Cosmos Vulnerability Scanner

Cosmos Vulnerability Scanner — Update Log

Third Update (2026-03-18) — 8 Missing Bug Classes Added

Summary

Added 8 missing vulnerability classes identified from real-world Cosmos findings catalog. Skill now covers 28 VULNERABILITY_PATTERNS + 16 IBC patterns. No existing patterns were duplicated.

New Patterns in VULNERABILITY_PATTERNS.md

• §20 expanded: ROUNDING ERRORS → ARITHMETIC ERRORS. Added wrapping overflow (CWA-2024-002), wrong operand (Osmosis $5M), negative value validation (Barberry vesting poisoning)

• §22 expanded: Added CacheContext event leak pattern (Huckleberry — events persist after state rollback, enables bridge spoofing)

• §24 expanded: EVMOS/ETHERMINT-SPECIFIC → EVM/COSMOS STATE DESYNC. Full precompile atomicity section with 6 detection patterns from 7 findings ($7M+ real losses)

• §25 new: STORAGE KEY DESIGN FLAWS — string concatenation collisions, prefix iterator malleability, redelegation bypass

• §26 new: CONSENSUS VALIDATION GAPS — vote extension forgery (SEDA), block timestamp manipulation (CometBFT Tachyon), vesting on blocked addresses

• §27 new: CIRCUIT BREAKER AUTHZ BYPASS — x/circuit scope escalation

• §28 new: MERKLE PROOF / CRYPTOGRAPHIC VERIFICATION FLAWS — ICS-23 proof forgery (Dragonberry), IAVL RangeProof (Dragonfruit/$566M), ECDSA malleability (Gravity Bridge)

New Pattern in IBC_VULNERABILITY_PATTERNS.md

• §16 new: IBC REENTRANCY / CEI VIOLATIONS — OnTimeoutPacket reentrancy (ASA-2024-007, $150M+ at risk), Terra IBC hooks ($6.4M stolen)

SKILL.md Updates

• Updated description, Step 2 checklist, IBC reference count, and Priority Guidelines

Second Update (2026-03-06) — v0.53.x Re-validation + 4 New Patterns

Summary

Re-validated all 9 existing patterns against cosmos-sdk v0.53.x (commit 82fcb05ceb, CometBFT v0.38.21, cosmossdk.io/math v1.5.3, cosmossdk.io/collections v1.3.1). Added 4 new vulnerability patterns discovered during verification. Skill now covers 13 patterns.

Existing Pattern Corrections

Pattern 4.4 (Slow ABCI Methods):

• Added HasABCIEndBlock (returns []abci.ValidatorUpdate, error) as a second EndBlock interface alongside HasEndBlocker (returns error). Used by x/staking. The skill previously only mentioned one variant.

• Added HasPrecommit and HasPrepareCheckState as additional lifecycle hooks (confirmed in core/appmodule/module.go:42-53). These run after EndBlock and are potential DoS surfaces.

Pattern 4.5 (ABCI Panics):

• Added note about ValidateBasic() deprecation (types/tx_msg.go:102: "deprecated and now facultative"). This increases the likelihood of invalid inputs reaching panic-prone code in ABCI methods.

New Patterns Added

4.10 Unbounded Pagination / Query DoS (HIGH):

• types/query/pagination.go DefaultLimit=100 only applies when Limit==0. Any non-zero client-supplied limit is accepted without cap.

• Recent fix d9d77304fd partially addressed this in x/auth/tx and x/bank/keeper/genesis.go, but core pagination still lacks a hard maximum.

4.11 Event Override / Suppression (MEDIUM):

• New EventManager.OverrideEvents() method added in commit 2ddb9ac0a9 (types/events.go:63). Replaces all previously emitted events.

• If called in module code, can silently suppress events from auth, bank, IBC — breaking indexers and relayers.

4.12 Unordered Transaction Replay (HIGH):

• SDK v0.53 supports TxBody.Unordered=true with timestamp-based replay protection.

• Configurable via WithMaxUnorderedTxTimeoutDuration (default 10min) and WithUnorderedTxGasCost (default 2240).

• x/auth PreBlocker handles RemoveExpiredUnorderedNonces cleanup.

• Risks: insufficient timeout, nonce flooding DoS, ordering assumptions in app logic.

