Which Cosmos SDK versions are compatible?

The skill is designed to work with modern Cosmos SDK projects, including those using legacy handlers and v0.47+ auto-registration patterns.

Can this skill help prevent blockchain halts?

Yes, it specifically scans for non-deterministic patterns, such as map iterations and platform-dependent types, which are the primary causes of consensus failure and chain halts.

What programming languages does this scanner support?

The scanner supports Go for Cosmos SDK modules and Rust for CosmWasm smart contracts, identifying specific patterns in each ecosystem.

Does it provide remediation advice?

Every vulnerability finding includes a detailed description, an attack scenario, and specific code recommendations to fix the identified issue.

Cosmos Vulnerability Scanner

Name: Cosmos Vulnerability Scanner
Author: trailofbits

bytrailofbits

•

2,992

•

Security & Testing

Scans Cosmos SDK and CosmWasm codebases for consensus-critical security vulnerabilities, non-determinism, and logic errors.

The Cosmos Vulnerability Scanner is a specialized security tool designed for developers and auditors working with Cosmos-based blockchains. It systematically analyzes Go-based Cosmos SDK modules and Rust-based CosmWasm smart contracts for 9 critical vulnerability patterns, including chain-halting non-determinism, authorization failures, and ABCI method panics. By identifying these platform-specific risks early, the skill helps prevent state divergence, fund loss, and consensus failures before code reaches production.

Key Features

012,992 GitHub stars

02Analyzes both Go (Cosmos SDK) and Rust (CosmWasm) source files.

03Identifies non-deterministic map iterations and platform-dependent types.

04Provides automated reports with file locations, impact analysis, and remediation code.

05Checks ABCI BeginBlocker and EndBlocker methods for unbounded execution or panic risks.

06Detects 9 critical Cosmos-specific vulnerability patterns like non-determinism and ABCI panics.

Use Cases

01Performing pre-launch security audits for custom Cosmos SDK zones and modules.

02Debugging and investigating the root causes of blockchain consensus halts or state root divergence.

03Reviewing CosmWasm smart contracts for authorization, validation, and reentrancy flaws.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add trailofbits/skills cosmos-vulnerability-scanner

For use in Claude.ai and ChatGPT

Download Skill