CosmWasm (Rust) detection

When this applies

• Any .rs file importing cosmwasm_std (use cosmwasm_std::{...})
• Macros/attrs #[entry_point], #[cw_serde]; enums ExecuteMsg, InstantiateMsg, QueryMsg, MigrateMsg, SudoMsg
• cw_storage_plus types Map, Item, IndexedMap; DepsMut/Deps, MessageInfo, Env
• SubMsg, Reply, reply(), set_contract_version, cw2

CosmWasm has no msg.sender-gated visibility and no implicit auth. Every execute branch is callable by anyone unless the handler checks info.sender.

Detection patterns

Missing info.sender authorization in execute (CRITICAL)

ExecuteMsg::SetConfig { admin } => {
    let mut cfg = CONFIG.load(deps.storage)?;
    cfg.admin = admin;                          // ← no info.sender check
    CONFIG.save(deps.storage, &cfg)?;
    Ok(Response::new())
}

Signal: an ExecuteMsg arm that mutates privileged state (admin, owner, mint, withdraw, pause) with no if info.sender != cfg.admin { return Err(Unauthorized) }. Anyone can dispatch any message.

Unbounded map iteration → gas exhaustion DoS (HIGH)

let all: Vec<_> = BALANCES
    .range(deps.storage, None, None, Order::Ascending)   // ← whole map
    .collect::<StdResult<_>>()?;
for (addr, bal) in all { /* mutate each */ }

Signal: .range(.., None, None, ..) / .keys(..) over a user-growable Map inside execute, or a loop whose length attackers control. Each entry costs gas; an attacker inflates the map until the handler always runs out of gas (permanent freeze). Paginate with start_after + limit.

reply_id confusion / unvalidated submessage reply (HIGH)

#[entry_point]
pub fn reply(deps: DepsMut, _env: Env, msg: Reply) -> Result<Response, ContractError> {
    let res = msg.result.unwrap();              // ← assumes success; panics on err
    // no match on msg.id → all replies handled identically
    parse_instantiate_response_data(&res.data.unwrap())?;
    Ok(Response::new())
}

Signal: a reply handler that doesn't match msg.id { ... } against known reply IDs, or .unwrap()s msg.result/msg.result.data, or trusts SubMsgResult data without checking it came from the expected submessage. Different submessages can land in the same reply with attacker-influenced data.

migrate admin backdoor / unguarded migrate (HIGH)

#[entry_point]
pub fn migrate(deps: DepsMut, _env: Env, msg: MigrateMsg) -> Result<Response, ContractError> {
    CONFIG.save(deps.storage, &Config { admin: msg.new_admin })?;  // ← arbitrary rewrite
    Ok(Response::new())                          // no version/sender guard
}

Signal: migrate that overwrites owner/config from MigrateMsg without checking set_contract_version/get_contract_version (downgrade or replay), or a centralization risk where the code-admin can swap logic+state at will. Even with chain-level migrate auth, document who holds the admin.

addr_validate vs raw string address (MEDIUM-HIGH)

let recipient = msg.to;                          // ← String, never validated
BALANCES.save(deps.storage, &Addr::unchecked(&recipient), &amt)?;  // ← unchecked

Signal: Addr::unchecked(...) on user input, or storing/using a String address without deps.api.addr_validate(&s)?. Unvalidated/un-normalized addresses split balances across casing/bech32 variants and break invariants.

Unchecked info.funds (HIGH)

ExecuteMsg::Deposit {} => {
    let amount = msg.amount;                     // ← trusts a field, not info.funds
    CREDIT.save(deps.storage, &info.sender, &amount)?;
    Ok(Response::new())
}

Signal: crediting a deposit from a message field instead of info.funds, or not asserting info.funds contains the expected denom AND amount (must_pay/one_coin from cw_utils). Also flag handlers that ignore unexpected attached funds.

Uint128 / Uint256 overflow & raw arithmetic (HIGH)

let total = a + b;                               // ← Uint128 Add can overflow → error,
let scaled = price * qty;                        //    but `as`/u128 casts wrap silently

Signal: Uint128/Uint256 +/-/* where overflow should be a domain error vs a panic, OR casting to/from primitive u128/u64 with as/.u128() in accounting. Prefer checked_add/checked_sub/checked_mul returning OverflowError.

Query reentrancy / cross-contract query trust (MEDIUM)

let price: PriceResp = deps.querier.query_wasm_smart(oracle, &QueryMsg::Price {})?;

Signal: acting on a query_wasm_smart result from a user-supplied contract address, or assuming queries are side-effect-free guarantees (a malicious queried contract returns adversarial data). Validate the oracle/contract address against an allowlist.

Severity rubric

Remediation patterns

1. Authorize first — every privileged execute arm starts with ensure_eq!(info.sender, cfg.admin, ContractError::Unauthorized {}).
2. Paginate iteration — start_after + bounded limit (e.g. 30); never .range(None, None) over attacker-growable maps in execute.
3. Match reply IDs — declare const REPLY_X: u64, match msg.id { REPLY_X => ..., _ => Err(...) }, and validate SubMsgResult before trusting its data.
4. Guard migrate — check cw2::get_contract_version, reject downgrades, and document the migrate-admin in centralization disclosures.
5. Validate addresses — deps.api.addr_validate(&s)?, never Addr::unchecked on user input.
6. Verify funds — use cw_utils::must_pay/one_coin against info.funds; reject unexpected denoms.
7. checked_* math on Uint128/Uint256; avoid as/.u128() casts in accounting.

False-positive notes

• Addr::unchecked is acceptable in tests and when re-loading an address the contract itself validated and stored earlier.
• An execute arm that is intentionally permissionless (e.g. public Claim {} keyed by info.sender) needs no admin check — confirm it can only affect the caller's own state.
• Uint128 +/- already returns an OverflowError (not a silent wrap) — the real risk is primitive u128/as casts and Decimal scaling; focus there.
• A bounded .range(.., Some(limit)) is fine.

Related

• [[access-control]] — CosmWasm has no implicit sender gate; every execute arm is public
• [[dos-vectors]] — unbounded map iteration is the canonical CosmWasm gas-freeze
• [[centralization-risk]] — migrate/admin powers concentrate upgrade + state control