Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns.
SkillScore41Maintained
Automatic
◆Security & AppSec pack
Last verified 8/7/2026
What it changes
Passed 7 of 16 test cases with the skill, and 3 of 16 without it.
Without skill18%
With skill41%
Checks it passed that the model alone missed
Verifies exactly 8 pattern summaries for core-scanner
Formats the output filename matching critical-s3-*.md
Verifies exactly 13 pattern summaries for state-scanner
and 2 more in the full report
5 fixed4 passed either way13 still failing0 broke
Pass-rate lift
+23 pp
Tokens
+181%
Agent turns
0%
Response time
-26%
Model gemini-3.6-flashMeasured 8/7/2026v19 of 22 cases passed with skill · 16 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 5
Prompt
We need a security review of our pure Solidity smart contract repository for an Ethereum deployment located at `./contracts/eth-dex`. Check for reentrancy, access control issues, and integer overflows.
What was checked, without and with the skill
Checked
Without skill
With skill
Declines running the Cosmos vulnerability scan
Passed
Passed
Recommends using Solidity-specific security auditing tools
Missed
Passed
case-04 · gemini-3.6-flash · 8/7/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md183 lines2 files
Cosmos Vulnerability Scanner
Purpose
Scan Cosmos SDK modules and CosmWasm contracts for vulnerabilities that cause chain halts, consensus failures, or fund loss. Spawns parallel scanning agents — each specializing in a vulnerability category — that return findings to the main skill, which then writes them as individual markdown files to an output directory.
Output directory: defaults to .bughunt_cosmos/. If the user specifies a different directory in their prompt, use that instead.
When to Use
Auditing Cosmos SDK modules (custom x/ modules)
Reviewing CosmWasm smart contracts
Pre-launch security assessment of Cosmos chains
Investigating chain halt incidents
When NOT to Use
Pure Solidity/EVM audits without Cosmos SDK — use Solidity-specific tools
CometBFT consensus engine internals — this covers SDK modules, not the consensus layer itself
General Go code review with no blockchain context
Cosmos SDK application logic that is not consensus-critical (e.g., CLI commands, REST endpoints)
CosmWasm contract-only audits on chains without custom SDK modules — use the CosmWasm checklist items alone
Essential Principles
Consensus path is king — A bug only matters for chain halt/fund loss if it's on the consensus-critical execution path (BeginBlock, EndBlock, FinalizeBlock, msg_server handlers, AnteHandler). Always verify a finding is reachable from consensus before reporting it.
State divergence = chain halt — Any non-determinism that causes validators to compute different state roots will halt the chain. This is the highest-severity class because it affects all validators simultaneously.
Check the version — Cosmos SDK has breaking changes across major versions (v0.47 removed GetSigners, v0.50 added ABCI 2.0, v0.53 deprecated ValidateBasic). Always check go.mod versions before applying patterns.
False positives waste audit time — A map iteration in a CLI command is not a consensus bug. A panic in a query handler does not halt the chain. Verify the execution context before flagging.
Cross-module interactions are where bugs hide — The most severe findings (IBC reentrancy, EVM/Cosmos state desync, authz escalation) involve interactions between modules, not bugs within a single module.
Scanning Workflow
Phase 1: Discovery (synchronous)
Entry: Target codebase path provided by user. Codebase contains Go source (e.g., x/ modules, go.mod) or Rust contracts with cosmwasm_std.
Run a synchronous subagent (Agent tool) with the full contents of DISCOVERY.md as its prompt. The agent must:
Follow the Discovery workflow to explore the target codebase