4.13 Missing msg_server Validation (HIGH):

• ValidateBasic() is now deprecated and facultative (types/tx_msg.go:102).

• Modules migrating away from ValidateBasic may forget to add equivalent validation in msg_server.go handlers.

• Authority/signer checks must be in the handler, not just in the removed ValidateBasic.

Verification Notes

All patterns confirmed against the live codebase:

• sdk.Msg = proto.Message (types/tx_msg.go:19) — confirmed

• 0 GetSigners() []AccAddress methods in x/ — confirmed (only LegacyMsg interface defines it)

• 74 cosmos.msg.v1.signer annotations across 22 proto files — confirmed

• appmodule.HasBeginBlocker, HasEndBlocker, HasPreBlocker in core/appmodule/module.go:65-89 — confirmed

• module.HasABCIEndBlock in types/module/module.go:237-241 — confirmed (different return type!)

• appmodule.HasPrecommit, HasPrepareCheckState in core/appmodule/module.go:42-53 — confirmed

• x/auth/module.go and x/upgrade/module.go implement PreBlock — confirmed

• time.Now() only in test files under x/, not consensus code — confirmed

• go func only in generated pb.gw.go files under x/ — confirmed

• blockedAddrs mechanism in x/bank/keeper/keeper.go — confirmed

• QuoTruncate/QuoRoundUp on math.LegacyDec in math/legacy_dec.go — confirmed

• No handler.go files for legacy SDK handler pattern under x/ — confirmed

• 22 modules under x/ (no x/accounts in this version) — confirmed

• collections framework used extensively (81+ occurrences in keeper.go files) — confirmed

First Update (2026-03-06)

Context

The skill's vulnerability patterns were written for Cosmos SDK ~v0.46 and had not been updated for the breaking changes in v0.47–v0.53. The current cosmos-sdk codebase (v0.53.x, Go 1.23, cosmossdk.io/math v1.5.3) was used as the reference for validation.

1. Mismatched Pattern Summary in SKILL.md

Problem: SKILL.md:98–109 Section 5 listed 9 CosmWasm-specific patterns (Missing Denom Validation, Reentrancy via Submessages, etc.) that did not correspond to the actual 9 Cosmos SDK patterns defined in VULNERABILITY_PATTERNS.md. The summary and the resource file described completely different vulnerability classes.

Fix: Replaced the summary to accurately reflect the 9 patterns in the resource file.

2. Pattern 4.1 — GetSigners: Rewritten for Proto Annotations

Problem: The pattern described GetSigners() []sdk.AccAddress as a method on message types. This interface was removed in SDK v0.47. In the current codebase:

• sdk.Msg is just proto.Message — types/tx_msg.go:19

• No func.*GetSigners.*[]sdk.AccAddress methods exist anywhere in x/

• Signers are declared via cosmos.msg.v1.signer proto annotations — e.g. proto/cosmos/gov/v1/tx.proto:60

• Resolution happens in x/tx/signing — x/tx/signing/context.go:358 (func (c *Context) GetSigners)

Fix: Rewrote pattern to describe the modern vulnerability: mismatch between cosmos.msg.v1.signer proto annotation and the field actually used for authorization in msg_server.go. Added detection patterns for wrong field annotation and proto vs handler mismatch.

3. Pattern 4.2 — Non-Determinism: Math Type References Updated

Problem: Pattern referenced sdk.Int, sdk.Dec, sdk.NewDec() which are removed/deprecated. The codebase uses:

• math.Int / math.NewInt() from cosmossdk.io/math — 186+ occurrences across x/ modules

• math.LegacyDec / math.LegacyNewDec() — 83+ occurrences across x/ modules

• Zero occurrences of sdk.NewInt() or sdk.NewDec() in x/ Go source (only in legacy tests via type aliases)

Fix: Updated all type references: sdk.Int → math.Int, sdk.Dec → math.LegacyDec.

4. Pattern 4.3 — Message Priority: Updated for ABCI 2.0

Problem: Pattern only discussed CheckTx priority. SDK v0.50 introduced ABCI 2.0 with PrepareProposal and ProcessProposal (267 occurrences in baseapp/), which give the block proposer direct control over transaction ordering.

