cosmos-vulnerability-scanner

cosmos vulnerability scanner

trailofbits 6.2k ↓ 3.8k CC-BY-SA-4.0 updated 28d ago

Claude Code

What it does

Auditing Cosmos SDK modules (custom x/ modules)
Reviewing CosmWasm smart contracts
Pre-launch security assessment of Cosmos chains
Investigating chain halt incidents
Pure Solidity/EVM audits without Cosmos SDK — use Solidity-specific tools
CometBFT consensus engine internals — this covers SDK modules, not the consensus layer itself
General Go code review with no blockchain context

Requirements & configuration

Critical (fund loss): signer mismatch, broken bookkeeping, AnteHandler bypass, bank keeper misuse, IBC token inflation, EVM/Cosmos desync, Merkle proof forgery, arithmetic overflow

Configuration: VULNERABILITY_PATTERNSSTATE_VULNERABILITY_PATTERNSADVANCED_VULNERABILITY_PATTERNSEVM_VULNERABILITY_PATTERNSIBC_VULNERABILITY_PATTERNSCOSMWASM_VULNERABILITY_PATTERNSFINDING_FILE

Derived from the skill's own SKILL.md documentation · extracted 2026-07-23

cosmos vulnerability scanner

Source

Repository: https://github.com/trailofbits/skills

cosmos-vulnerability-scanner FAQ

What does the cosmos-vulnerability-scanner skill do?

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x. Auditing Cosmos SDK modules (custom x/ modules) Reviewing CosmWasm smart contracts

What does cosmos-vulnerability-scanner require?

Critical (fund loss): signer mismatch, broken bookkeeping, AnteHandler bypass, bank keeper misuse, IBC token inflation, EVM/Cosmos desync, Merkle proof forgery, arithmetic overflow Configuration keys: VULNERABILITY_PATTERNS, STATE_VULNERABILITY_PATTERNS, ADVANCED_VULNERABILITY_PATTERNS, EVM_VULNERABILITY_PATTERNS, IBC_VULNERABILITY_PATTERNS, COSMWASM_VULNERABILITY_PATTERNS, FINDING_FILE.

How do I install cosmos-vulnerability-scanner?

Run: npx -y skills add https://github.com/trailofbits/skills --skill cosmos-vulnerability-scanner --agent claude-code — the source lives at github.com/trailofbits/skills.

Maintain cosmos-vulnerability-scanner?

Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.

[cosmos-vulnerability-scanner on getagentictools](https://getagentictools.com/skills/trailofbits-skills-cosmos-vulnerability-scanner?ref=badge)

npx agentictools info skills/trailofbits-skills-cosmos-vulnerability-scanner

The second line is the CLI lookup for this page — handy in READMEs and docs.