CosmWasm
CosmWasm security review
CosmWasm is the smart contract platform on Cosmos chains. Hackerbane audits the contract entry points, the messages they accept, and who can migrate the code.
scope
What we review
We audit CosmWasm contracts on the chain they will run on. We read instantiate, execute, query, sudo, and migrate, plus the messages those entry points accept. Typical issues are an execute that skips the sender or attached funds, an admin migrate that rewrites authority, a reply that assumes a submessage succeeded, and IBC receive that unlocks on a channel the contract never approved.
Execute handlers that skip info.sender or the funds attached to the CosmWasm message.
Instantiate and migrate messages that trust a field, including admin migrate that rewrites stored authority.
Sudo entry points that perform privileged writes once the chain or governance calls them.
Reply and submessage handling that assumes success and never inspects the result.
IBC packet receive that mints or unlocks without checking the channel the packet arrived on.
Advanced Threat Detection
We built our own advanced threat detection stack that is more performant and cheaper than our competitors. We use a state-of-the-art AI harness coupled with world-class senior security engineers with proven experience finding vulnerabilities in well-tested software.
How we review this language
A CosmWasm review follows the same five-stage engagement as every Hackerbane audit. We start from instantiate, execute, query, sudo, and migrate, then read the CosmWasm messages, the admin migrate path, reply and submessages, and any IBC packets in scope.
Two senior engineers read the contract in parallel. cargo and clippy run across the crate. We write detectors for the sender, funds, and channel rules this contract actually uses, and we fuzz the execute, migrate, and IBC paths your unit tests never send.
Scope and threat model
We lock the contracts, the commit, the chain, the IBC connections, and who can execute, migrate, or upgrade, before the review starts.
Architecture and design review
We read the entry points, the reply flow, and the IBC handlers against that model to find flaws a line-by-line pass would miss.
Hybrid code and infrastructure review
Two senior engineers read the CosmWasm in parallel, backed by clippy, custom detectors, fuzzing, and cw-multi-test integration cases.
Exploitability and root-cause analysis
High and Critical findings ship with a proof of concept on the entry, migrate, or IBC path and the root cause, so the class of bug gets fixed, not only the instance.
Reporting and remediation
A prioritized report, a live walkthrough, and verification of every in-scope fix within the remediation window.
Tools and practices
We work in the crate you already build. cargo test and cw-multi-test stay in place. We add fuzz harnesses over the entry points and IBC handlers, then hand those artifacts back with the report.
What you get
Prioritized findings your engineers can ship against, each with root cause and a recommended fix.
Verifiable proofs of concept for High and Critical issues, including the migrate, reply, and IBC paths.
A report you can share with partners, exchanges, investors, and regulators.
Remediation verification and a final report that reflects the fixed state of the contract.
The fuzz harnesses and cw-multi-test cases written during the review.
How to prepare
| # | Before review starts |
|---|---|
| 01 | The crate builds and cargo test runs cleanly from a fresh checkout. |
| 02 | The target chain and its IBC connections are named. |
| 03 | Contract admin, migrate authority, and trusted channels are documented. |
| 04 | Core execute, sudo, reply, and IBC flows are covered by tests, and known limits are written down. |
| 05 | Scope is defined: which contracts, which commit, and which deployment. |
Other pages
Questions
- Do you review migrate and sudo, or only execute?
- Both. Migrate can rewrite storage and re-point admin, so we read who can call it, what the message trusts, and what state it leaves. Sudo is a privileged entry point only the chain or governance can hit; we still read what it does once it is called.
- How do you treat IBC packets?
- As untrusted input from another chain. We check which channels can mint or unlock, and whether ibc_packet_receive verifies the packet before the contract moves value.
- Is query in scope if it cannot change state?
- Yes, when a query result feeds an authorization decision or leaks privileged state. A read that looks harmless becomes a finding once another path uses it to decide who can act.
Next step
Request an audit
Share the CosmWasm crate (the Rust package), the chain it deploys to, and your timeline. We will propose an audit plan and estimate.