[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DSNRC7K35APEBNNVWRGHWG":3,"skill-same:01M6DSNRC7K35APEBNNVWRGHWG":61},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":29,"linkOnly":30,"markdownContent":31,"markdownBody":32,"frontMatter":33,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":40,"install":41,"resources":54},"01M6DSNRC7K35APEBNNVWRGHWG","cosmos-vulnerability-scanner",null,"Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts.","AntifragileTech\u002Fantifragile-claude-code","AntifragileTech","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F174357194?v=4","01M6DQCYMK4CDSQQAN0ZC72NTV","01M6DQCYS9YPW1WKMQ5TJMPQ43",9,"MIT","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fcosmos-vulnerability-scanner\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28],"vulnerability","vulnerability scanner","scanner","cosmos","cosmos vulnerability scanner","sdk","vulnerabilities","consensus","use","contracts","critical","2026-11-10 10:12:30",false,"---\nname: cosmos-vulnerability-scanner\ndescription: Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts.\n---\n\n# Cosmos Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Cosmos SDK blockchain modules and CosmWasm smart contracts for platform-specific security vulnerabilities that can cause chain halts, consensus failures, or fund loss. This skill encodes 9 critical vulnerability patterns unique to Cosmos-based chains.\n\n## 2. When to Use This Skill\n\n- Auditing Cosmos SDK modules (custom x\u002F modules)\n- Reviewing CosmWasm smart contracts (Rust)\n- Pre-launch security assessment of Cosmos chains\n- Investigating chain halt incidents\n- Validating consensus-critical code changes\n- Reviewing ABCI method implementations\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Go files**: `.go`, `.proto`\n- **CosmWasm**: `.rs` (Rust with cosmwasm imports)\n\n### Language\u002FFramework Markers\n```go\n\u002F\u002F Cosmos SDK indicators\nimport (\n    \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Ftypes\"\n    sdk \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Ftypes\"\n    \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Fx\u002F...\"\n)\n\n\u002F\u002F Common patterns\nkeeper.Keeper\nsdk.Msg, GetSigners()\nBeginBlocker, EndBlocker\nCheckTx, DeliverTx\nprotobuf service definitions\n```\n\n```rust\n\u002F\u002F CosmWasm indicators\nuse cosmwasm_std::*;\n#[entry_point]\npub fn execute(deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)\n```\n\n### Project Structure\n- `x\u002Fmodulename\u002F` - Custom modules\n- `keeper\u002Fkeeper.go` - State management\n- `types\u002Fmsgs.go` - Message definitions\n- `abci.go` - BeginBlocker\u002FEndBlocker\n- `handler.go` - Message handlers (legacy)\n\n### Tool Support\n- **CodeQL**: Custom rules for non-determinism and panics\n- **go vet**, **golangci-lint**: Basic Go static analysis\n- **Manual review**: Critical for consensus issues\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Cosmos SDK modules\n2. **Analyze each module** for the 9 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check message handlers** for validation issues\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== COSMOS SDK VULNERABILITY SCAN RESULTS ===\n\nProject: my-cosmos-chain\nFiles Scanned: 6 (.go)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Incorrect GetSigners()\n\n---\n\n## 5. Vulnerability Patterns (9 Patterns)\n\nI check for 9 critical vulnerability patterns unique to CosmWasm. