code/cl8y-dex-terraclassic

Fork 0

Security: no committed historical exploit replay matrix for known Cosmos/CosmWasm attack classes [SEC-D01] #406

New issue

Closed

opened 2026-06-19 11:42:33 +00:00 by totdking · 8 comments

totdking commented

2026-06-19 11:42:33 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 11:43:47 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-D01: Create a historical exploit matrix with date, protocol, root cause, affected component, our equivalent surface, mitigation, and verification. Verify: committed docs table with links to tests/issues.

Summary

The repo has an in-repo invariant matrix (contracts-security-audit.md) and an "Attack paths considered" section, but neither constitutes a historical exploit replay matrix. No document maps historical incidents (Terra IBC-hooks, Osmosis LP share, Levana oracle, etc.) by date, protocol, root cause, affected component, our equivalent surface, mitigation status, and test link.

What Was Checked

docs/contracts-security-audit.md: invariant matrix and "Attack paths considered" section reviewed; covers internal invariants and non-governance attacks, not external historical incidents
docs/security-model.md: governance, treasury, hook safety, off-chain trust boundaries; no exploit replay matrix
docs/security-posture.md: TVL-scaled posture and residual risks; no historical incident table
All docs files searched for "exploit matrix", "historical exploit", "replay matrix", "incident matrix": only help/checklist.md contains those terms

Expected (per checklist)

A committed document or table listing each modeled historical incident with: date, protocol name, root cause, affected component class, our equivalent attack surface, our mitigation, and a link to the test or issue verifying coverage.

Actual

No such document exists. The contracts-security-audit.md covers what invariants hold and what attack paths are rejected, but does not trace those to specific external incidents by date and protocol. The SEC-D checklist items (D02-D12) each reference specific historical incidents (Terra/Astroport IBC-hooks, Osmosis pool-share bug, Levana oracle, etc.) but there is no central committed table linking them all.

Evidence

docs/contracts-security-audit.md lines 79-88: "Attack paths considered"; covers sandwich, reentrancy, fee-on-transfer, hook griefing, router state, router dust; no dates, protocols, or historical incident links
docs/security-posture.md: no exploit matrix
Repo-wide search for "exploit matrix", "historical exploit", "replay matrix": no results outside help/checklist.md

Suggested Fix

Create docs/exploit-replay-matrix.md with a table structured as:

Date	Protocol	Root Cause	Component Class	Our Equivalent Surface	Our Mitigation	Verification

Populate with at minimum the incidents referenced in SEC-D02 through SEC-D12 (Terra IBC-hooks reentrancy, Osmosis LP-share accounting, Levana oracle timing, malicious CW20, fake pair indexing, SQL injection, LCD amplification, admin key compromise, wallet phishing, stale deployment). Link each row to the relevant contract test, docs section, or GitLab issue.

Verification Checklist

docs/exploit-replay-matrix.md committed with a row for each historical incident from SEC-D02 through SEC-D12
Each row includes date, protocol, root cause, affected component, our surface, our mitigation, and a link to test or issue
Document is linked from docs/contracts-security-audit.md and docs/security-model.md

Labels

security, pre-launch

Cc: @PlasticDigits

### Checklist Item SEC-D01: Create a historical exploit matrix with date, protocol, root cause, affected component, our equivalent surface, mitigation, and verification. Verify: committed docs table with links to tests/issues. --- ### Summary The repo has an in-repo invariant matrix (`contracts-security-audit.md`) and an "Attack paths considered" section, but neither constitutes a historical exploit replay matrix. No document maps historical incidents (Terra IBC-hooks, Osmosis LP share, Levana oracle, etc.) by date, protocol, root cause, affected component, our equivalent surface, mitigation status, and test link. --- ### What Was Checked - `docs/contracts-security-audit.md`: invariant matrix and "Attack paths considered" section reviewed; covers internal invariants and non-governance attacks, not external historical incidents - `docs/security-model.md`: governance, treasury, hook safety, off-chain trust boundaries; no exploit replay matrix - `docs/security-posture.md`: TVL-scaled posture and residual risks; no historical incident table - All docs files searched for "exploit matrix", "historical exploit", "replay matrix", "incident matrix": only `help/checklist.md` contains those terms --- ### Expected (per checklist) A committed document or table listing each modeled historical incident with: date, protocol name, root cause, affected component class, our equivalent attack surface, our mitigation, and a link to the test or issue verifying coverage. --- ### Actual No such document exists. The contracts-security-audit.md covers what invariants hold and what attack paths are rejected, but does not trace those to specific external incidents by date and protocol. The SEC-D checklist items (D02-D12) each reference specific historical incidents (Terra/Astroport IBC-hooks, Osmosis pool-share bug, Levana oracle, etc.) but there is no central committed table linking them all. --- ### Evidence - `docs/contracts-security-audit.md` lines 79-88: "Attack paths considered"; covers sandwich, reentrancy, fee-on-transfer, hook griefing, router state, router dust; no dates, protocols, or historical incident links - `docs/security-posture.md`: no exploit matrix - Repo-wide search for "exploit matrix", "historical exploit", "replay matrix": no results outside `help/checklist.md` --- ### Suggested Fix Create `docs/exploit-replay-matrix.md` with a table structured as: | Date | Protocol | Root Cause | Component Class | Our Equivalent Surface | Our Mitigation | Verification | |------|----------|------------|-----------------|------------------------|----------------|--------------| Populate with at minimum the incidents referenced in SEC-D02 through SEC-D12 (Terra IBC-hooks reentrancy, Osmosis LP-share accounting, Levana oracle timing, malicious CW20, fake pair indexing, SQL injection, LCD amplification, admin key compromise, wallet phishing, stale deployment). Link each row to the relevant contract test, docs section, or GitLab issue. --- ### Verification Checklist - [ ] `docs/exploit-replay-matrix.md` committed with a row for each historical incident from SEC-D02 through SEC-D12 - [ ] Each row includes date, protocol, root cause, affected component, our surface, our mitigation, and a link to test or issue - [ ] Document is linked from `docs/contracts-security-audit.md` and `docs/security-model.md` --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-19 12:06:49 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 13:23:06 +00:00

