cosmos-vulnerability-scanner

Search consensus-critical code for map iteration, platform-dependent types like int and float64, goroutines, select statements, rand, and time.Now(). The skill provides grep commands and CodeQL guidance, plus mitigations such as sorting map keys and using ctx.BlockTime().

Prioritize non-determinism, ABCI method panics, slow BeginBlocker or EndBlocker loops, and incorrect GetSigners, since these can halt the chain. Then check missing error handling on bankKeeper.SendCoins, broken bookkeeping versus x/bank, and rounding errors in sdk.Dec arithmetic.

Yes, it detects CosmWasm projects via Rust files with cosmwasm_std imports and entry_point functions. The referenced pattern list covers CosmWasm issues like missing denom validation, improper reply handling, IBC packet validation, and reentrancy via submessages.

Chain halts in EndBlocker usually come from panics in sdk.NewCoin or sdk.NewDec operations, division by zero, or unbounded iterations exceeding block time. Validate inputs before panic-prone SDK calls, bound batch sizes, and benchmark with maximum expected state.

Static pattern matching cannot confirm exploitability or catch all logic bugs, so manual review remains critical for consensus issues. The skill recommends complementing scans with cross-architecture builds, fuzz testing, ABCI benchmarks, and invariant checks in CI.