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Denom Validation** ⚠️ CRITICAL - Accepting arbitrary token denoms\n2. **Insufficient Authorization** ⚠️ CRITICAL - Missing sender\u002Fadmin validation\n3. **Missing Balance Check** ⚠️ HIGH - Not verifying sufficient balances\n4. **Improper Reply Handling** ⚠️ HIGH - Unsafe submessage reply processing\n5. **Missing Reply ID Check** ⚠️ MEDIUM - Not validating reply IDs\n6. **Improper IBC Packet Validation** ⚠️ CRITICAL - Unvalidated IBC packets\n7. **Unvalidated Execute Message** ⚠️ HIGH - Missing message validation\n8. **Integer Overflow** ⚠️ HIGH - Unchecked arithmetic operations\n9. **Reentrancy via Submessages** ⚠️ MEDIUM - State changes before submessages\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Identify Cosmos SDK version (`go.mod`)\n2. Locate custom modules (`x\u002F*\u002F`)\n3. Find ABCI methods (`abci.go`, BeginBlocker, EndBlocker)\n4. Identify message types (`types\u002Fmsgs.go`, `.proto`)\n\n### Step 2: Critical Path Analysis\nFocus on consensus-critical code:\n- BeginBlocker \u002F EndBlocker implementations\n- Message handlers (execute, DeliverTx)\n- Keeper methods that modify state\n- CheckTx priority logic\n\n### Step 3: Non-Determinism Sweep\n**This is the highest priority check for Cosmos chains.**\n\n```bash\n# Search for non-deterministic patterns\ngrep -r \"range.*map\\[\" x\u002F\ngrep -r \"\\bint\\b\\|\\buint\\b\" x\u002F | grep -v \"int32\\|int64\\|uint32\\|uint64\"\ngrep -r \"float32\\|float64\" x\u002F\ngrep -r \"go func\\|go routine\" x\u002F\ngrep -r \"select {\" x\u002F\ngrep -r \"time.Now()\" x\u002F\ngrep -r \"rand\\.\" x\u002F\n```\n\nFor each finding:\n1. Verify it's in consensus-critical path\n2. Confirm it causes non-determinism\n3. Assess severity (chain halt vs data inconsistency)\n\n### Step 4: ABCI Method Analysis\nReview BeginBlocker and EndBlocker:\n- [ ] Computational complexity bounded?\n- [ ] No unbounded iterations?\n- [ ] No nested loops over large collections?\n- [ ] Panic-prone operations validated?\n- [ ] Benchmarked with maximum state?\n\n### Step 5: Message Validation\nFor each message type:\n- [ ] GetSigners() address matches handler usage?\n- [ ] All error returns checked?\n- [ ] Priority set in CheckTx if critical?\n- [ ] Handler registered (or using v0.47+ auto-registration)?\n\n### Step 6: Arithmetic & Bookkeeping\n- [ ] sdk.Dec operations use multiply-before-divide?\n- [ ] Rounding favors protocol over users?\n- [ ] Custom bookkeeping synchronized with x\u002Fbank?\n- [ ] Invariant checks in place?\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Non-Deterministic Map Iteration in EndBlocker\n\n**Location**: `x\u002Fdex\u002Fabci.go:45-52`\n\n**Description**:\nThe EndBlocker iterates over an unordered map to distribute rewards, causing different validators to process users in different orders and produce different state roots. This will halt the chain when validators fail to reach consensus.\n\n**Vulnerable Code**:\n```go\n\u002F\u002F abci.go, line 45\nfunc EndBlocker(ctx sdk.Context, k keeper.Keeper) {\n    rewards := k.GetPendingRewards(ctx)  \u002F\u002F Returns map[string]sdk.Coins\n    for user, amount := range rewards {  \u002F\u002F NON-DETERMINISTIC ORDER\n        k.bankKeeper.SendCoins(ctx, moduleAcc, user, amount)\n    }\n}\n```\n\n**Attack Scenario**:\n1. Multiple users have pending rewards\n2. Different validators iterate in different orders due to map randomization\n3. If any reward distribution fails mid-iteration, state diverges\n4. Validators produce different app hashes\n5. Chain halts - cannot reach consensus\n\n**Recommendation**:\nSort map keys before iteration:\n```go\nfunc EndBlocker(ctx sdk.Context, k keeper.Keeper) {\n    rewards := k.GetPendingRewards(ctx)\n\n    \u002F\u002F Collect and sort keys for deterministic iteration\n    users := make([]string, 0, len(rewards))\n    for user := range rewards {\n        users = append(users, user)\n    }\n    sort.Strings(users)  \u002F\u002F Deterministic order\n\n    \u002F\u002F Process in sorted order\n    for _, user := range users {\n        k.bankKeeper.SendCoins(ctx, moduleAcc, user, rewards[user])\n    }\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcosmos\u002Fnon_determinism\n- Cosmos SDK docs: Determinism\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical - CHAIN HALT Risk\n- Non-determinism (any form)\n- ABCI method panics\n- Slow ABCI methods\n- Incorrect GetSigners (allows unauthorized actions)\n\n### High - Fund Loss Risk\n- Missing error handling (bankKeeper.SendCoins)\n- Broken bookkeeping (accounting mismatch)\n- Missing message priority (oracle\u002Femergency messages)\n\n### Medium - Logic\u002FDoS Risk\n- Rounding errors (protocol value leakage)\n- Unregistered message handlers (functionality broken)\n\n---\n\n## 8. Testing Recommendations\n\n### Non-Determinism Testing\n```bash\n# Build for different architectures\nGOARCH=amd64 go build\nGOARCH=arm64 go build\n\n# Run same operations, compare state roots\n# Must be identical across architectures\n\n# Fuzz test with concurrent operations\ngo test -fuzz=FuzzEndBlocker -parallel=10\n```\n\n### ABCI Benchmarking\n```go\nfunc BenchmarkBeginBlocker(b *testing.B) {\n    ctx := setupMaximalState()  \u002F\u002F Worst-case state\n    b.ResetTimer()\n\n    for i := 0; i \u003C b.N; i++ {\n        BeginBlocker(ctx, keeper)\n    }\n\n    \u002F\u002F Must complete in \u003C 1 second\n    require.Less(b, b.Elapsed()\u002Ftime.Duration(b.N), time.Second)\n}\n```\n\n### Invariant Testing\n```go\n\u002F\u002F Run invariants in integration tests\nfunc TestInvariants(t *testing.T) {\n    app := setupApp()\n\n    \u002F\u002F Execute operations\n    app.DeliverTx(...)\n\n    \u002F\u002F Check invariants\n    _, broken := keeper.AllInvariants()(app.Ctx)\n    require.False(t, broken, \"invariant violation detected\")\n}\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcosmos\u002F`\n- **Cosmos SDK Docs**: https:\u002F\u002Fdocs.cosmos.network\u002F\n- **CodeQL for Go**: https:\u002F\u002Fcodeql.github.com\u002Fdocs\u002Fcodeql-language-guides\u002Fcodeql-for-go\u002F\n- **Cosmos Security Best Practices**: https:\u002F\u002Fgithub.com\u002Fcosmos\u002Fcosmos-sdk\u002Fblob\u002Fmain\u002Fdocs\u002Fdocs\u002Flearn\u002Fadvanced\u002F17-determinism.md\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Cosmos chain audit:\n\n**Non-Determinism (CRITICAL)**:\n- [ ] No map iteration in consensus code\n- [ ] No platform-dependent types (int, uint, float)\n- [ ] No goroutines in message handlers\u002FABCI\n- [ ] No select statements with multiple channels\n- [ ] No rand, time.Now(), memory addresses\n- [ ] All serialization is deterministic\n\n**ABCI Methods (CRITICAL)**:\n- [ ] BeginBlocker\u002FEndBlocker computationally bounded\n- [ ] No unbounded iterations\n- [ ] No nested loops over large collections\n- [ ] All panic-prone operations validated\n- [ ] Benchmarked with maximum state\n\n**Message Handling (HIGH)**:\n- [ ] GetSigners() matches handler address usage\n- [ ] All error returns checked\n- [ ] Critical messages prioritized in CheckTx\n- [ ] All message types registered\n\n**Arithmetic & Accounting (MEDIUM)**:\n- [ ] Multiply before divide pattern used\n- [ ] Rounding favors protocol\n- [ ] Custom bookkeeping synced with x\u002Fbank\n- [ ] Invariant checks implemented\n\n**Testing**:\n- [ ] Cross-architecture builds tested\n- [ ] ABCI methods benchmarked\n- [ ] Invariants checked in CI\n- [ ] Integration tests cover all messages\n","# Cosmos Vulnerability Scanner\n\n## 1. Purpose\n\nSystematically scan Cosmos SDK blockchain modules and CosmWasm smart contracts for platform-specific security vulnerabilities that can cause chain halts, consensus failures, or fund loss. This skill encodes 9 critical vulnerability patterns unique to Cosmos-based chains.