Reviewing Cosmos And Ibc

Name: Reviewing Cosmos And Ibc
Author: nuroctane

ASecurity

Review Cosmos SDK modules, IBC (ICS-20/23), ibc-hooks, CosmWasm submessages, Authz, Ante/fees. Use for appchains and IBC-connected DeFi. Lawful/in-scope only.

3 stars
0 votes
0 copies
2 views
Added September 2, 2026

ai-agentsgo

Works with

Security analysis

A100/100

Scanned September 2, 2026

npx -y skills add nuroctane/nur-cli --skill reviewing-cosmos-and-ibc --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Reviewing Cosmos And Ibc?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Reviewing Cosmos And Ibc

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nuroctane-reviewing-cosmos-and-ibc/badge)](https://www.skillsdirectory.com/skills/nuroctane-reviewing-cosmos-and-ibc)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: reviewing-cosmos-and-ibc
description: "Review Cosmos SDK modules, IBC (ICS-20/23), ibc-hooks, CosmWasm submessages, Authz, Ante/fees. Use for appchains and IBC-connected DeFi. Lawful/in-scope only."
---

# Reviewing Cosmos and IBC

In-scope Go modules / CosmWasm contracts only. Use simapp or cw-multi-test. Never forge live light-client proofs.

Historical: `historical-smart-contract-vulns` `references/move-cosmos-cairo.md` (Dragonberry, ASA-2024-007, Cronos fees, Evmos, Sei, Axelar halt).

## ICS-20

Minted vouchers cannot exceed escrow (`C01`). Denom trace cannot be spoofed into a native.

## ICS-23 / light client

`ibc-go` / `ics23` versions include the Dragonberry-era fixes (`C02`). If a fork is behind, that is the finding. Do not ship a proof-forger.

## ibc-hooks and CosmWasm

Timeout / ack / `reply` cannot re-enter mint (`C03`). Submessages: same conservation as Solidity CEI.

## Authz and Ante

Grants are least privilege (`C04`). Fee/Ante cannot steal the current block's fees (`C05`, Cronos analog).

## Output

`(msg_type, invariant, C0x, simapp test idea)`. Next: `reviewing-bridges-and-messaging` if there is also an EVM gateway.

## Paid bounty analogs

| $ | Protocol | Pack | Whitehat |
|---|----------|------|----------|
| **$2M+$75k** | Sei chain/module | O04 | usmannk, Catchme |
| $150k | Evmos docs vs impl | O04 | jayjonah.eth |
| $50k | Axelar halt | C01 | Marco Nunes |
| $50k | Injective 2026 X | O04 | f4lc0n (confirm Immunefi) |
| $40k | Cronos tx-fee theft | C05 | zb3 |

BNB IAVL $586M is a **hack** (C02). Dragonberry is a library patch, not a payout row.