores `recipient`

parameter | `aro-network/aro-evm-contract`

| `contracts/rewards/MerkleDistributor.sol:54-63`

| Owner cannot withdraw to intended treasury/recipient. Event may be misleading and accounting can be wrong. Important before mainnet. | Transfer to `recipient`

instead of `_msgSender()`

. Add unit tests for recipient withdrawal. | P1 |

| 3 | MEDIUM | Withdraw emits success event even when transfer does not occur | `aro-network/aro-evm-contract`

| `RewardsDistributor.sol:104-113`

; `MerkleDistributor.sol:54-63`

| Monitoring/accounting may think funds were withdrawn although no transfer occurred when amount exceeds balance. | Use `require(amount <= balance, "Insufficient balance")`

before transfer. Emit event only after successful transfer. Add negative tests. | P1/P2 |

| 4 | MEDIUM | Potential secret exposure through `NEXT_PUBLIC_*`

build variable | `aro-network/aro-official-website`

| `.github/workflows/static.yml:61-63`

| Any `NEXT_PUBLIC_*`

value in Next.js may be bundled client-side and visible publicly. Risk depends on whether `secrets.PUBLIC_KEY`

is truly public or sensitive. | Audit the secret value. If sensitive, rotate immediately and remove `NEXT_PUBLIC_`

exposure. If public config, store as non-secret repo variable. | P2 |

| 5 | MEDIUM | Next.js `15.0.3`

may be affected by known advisories | `aro-network/aro-official-website`

; `aro-network/aro-official-shop`

| `package.json`

| Potential exposure to Next.js vulnerabilities depending on deployment features like middleware/auth. Risk lower if static export, but should be upgraded before production/mainnet. | Upgrade Next.js to patched/latest version. Run dependency audit/Dependabot. Confirm middleware/auth usage. | P2 |

| 6 | MEDIUM | GitHub Actions supply-chain hardening gaps | `aro-network/aro-official-website`

| `.github/workflows/static.yml`

| Avoidable build/deploy supply-chain risk. Compromised action or dependency change could affect deployed site. | Apply least privilege per job. Pin third-party actions to commit SHA. Use `pnpm install --frozen-lockfile`

. Add dependency review/code scanning. | P2/P3 |

| 7 | LOW | `window.open(..., "_blank")`

without `noopener,noreferrer`

| `aro-network/aro-official-website`

| `src/app/components/AJoinWaitlist.tsx`

| Reverse tabnabbing/phishing risk in some browser conditions. Easy to fix. | Use `window.open(url, "_blank", "noopener,noreferrer")`

or `<a target="_blank" rel="noopener noreferrer">`

. | P3 |

| 8 | INFO | No obvious leaked private secrets found in quick public scan | Public repos sampled | Public GitHub code/files | Positive note. No immediate exposed `.env`

or private key patterns found in quick review, but not a complete secret audit. | Enable GitHub secret scanning/push protection. Run full repo history scan before mainnet. | Info |

- Fix
`lumii-harness`

permission bypass / hook enforcement. - Fix
`MerkleDistributor.withdraw()`

recipient bug. - Add insufficient-balance
`require`

to withdraw flows. - Audit
`NEXT_PUBLIC_PUBLIC_KEY`

/ GitHub Secret usage. - Upgrade Next.js.
- Harden GitHub Actions.
- Add tests and full audit before mainnet.