Cosmos Vulnerability Scanner

// VULNERABLE: Iterating over Go map (random order)
assets := make(map[string]sdk.Coin)
for assetID, coin := range assets {  // NON-DETERMINISTIC!
    keeper.ProcessAsset(ctx, assetID, coin)
}

// VULNERABLE: Platform-dependent integer types
var amount int   // Size differs: 32-bit vs 64-bit systems
var price float64  // Float arithmetic is non-deterministic

// Serialization produces different bytes on different architectures
bz := someSerializer(amount)  // Different on 32-bit vs 64-bit!

// VULNERABLE: Goroutines have non-deterministic execution order
go processTransaction(tx1)
go processTransaction(tx2)
// Order of state updates is non-deterministic!

// VULNERABLE: Select with multiple ready channels
select {
case msg := <-ch1:  // Non-deterministic choice
    process(msg)
case msg := <-ch2:
    process(msg)
}

// VULNERABLE: Other non-determinism sources
rand.Intn(100)              // Random numbers
time.Now()                  // Local system time (use ctx.BlockTime())
&obj                        // Memory addresses
json.Marshal(map)           // Map serialization order
filepath.Walk()             // Filesystem traversal order

// SECURE: Deterministic iteration
// Option 1: Sort map keys
keys := make([]string, 0, len(assets))
for k := range assets {
    keys = append(keys, k)
}
sort.Strings(keys)  // Deterministic order
for _, k := range keys {
    keeper.ProcessAsset(ctx, k, assets[k])
}

// Option 2: Use ordered data structure (sdk.KVStore with ordered iteration)

// SECURE: Platform-independent types
var amount int64          // Explicit 64-bit
var amount math.Int       // Arbitrary precision integer (cosmossdk.io/math)
var price math.LegacyDec // Decimal type for consensus (cosmossdk.io/math)

// SECURE: Use block time, not system time
timestamp := ctx.BlockTime()  // Deterministic
height := ctx.BlockHeight()   // Deterministic

// VULNERABLE: Unbounded loop in EndBlocker (v0.50+ style)
func (am AppModule) EndBlock(ctx context.Context) error {
    sdkCtx := sdk.UnwrapSDKContext(ctx)
    // Iterates over ALL users - could be millions!
    am.keeper.IterateAllUsers(sdkCtx, func(user User) bool {
        reward := am.keeper.CalculateReward(sdkCtx, user)
        am.keeper.DistributeReward(sdkCtx, user, reward)
        return false
    })
    return nil
}

// VULNERABLE: Nested loops in BeginBlocker
func (am AppModule) BeginBlock(ctx context.Context) error {
    sdkCtx := sdk.UnwrapSDKContext(ctx)
    pools := am.keeper.GetAllPools(sdkCtx)        // 1000+ pools
    for _, pool := range pools {
        assets := am.keeper.GetPoolAssets(sdkCtx, pool.ID)  // 100+ assets each
        for _, asset := range assets {
            am.keeper.UpdatePrice(sdkCtx, pool, asset)  // Expensive calculation
        }
    }
    return nil
}

// VULNERABLE: Unbounded PreBlocker
func (am AppModule) PreBlock(ctx context.Context) error {
    // No limit on processing!
    am.keeper.ProcessAllPending(ctx)
    return nil
}

// SECURE: Process limited batch per block (v0.50+ style)
func (am AppModule) EndBlock(ctx context.Context) error {
    sdkCtx := sdk.UnwrapSDKContext(ctx)
    maxProcessed := 100  // Process max 100 users per block

    iterator := am.keeper.GetUnprocessedUsers(sdkCtx)
    defer iterator.Close()

    count := 0
    for ; iterator.Valid() && count < maxProcessed; iterator.Next() {
        user := am.keeper.UnmarshalUser(iterator.Value())
        reward := am.keeper.CalculateReward(sdkCtx, user)
        am.keeper.DistributeReward(sdkCtx, user, reward)
        am.keeper.MarkProcessed(sdkCtx, user)
        count++
    }
    // Remaining users processed in subsequent blocks
    return nil
}

func BenchmarkEndBlocker(b *testing.B) {
    ctx := setupMaximumState()  // 1M users, 10K pools, etc.
    b.ResetTimer()
    for i := 0; i < b.N; i++ {
        am.EndBlock(ctx)
    }
    // Must complete in < 1 second
}

