domains / families / security / cosmos-vulnerability-scanner

cosmos-vulnerability-scanner

separate

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

When to use

• Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents — each specializing in a vulnerability category — that return findings to the main…
• Auditing Cosmos SDK modules (custom `x/` modules)
• Reviewing CosmWasm smart contracts
• Pre-launch security assessment of Cosmos chains
• Investigating chain halt incidents

When not to use

• Pure Solidity/EVM audits without Cosmos SDK — use Solidity-specific tools
• CometBFT consensus engine internals — this covers SDK modules, not the consensus layer itself
• General Go code review with no blockchain context
• Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints)
• CosmWasm contract-only audits on chains without custom SDK modules — use the CosmWasm checklist items alone

Skill page

Source