Fix: Added PrepareProposal/ProcessProposal as the primary mechanism for transaction priority. Updated code examples.

Evidence: baseapp/abci.go — FinalizeBlock, PrepareProposal, ProcessProposal are the ABCI 2.0 entry points. DeliverTx still exists internally but is called within FinalizeBlock.

5. Pattern 4.4 — Slow ABCI Methods: Updated Interfaces

Problem: Pattern used standalone BeginBlocker(ctx sdk.Context, k keeper.Keeper) function signatures. In SDK v0.50+, modules implement interfaces:

• appmodule.HasBeginBlocker — method BeginBlock(context.Context) error

• appmodule.HasEndBlocker — method EndBlock(context.Context) error

• Module manager calls these via types/module/module.go:776–825

• PreBlocker is new (40 occurrences in codebase)

Evidence:

x/mint/module.go:     _ appmodule.HasBeginBlocker = AppModule{}
x/staking/module.go:  _ appmodule.HasBeginBlocker = AppModule{}
x/gov/module.go:      _ appmodule.HasEndBlocker   = AppModule{}
x/feegrant/module.go: _ appmodule.HasEndBlocker   = AppModule{}

Fix: Updated all code examples to use func (am AppModule) BeginBlock(ctx context.Context) error and EndBlock signatures. Added PreBlock as a new attack surface. Updated checklist.

6. Pattern 4.5 — ABCI Panics: Updated Types and Deprecated Params

Problem: Two sub-issues:

1. Math types: Pattern used sdk.NewDec(), sdk.NewInt(). Current SDK uses math.NewInt(), math.LegacyNewDecFromStr(), and panic-prone Must* variants like math.LegacyMustNewDecFromStr().

2. SetParamSet: Pattern described SetParamSet panics. The entire x/params module is deprecated:

   • x/params/module.go:61: "Deprecated: the params module is deprecated and will be removed in the next Cosmos SDK major release."

   • x/params/keeper/keeper.go:15: keeper also deprecated

   • Modern modules store params directly in keeper state via collections

Fix: Updated math type references. Replaced SetParamSet panic pattern with direct keeper param storage pattern. Added Must* variant warning as a new detection pattern.

7. Pattern 4.7 — Rounding Errors: Updated Types

Problem: All references used sdk.Dec, sdk.NewDec(), sdk.ZeroDec(). These are gone.

Evidence: QuoTruncate and QuoRoundUp still exist on math.LegacyDec — math/legacy_dec.go (5 occurrences of QuoTruncate/QuoCeil in codebase). The vulnerability pattern itself is still valid.

Fix: Updated all type references to math.LegacyDec, math.LegacyNewDec(), math.LegacyZeroDec().

8. Pattern 4.8 — Unregistered Handler: Marked Legacy Only

Problem: Pattern described NewHandler / sdk.Handler switch-case pattern. This is completely gone from the SDK:

• Zero handler.go files exist under x/

• Zero matches for NewHandler or sdk.Handler in Go files under x/

• All 16 modules use msg_server.go with protobuf service registration:

  Copy

  x/auth/keeper/msg_server.go
  x/bank/keeper/msg_server.go
  x/gov/keeper/msg_server.go
  x/staking/keeper/msg_server.go
  ... (16 total)

Fix: Marked pattern as legacy-only (pre-v0.47). Added modern equivalent: stub/no-op msg_server.go implementations where a proto RPC method is technically implemented but does nothing. The Go compiler catches missing methods (unlike the old switch-case), but stub implementations are still a risk.

9. Scanning Workflow: Updated Throughout

Changes in SKILL.md Section 6:

Quick Reference Checklist updated similarly — signer check now references proto annotations, ABCI check includes PreBlock, testing uses FinalizeBlock.

Files Modified

• SKILL.md — Full rewrite of sections 3, 5, 6, 7, 9, 10, 11

• resources/VULNERABILITY_PATTERNS.md — All 9 patterns updated

Validation Method

Each pattern was validated against the cosmos-sdk codebase against cosmos-sdk (v0.53.x, commit 82fcb05ceb) using grep/glob searches to confirm:

• Which interfaces/types still exist

• Which have been removed or deprecated

• What replaced them

• Occurrence counts to verify patterns are real