// VULNERABLE: NewCoins panics on invalid coins
func (am AppModule) EndBlock(ctx context.Context) error {
    sdkCtx := sdk.UnwrapSDKContext(ctx)
    // Panics if amount is negative or denom is invalid!
    coins := sdk.NewCoins(sdk.NewCoin(userDenom, math.NewInt(userAmount)))
    am.keeper.MintCoins(sdkCtx, coins)
    return nil
}

// VULNERABLE: Coin arithmetic panics
reward := sdk.NewCoin("uatom", math.NewInt(-100))  // PANIC: negative amount

// VULNERABLE: math.LegacyNewDecFromStr panics on invalid string
func (am AppModule) BeginBlock(ctx context.Context) error {
    price, err := math.LegacyNewDecFromStr(priceString)  // Returns error, but...
    // If using the non-error variant:
    price := math.LegacyMustNewDecFromStr(priceString)    // PANIC if invalid!
}

// VULNERABLE: Division by zero
ratio := amount.Quo(math.ZeroInt())  // PANIC!

// PITFALL: Using pointer to Dec is error-prone
var price *math.LegacyDec  // Unnecessary pointer — LegacyDec is already a single pointer internally
// Dec consists of a single big.Int pointer — pointer-to-pointer adds indirection with no performance benefit
// and introduces nil-pointer dereference risk

// VULNERABLE: Setting params without validation
// In v0.50+, modules store params directly in keeper state
func (k Keeper) SetParams(ctx context.Context, params Params) error {
    // If params are not validated before storage, invalid state can cause
    // panics later when params are read and used in calculations
    return k.Params.Set(ctx, params)
}

// VULNERABLE: No bounds checking
func processValidators(validators []Validator) {
    top := validators[0]  // PANIC if empty slice!
}

// SECURE: Validate before panic-prone operations
func (am AppModule) EndBlock(ctx context.Context) error {
    sdkCtx := sdk.UnwrapSDKContext(ctx)

    if err := sdk.ValidateDenom(userDenom); err != nil {
        sdkCtx.Logger().Error("invalid denom", "error", err)
        return nil
    }
    if userAmount.IsNegative() {
        sdkCtx.Logger().Error("negative amount")
        return nil
    }

    coins := sdk.NewCoins(sdk.NewCoin(userDenom, userAmount))
    am.keeper.MintCoins(sdkCtx, coins)
    return nil
}

// SECURE: Use safe constructors
func (k Keeper) UpdatePrice(ctx context.Context, priceStr string) error {
    price, err := math.LegacyNewDecFromStr(priceStr)
    if err != nil {
        return err
    }

    if divisor.IsZero() {
        return errors.New("division by zero")
    }
    ratio := amount.Quo(divisor)
    return nil
}

// In tx.proto
message MsgTransferOwnership {
  option (cosmos.msg.v1.signer) = "sender";  // "sender" is the verified signer

  string sender = 1;
  string new_owner = 2;
}

// In msg_server.go - VULNERABLE: uses new_owner for authorization instead of sender
func (ms msgServer) TransferOwnership(ctx context.Context, msg *types.MsgTransferOwnership) (*types.MsgTransferOwnershipResponse, error) {
    // BUG: authorizing based on new_owner, not the verified sender!
    if !ms.IsAdmin(ctx, msg.NewOwner) {
        return nil, errors.ErrUnauthorized
    }
    // ...
}

// VULNERABLE: signer annotation points to wrong field
message MsgExecute {
  option (cosmos.msg.v1.signer) = "authority";  // Should be "sender"

  string sender = 1;     // actual tx signer
  string authority = 2;  // module authority, not tx signer
}

message MsgDelegate {
  option (cosmos.msg.v1.signer) = "delegator";

  string delegator = 1;
  string validator = 2;
  string beneficiary = 3;  // If handler uses this instead of delegator...
}

// SECURE: Single clear signer field
message MsgExample {
  option (cosmos.msg.v1.signer) = "sender";
  string sender = 1;  // Only address field used for authorization
}

// SECURE: msg_server uses the annotated signer field
func (ms msgServer) Example(ctx context.Context, msg *types.MsgExample) (*types.MsgExampleResponse, error) {
    // Use msg.Sender - the field declared in cosmos.msg.v1.signer
    if err := ms.authorize(ctx, msg.Sender); err != nil {
        return nil, err
    }
    // ...
}

// VULNERABLE: ValidateBasic removed but no validation in handler
// types/msgs.go - ValidateBasic was here but got removed during migration

// msg_server.go - No validation of inputs
func (ms msgServer) UpdateParams(ctx context.Context, msg *types.MsgUpdateParams) (*types.MsgUpdateParamsResponse, error) {
    // No check on msg.Authority
    // No check on msg.Params fields
    return &types.MsgUpdateParamsResponse{}, ms.Params.Set(ctx, msg.Params)
}