\n\n## 2. When to Use This Skill\n\n- Auditing Cosmos SDK modules (custom x\u002F modules)\n- Reviewing CosmWasm smart contracts (Rust)\n- Pre-launch security assessment of Cosmos chains\n- Investigating chain halt incidents\n- Validating consensus-critical code changes\n- Reviewing ABCI method implementations\n\n## 3. Platform Detection\n\n### File Extensions & Indicators\n- **Go files**: `.go`, `.proto`\n- **CosmWasm**: `.rs` (Rust with cosmwasm imports)\n\n### Language\u002FFramework Markers\n```go\n\u002F\u002F Cosmos SDK indicators\nimport (\n    \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Ftypes\"\n    sdk \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Ftypes\"\n    \"github.com\u002Fcosmos\u002Fcosmos-sdk\u002Fx\u002F...\"\n)\n\n\u002F\u002F Common patterns\nkeeper.Keeper\nsdk.Msg, GetSigners()\nBeginBlocker, EndBlocker\nCheckTx, DeliverTx\nprotobuf service definitions\n```\n\n```rust\n\u002F\u002F CosmWasm indicators\nuse cosmwasm_std::*;\n#[entry_point]\npub fn execute(deps: DepsMut, env: Env, info: MessageInfo, msg: ExecuteMsg)\n```\n\n### Project Structure\n- `x\u002Fmodulename\u002F` - Custom modules\n- `keeper\u002Fkeeper.go` - State management\n- `types\u002Fmsgs.go` - Message definitions\n- `abci.go` - BeginBlocker\u002FEndBlocker\n- `handler.go` - Message handlers (legacy)\n\n### Tool Support\n- **CodeQL**: Custom rules for non-determinism and panics\n- **go vet**, **golangci-lint**: Basic Go static analysis\n- **Manual review**: Critical for consensus issues\n\n---\n\n## 4. How This Skill Works\n\nWhen invoked, I will:\n\n1. **Search your codebase** for Cosmos SDK modules\n2. **Analyze each module** for the 9 vulnerability patterns\n3. **Report findings** with file references and severity\n4. **Provide fixes** for each identified issue\n5. **Check message handlers** for validation issues\n\n---\n\n## 5. Example Output\n\nWhen vulnerabilities are found, you'll get a report like this:\n\n```\n=== COSMOS SDK VULNERABILITY SCAN RESULTS ===\n\nProject: my-cosmos-chain\nFiles Scanned: 6 (.go)\nVulnerabilities Found: 2\n\n---\n\n[CRITICAL] Incorrect GetSigners()\n\n---\n\n## 5. Vulnerability Patterns (9 Patterns)\n\nI check for 9 critical vulnerability patterns unique to CosmWasm. For detailed detection patterns, code examples, mitigations, and testing strategies, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n\n### Pattern Summary:\n\n1. **Missing Denom Validation** ⚠️ CRITICAL - Accepting arbitrary token denoms\n2. **Insufficient Authorization** ⚠️ CRITICAL - Missing sender\u002Fadmin validation\n3. **Missing Balance Check** ⚠️ HIGH - Not verifying sufficient balances\n4. **Improper Reply Handling** ⚠️ HIGH - Unsafe submessage reply processing\n5. **Missing Reply ID Check** ⚠️ MEDIUM - Not validating reply IDs\n6. **Improper IBC Packet Validation** ⚠️ CRITICAL - Unvalidated IBC packets\n7. **Unvalidated Execute Message** ⚠️ HIGH - Missing message validation\n8. **Integer Overflow** ⚠️ HIGH - Unchecked arithmetic operations\n9. **Reentrancy via Submessages** ⚠️ MEDIUM - State changes before submessages\n\nFor complete vulnerability patterns with code examples, see [VULNERABILITY_PATTERNS.md](resources\u002FVULNERABILITY_PATTERNS.md).