(Migrated from gitlab.com)

mentioned in commit 74c66522ed

mentioned in commit 74c66522ed93a5c6189afd8b9e4e0d53bdc5c571

PlasticDigits commented

2026-06-19 13:24:03 +00:00

(Migrated from gitlab.com)

mentioned in merge request !935

PlasticDigits commented

2026-06-19 14:39:15 +00:00

(Migrated from gitlab.com)

mentioned in commit d635061066

mentioned in commit d63506106619d170079d794fce09ab8c495ff336

PlasticDigits commented

2026-06-20 04:54:42 +00:00

(Migrated from gitlab.com)

mentioned in commit 64ae472470

mentioned in commit 64ae47247045af0a16bc7bb26029612695e4a558

PlasticDigits commented

2026-06-25 11:37:42 +00:00

(Migrated from gitlab.com)

Verification — SEC-D01 / #406 (PASS)

Verified on main (clean working tree, up to date with origin/main). No repo changes required.

Acceptance checklist

Criterion	Result	How verified
`docs/exploit-replay-matrix.md` committed with SEC-D02–D12 rows	PASS	File present; 11 table rows (`
Each row includes date, protocol, root cause, affected component, our surface, mitigation, and test/issue link	PASS	Manual review of all 11 rows; spot-checked verification targets exist in repo (`test_reentrant_swap_during_swap_rejected`, `test_lp_share_inflation_first_depositor_griefing`, `fee_on_transfer_creates_reserve_imbalance`, `verify_factory_provenance_*`, `SwapPreSubmitSummary.test.tsx`, etc.).
Document linked from `docs/contracts-security-audit.md` and `docs/security-model.md`	PASS	Both files link to `exploit-replay-matrix.md` in intro and body sections; agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md` present.
Drift guard / automated check	PASS	`make check-exploit-replay-matrix-docs` → `OK: exploit replay matrix covers SEC-D02–D12 and is linked from contracts-security-audit, security-model, and agent skill`. Target also wired into `make lint`.

Notes

SEC-D02 and SEC-D10 mitigations are correctly marked partial with open follow-up issues (#407, #408, #410) rather than implying full coverage.
No LocalTerra / indexer / frontend runtime required for this documentation-only acceptance criteria.

Closing as implemented on main.

## Verification — SEC-D01 / #406 (PASS) Verified on `main` (clean working tree, up to date with `origin/main`). No repo changes required. ### Acceptance checklist | Criterion | Result | How verified | |-----------|--------|--------------| | `docs/exploit-replay-matrix.md` committed with SEC-D02–D12 rows | **PASS** | File present; 11 table rows (`| **SEC-D02**` … `| **SEC-D12**`); each row has 8 columns (checklist, date, protocol, root cause, component class, our surface, mitigation, verification). | | Each row includes date, protocol, root cause, affected component, our surface, mitigation, and test/issue link | **PASS** | Manual review of all 11 rows; spot-checked verification targets exist in repo (`test_reentrant_swap_during_swap_rejected`, `test_lp_share_inflation_first_depositor_griefing`, `fee_on_transfer_creates_reserve_imbalance`, `verify_factory_provenance_*`, `SwapPreSubmitSummary.test.tsx`, etc.). | | Document linked from `docs/contracts-security-audit.md` and `docs/security-model.md` | **PASS** | Both files link to `exploit-replay-matrix.md` in intro and body sections; agent playbook `skills/AGENTS_EXPLOIT_REPLAY_MATRIX.md` present. | | Drift guard / automated check | **PASS** | `make check-exploit-replay-matrix-docs` → `OK: exploit replay matrix covers SEC-D02–D12 and is linked from contracts-security-audit, security-model, and agent skill`. Target also wired into `make lint`. | ### Notes - SEC-D02 and SEC-D10 mitigations are correctly marked partial with open follow-up issues (#407, #408, #410) rather than implying full coverage. - No LocalTerra / indexer / frontend runtime required for this documentation-only acceptance criteria. Closing as implemented on `main`.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:37:43 +00:00

PlasticDigits commented

2026-06-29 00:21:33 +00:00

(Migrated from gitlab.com)

mentioned in issue #424