// VULNERABLE: HasValidateBasic implemented but handler also needs validation
// types/msgs.go
func (msg *MsgTransfer) ValidateBasic() error {
    // Only checks basic format — NOT authorization or business logic
    return nil
}

// msg_server.go - Relies entirely on ValidateBasic, no handler-level checks
func (ms msgServer) Transfer(ctx context.Context, msg *types.MsgTransfer) (*types.MsgTransferResponse, error) {
    // Missing: check that msg.Amount is positive
    // Missing: check that sender has sufficient funds
    // Missing: authorization check against cosmos.msg.v1.signer
    return ms.executeTransfer(ctx, msg)
}

// SECURE: Full validation in msg_server.go handler
func (ms msgServer) UpdateParams(ctx context.Context, msg *types.MsgUpdateParams) (*types.MsgUpdateParamsResponse, error) {
    if ms.authority != msg.Authority {
        return nil, errorsmod.Wrapf(govtypes.ErrInvalidSigner, "invalid authority; expected %s, got %s", ms.authority, msg.Authority)
    }
    if err := msg.Params.Validate(); err != nil {
        return nil, err
    }
    return &types.MsgUpdateParamsResponse{}, ms.Params.Set(ctx, msg.Params)
}

// VULNERABLE: Ignored error from SendCoins
func (k Keeper) Withdraw(ctx context.Context, user string, amount sdk.Coins) {
    // Error ignored! Withdrawal appears successful even if SendCoins fails
    k.bankKeeper.SendCoins(ctx, moduleAccount, user, amount)

    // Update state assuming withdrawal succeeded
    k.DecrementBalance(ctx, user, amount)
}

// VULNERABLE: Deferred error handling too late
func (k Keeper) ProcessBatch(ctx context.Context, txs []Transaction) {
    for _, tx := range txs {
        err := k.ProcessTransaction(ctx, tx)
        // Error not checked, continues processing!
    }
}

// SECURE: Check all errors
func (k Keeper) Withdraw(ctx context.Context, user string, amount sdk.Coins) error {
    if err := k.bankKeeper.SendCoins(ctx, moduleAccount, user, amount); err != nil {
        return err
    }
    k.DecrementBalance(ctx, user, amount)
    return nil
}

// SECURE: Stop processing on first error
func (k Keeper) ProcessBatch(ctx context.Context, txs []Transaction) error {
    for _, tx := range txs {
        if err := k.ProcessTransaction(ctx, tx); err != nil {
            return fmt.Errorf("transaction failed: %w", err)
        }
    }
    return nil
}

# .golangci.yml
linters:
  enable:
    - errcheck
    - goerr113

linters-settings:
  errcheck:
    check-blank: true
    check-type-assertions: true

// msg_server.go - Message type defined in proto but method not implemented
type msgServer struct {
    Keeper
}

var _ types.MsgServer = msgServer{}

// If a method is declared in the proto service but the Go implementation
// is missing or returns a nil/empty response, the compiler will catch
// missing methods (unlike the legacy switch-case), but the implementation
// could still be a no-op stub.

func (ms msgServer) Withdraw(ctx context.Context, msg *types.MsgWithdraw) (*types.MsgWithdrawResponse, error) {
    // VULNERABLE: Stub implementation that does nothing
    return &types.MsgWithdrawResponse{}, nil
}

// VULNERABLE: AnteHandler only checks outer message type
func (d MyDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
    for _, msg := range tx.GetMsgs() {
        // Only checks msg type — does NOT recurse into MsgExec.Msgs!
        if _, ok := msg.(*types.MsgDangerous); ok {
            return ctx, errors.New("blocked")
        }
    }
    return next(ctx, tx, simulate)
}

// SECURE: Recurse into nested messages
func (d MyDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
    for _, msg := range tx.GetMsgs() {
        if err := d.checkMsg(msg); err != nil {
            return ctx, err
        }
    }
    return next(ctx, tx, simulate)
}

func (d MyDecorator) checkMsg(msg sdk.Msg) error {
    if _, ok := msg.(*types.MsgDangerous); ok {
        return errors.New("blocked")
    }
    if exec, ok := msg.(*authz.MsgExec); ok {
        for _, inner := range exec.Msgs {
            var innerMsg sdk.Msg
            if err := d.cdc.UnpackAny(inner, &innerMsg); err != nil {
                return err
            }
            if err := d.checkMsg(innerMsg); err != nil {  // Recurse
                return err
            }
        }
    }
    return nil
}