\n## 5. Scanning Workflow\n\n### Step 1: Platform Identification\n1. Identify Cosmos SDK version (`go.mod`)\n2. Locate custom modules (`x\u002F*\u002F`)\n3. Find ABCI methods (`abci.go`, BeginBlocker, EndBlocker)\n4. Identify message types (`types\u002Fmsgs.go`, `.proto`)\n\n### Step 2: Critical Path Analysis\nFocus on consensus-critical code:\n- BeginBlocker \u002F EndBlocker implementations\n- Message handlers (execute, DeliverTx)\n- Keeper methods that modify state\n- CheckTx priority logic\n\n### Step 3: Non-Determinism Sweep\n**This is the highest priority check for Cosmos chains.**\n\n```bash\n# Search for non-deterministic patterns\ngrep -r \"range.*map\\[\" x\u002F\ngrep -r \"\\bint\\b\\|\\buint\\b\" x\u002F | grep -v \"int32\\|int64\\|uint32\\|uint64\"\ngrep -r \"float32\\|float64\" x\u002F\ngrep -r \"go func\\|go routine\" x\u002F\ngrep -r \"select {\" x\u002F\ngrep -r \"time.Now()\" x\u002F\ngrep -r \"rand\\.\" x\u002F\n```\n\nFor each finding:\n1. Verify it's in consensus-critical path\n2. Confirm it causes non-determinism\n3. Assess severity (chain halt vs data inconsistency)\n\n### Step 4: ABCI Method Analysis\nReview BeginBlocker and EndBlocker:\n- [ ] Computational complexity bounded?\n- [ ] No unbounded iterations?\n- [ ] No nested loops over large collections?\n- [ ] Panic-prone operations validated?\n- [ ] Benchmarked with maximum state?\n\n### Step 5: Message Validation\nFor each message type:\n- [ ] GetSigners() address matches handler usage?\n- [ ] All error returns checked?\n- [ ] Priority set in CheckTx if critical?\n- [ ] Handler registered (or using v0.47+ auto-registration)?\n\n### Step 6: Arithmetic & Bookkeeping\n- [ ] sdk.Dec operations use multiply-before-divide?\n- [ ] Rounding favors protocol over users?\n- [ ] Custom bookkeeping synchronized with x\u002Fbank?\n- [ ] Invariant checks in place?\n\n---\n\n## 6. Reporting Format\n\n### Finding Template\n```markdown\n## [CRITICAL] Non-Deterministic Map Iteration in EndBlocker\n\n**Location**: `x\u002Fdex\u002Fabci.go:45-52`\n\n**Description**:\nThe EndBlocker iterates over an unordered map to distribute rewards, causing different validators to process users in different orders and produce different state roots. This will halt the chain when validators fail to reach consensus.\n\n**Vulnerable Code**:\n```go\n\u002F\u002F abci.go, line 45\nfunc EndBlocker(ctx sdk.Context, k keeper.Keeper) {\n    rewards := k.GetPendingRewards(ctx)  \u002F\u002F Returns map[string]sdk.Coins\n    for user, amount := range rewards {  \u002F\u002F NON-DETERMINISTIC ORDER\n        k.bankKeeper.SendCoins(ctx, moduleAcc, user, amount)\n    }\n}\n```\n\n**Attack Scenario**:\n1. Multiple users have pending rewards\n2. Different validators iterate in different orders due to map randomization\n3. If any reward distribution fails mid-iteration, state diverges\n4. Validators produce different app hashes\n5. Chain halts - cannot reach consensus\n\n**Recommendation**:\nSort map keys before iteration:\n```go\nfunc EndBlocker(ctx sdk.Context, k keeper.Keeper) {\n    rewards := k.GetPendingRewards(ctx)\n\n    \u002F\u002F Collect and sort keys for deterministic iteration\n    users := make([]string, 0, len(rewards))\n    for user := range rewards {\n        users = append(users, user)\n    }\n    sort.Strings(users)  \u002F\u002F Deterministic order\n\n    \u002F\u002F Process in sorted order\n    for _, user := range users {\n        k.bankKeeper.SendCoins(ctx, moduleAcc, user, rewards[user])\n    }\n}\n```\n\n**References**:\n- building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcosmos\u002Fnon_determinism\n- Cosmos SDK docs: Determinism\n```\n\n---\n\n## 7. Priority Guidelines\n\n### Critical - CHAIN HALT Risk\n- Non-determinism (any form)\n- ABCI method panics\n- Slow ABCI methods\n- Incorrect GetSigners (allows unauthorized actions)\n\n### High - Fund Loss Risk\n- Missing error handling (bankKeeper.SendCoins)\n- Broken bookkeeping (accounting mismatch)\n- Missing message priority (oracle\u002Femergency messages)\n\n### Medium - Logic\u002FDoS Risk\n- Rounding errors (protocol value leakage)\n- Unregistered message handlers (functionality broken)\n\n---\n\n## 8. Testing Recommendations\n\n### Non-Determinism Testing\n```bash\n# Build for different architectures\nGOARCH=amd64 go build\nGOARCH=arm64 go build\n\n# Run same operations, compare state roots\n# Must be identical across architectures\n\n# Fuzz test with concurrent operations\ngo test -fuzz=FuzzEndBlocker -parallel=10\n```\n\n### ABCI Benchmarking\n```go\nfunc BenchmarkBeginBlocker(b *testing.B) {\n    ctx := setupMaximalState()  \u002F\u002F Worst-case state\n    b.ResetTimer()\n\n    for i := 0; i \u003C b.N; i++ {\n        BeginBlocker(ctx, keeper)\n    }\n\n    \u002F\u002F Must complete in \u003C 1 second\n    require.Less(b, b.Elapsed()\u002Ftime.Duration(b.N), time.Second)\n}\n```\n\n### Invariant Testing\n```go\n\u002F\u002F Run invariants in integration tests\nfunc TestInvariants(t *testing.T) {\n    app := setupApp()\n\n    \u002F\u002F Execute operations\n    app.DeliverTx(...)\n\n    \u002F\u002F Check invariants\n    _, broken := keeper.AllInvariants()(app.Ctx)\n    require.False(t, broken, \"invariant violation detected\")\n}\n```\n\n---\n\n## 9. Additional Resources\n\n- **Building Secure Contracts**: `building-secure-contracts\u002Fnot-so-smart-contracts\u002Fcosmos\u002F`\n- **Cosmos SDK Docs**: https:\u002F\u002Fdocs.cosmos.network\u002F\n- **CodeQL for Go**: https:\u002F\u002Fcodeql.github.com\u002Fdocs\u002Fcodeql-language-guides\u002Fcodeql-for-go\u002F\n- **Cosmos Security Best Practices**: https:\u002F\u002Fgithub.com\u002Fcosmos\u002Fcosmos-sdk\u002Fblob\u002Fmain\u002Fdocs\u002Fdocs\u002Flearn\u002Fadvanced\u002F17-determinism.md\n\n---\n\n## 10. Quick Reference Checklist\n\nBefore completing Cosmos chain audit:\n\n**Non-Determinism (CRITICAL)**:\n- [ ] No map iteration in consensus code\n- [ ] No platform-dependent types (int, uint, float)\n- [ ] No goroutines in message handlers\u002FABCI\n- [ ] No select statements with multiple channels\n- [ ] No rand, time.Now(), memory addresses\n- [ ] All serialization is deterministic\n\n**ABCI Methods (CRITICAL)**:\n- [ ] BeginBlocker\u002FEndBlocker computationally bounded\n- [ ] No unbounded iterations\n- [ ] No nested loops over large collections\n- [ ] All panic-prone operations validated\n- [ ] Benchmarked with maximum state\n\n**Message Handling (HIGH)**:\n- [ ] GetSigners() matches handler address usage\n- [ ] All error returns checked\n- [ ] Critical messages prioritized in CheckTx\n- [ ] All message types registered\n\n**Arithmetic & Accounting (MEDIUM)**:\n- [ ] Multiply before divide pattern used\n- [ ] Rounding favors protocol\n- [ ] Custom bookkeeping synced with x\u002Fbank\n- [ ] Invariant checks implemented\n\n**Testing**:\n- [ ] Cross-architecture builds tested\n- [ ] ABCI methods benchmarked\n- [ ] Invariants checked in CI\n- [ ] Integration tests cover all messages\n",{"name":5,"description":7},"master","c73386b305dec167db7654e0e6feacb462d4f9dc","assets\u002Fskills\u002Fsecurity\u002Fcosmos-vulnerability-scanner",1,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code","https:\u002F\u002Fgithub.com\u002FAntifragileTech","2026-10-02 14:22:14",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add AntifragileTech\u002Fantifragile-claude-code --skill cosmos-vulnerability-scanner",{"tool":47,"command":48},"bunx","bunx skills add AntifragileTech\u002Fantifragile-claude-code --skill cosmos-vulnerability-scanner",{"tool":50,"command":51},"pnpm","pnpm dlx skills add AntifragileTech\u002Fantifragile-claude-code --skill cosmos-vulnerability-scanner","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fcosmos-vulnerability-scanner\u002FSKILL.md",true,[55],{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"resources\u002FVULNERABILITY_PATTERNS.md","REFERENCE","参考文档",22675,"https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fsecurity\u002Fcosmos-vulnerability-scanner\u002Fresources\u002FVULNERABILITY_PATTERNS.md",[62,87,102,117,130,143],{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":81,"publishedAt":29},"01M6DT9Q6VYA615SCXR757TZZ7","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-skills\u002FSKILL.md",[68,73,76],{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":74,"categoryName":75,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[82,83,26,84,85,86],"writing skills","writing","editing","work","deployment",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":95,"publishedAt":29},"01M6DT9GFHDNY90P41WGAE1TV0","writing-plans","Use when you have a spec or requirements for a multi-step task, before touching code","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwriting-plans\u002FSKILL.md",[93,94],{"categoryNo":74,"categoryName":75,"taxonomyType":71,"taxonomyTypeDesc":72},{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},[96,97,83,98,99,26,100,101],"plans","writing plans","requirements","task","code","spec",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":110,"publishedAt":29},"01M6DT9C6PFGD86WS3HY7YE3XG","docs:write-concisely","Apply writing rules to any documentation that humans will read. Makes your writing clearer, stronger, and more professional.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwrite-concisely\u002FSKILL.md",[108,109],{"categoryNo":74,"categoryName":75,"taxonomyType":71,"taxonomyTypeDesc":72},{"categoryNo":77,"categoryName":78,"taxonomyType":79,"taxonomyTypeDesc":80},[111,112,113,114,115,116,83],"docs:write concisely","write","docs","read","Rules","documentation",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":29},"01M6DT98AWQ27P0N1CG97WAG66","kaizen:why","Iterative Five Whys root cause analysis drilling from symptoms to fundamentals","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fwhy\u002FSKILL.md",[],[119,124,125,126,127,128,129],"why","kaizen","issue","five whys","analysis","root cause analysis",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":29},"01M6DT93EH25NAX19R3WGE1P53","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-loop\u002FSKILL.md",[],[137,138,139,140,100,141,142],"verification loop","verification","loop","sessions","claude code sessions","system",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":29},"01M6DT90GW7Z7VCN98P9DVYSNC","verification-before-completion","Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always","https:\u002F\u002Fgithub.com\u002FAntifragileTech\u002Fantifragile-claude-code\u002Fblob\u002Fmaster\u002Fassets\u002Fskills\u002Fthinking\u002Fverification-before-completion\u002FSKILL.md",[],[150,138,151,85,26,152,153,154],"verification before completion","commands","evidence","claim","complete"]