code/cl8y-dex-terraclassic

Fork 0

Security: deploy runbook has no IBC-hooks chain version check or record that contracts do not use IBC hooks [SEC-D02] #407

New issue

Closed

opened 2026-06-19 11:44:10 +00:00 by totdking · 14 comments

totdking commented

2026-06-19 11:44:10 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-19 11:45:13 +00:00

(Migrated from gitlab.com)

Checklist Item

SEC-D02: Model Terra/Astroport IBC-hooks reentrancy/infinite-mint as a threat to bridged/CW20 assets and chain dependency patching. Verify: deployment runbook checks chain version/IBC-hooks exposure and records whether app contracts directly use IBC hooks.

Summary

The contracts do not expose any IBC receive/ack/timeout callbacks, which is the correct posture. However, neither the production launch runbook (docs/runbooks/launch-checklist.md) nor the deployment guide records a check for the Terra Classic chain version, IBC-hooks module version, or an explicit statement that the deployed contracts do not use IBC hooks. If the chain silently gains IBC-hooks support or if a future contract extension adds IBC callbacks, there is no runbook gate to catch it.

What Was Checked

docs/runbooks/launch-checklist.md Phase 0 through Phase 5: no chain version check, no IBC-hooks module version check, no record of whether contracts use IBC hooks
docs/deployment-guide.md Post-Deployment Checklist: no chain version or IBC-hooks check
smartcontracts/contracts/ (all contract source): grep for ibc_receive, ibc_ack, ibc_timeout, IbcChannel, ibc_packet returns no results; contracts confirmed to not expose IBC callbacks
docs/security-model.md Hook Safety: mentions CosmWasm actor model prevents reentrancy but does not document IBC hooks specifically

Expected (per checklist)

The deployment runbook must include a check for the chain's IBC-hooks module version and an explicit recorded statement that the app contracts do not directly use IBC hooks (or if they do, document the exposure and mitigation).

Actual

The launch runbook covers wasm policy, code ID whitelist, fee configuration, hook registration policy, and HTTPS/CSP requirements. It does not require operators to check the Terra Classic chain version, verify whether the IBC-hooks module is active and at what version, or record the status of IBC hook usage in the deployed contracts.

Evidence

docs/runbooks/launch-checklist.md Phase 0: checks governance, wasm policy, hook policy, code ID whitelist; no IBC-hooks chain version step
docs/deployment-guide.md Post-Deployment Checklist: no IBC-hooks or chain version item
Grep for ibc_receive, ibc_ack, ibc_timeout in smartcontracts/contracts/: no results (contracts are clean)

Suggested Fix

Add a step to docs/runbooks/launch-checklist.md Phase 0 or Phase 1 that:

Records the Terra Classic chain version and IBC-hooks module version at deploy time
States explicitly: "App contracts do not expose IBC receive/ack/timeout entry points (verified by grep; last reviewed at commit SHA X)"
Requires re-verification when the chain is upgraded or when new contract modules are added

This step requires no code change; it is a runbook documentation gate only.

Verification Checklist

docs/runbooks/launch-checklist.md includes a checklist item to record Terra Classic chain version and IBC-hooks module version at deploy time
Checklist item includes an explicit statement that deployed contracts do not use IBC hooks
Step requires re-review when chain is upgraded or contracts are extended

Labels

security, pre-launch

Cc : @PlasticDigits

### Checklist Item SEC-D02: Model Terra/Astroport IBC-hooks reentrancy/infinite-mint as a threat to bridged/CW20 assets and chain dependency patching. Verify: deployment runbook checks chain version/IBC-hooks exposure and records whether app contracts directly use IBC hooks. --- ### Summary The contracts do not expose any IBC receive/ack/timeout callbacks, which is the correct posture. However, neither the production launch runbook (`docs/runbooks/launch-checklist.md`) nor the deployment guide records a check for the Terra Classic chain version, IBC-hooks module version, or an explicit statement that the deployed contracts do not use IBC hooks. If the chain silently gains IBC-hooks support or if a future contract extension adds IBC callbacks, there is no runbook gate to catch it. --- ### What Was Checked - `docs/runbooks/launch-checklist.md` Phase 0 through Phase 5: no chain version check, no IBC-hooks module version check, no record of whether contracts use IBC hooks - `docs/deployment-guide.md` Post-Deployment Checklist: no chain version or IBC-hooks check - `smartcontracts/contracts/` (all contract source): grep for `ibc_receive`, `ibc_ack`, `ibc_timeout`, `IbcChannel`, `ibc_packet` returns no results; contracts confirmed to not expose IBC callbacks - `docs/security-model.md` Hook Safety: mentions CosmWasm actor model prevents reentrancy but does not document IBC hooks specifically --- ### Expected (per checklist) The deployment runbook must include a check for the chain's IBC-hooks module version and an explicit recorded statement that the app contracts do not directly use IBC hooks (or if they do, document the exposure and mitigation). --- ### Actual The launch runbook covers wasm policy, code ID whitelist, fee configuration, hook registration policy, and HTTPS/CSP requirements. It does not require operators to check the Terra Classic chain version, verify whether the IBC-hooks module is active and at what version, or record the status of IBC hook usage in the deployed contracts. --- ### Evidence - `docs/runbooks/launch-checklist.md` Phase 0: checks governance, wasm policy, hook policy, code ID whitelist; no IBC-hooks chain version step - `docs/deployment-guide.md` Post-Deployment Checklist: no IBC-hooks or chain version item - Grep for `ibc_receive`, `ibc_ack`, `ibc_timeout` in `smartcontracts/contracts/`: no results (contracts are clean) --- ### Suggested Fix Add a step to `docs/runbooks/launch-checklist.md` Phase 0 or Phase 1 that: 1. Records the Terra Classic chain version and IBC-hooks module version at deploy time 2. States explicitly: "App contracts do not expose IBC receive/ack/timeout entry points (verified by grep; last reviewed at commit SHA X)" 3. Requires re-verification when the chain is upgraded or when new contract modules are added This step requires no code change; it is a runbook documentation gate only. --- ### Verification Checklist - [ ] `docs/runbooks/launch-checklist.md` includes a checklist item to record Terra Classic chain version and IBC-hooks module version at deploy time - [ ] Checklist item includes an explicit statement that deployed contracts do not use IBC hooks - [ ] Step requires re-review when chain is upgraded or contracts are extended --- ### Labels `security`, `pre-launch` Cc : @PlasticDigits

totdking commented

2026-06-19 12:06:49 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-19 13:18:43 +00:00

(Migrated from gitlab.com)

mentioned in commit 7af3556e66

mentioned in commit 7af3556e66757f557ef43bdb9baca96fea22aa68

PlasticDigits commented

2026-06-19 13:18:58 +00:00

(Migrated from gitlab.com)

mentioned in merge request !932

PlasticDigits commented

2026-06-19 13:24:04 +00:00

(Migrated from gitlab.com)

mentioned in merge request !935

PlasticDigits commented

2026-06-19 14:43:18 +00:00

(Migrated from gitlab.com)

mentioned in commit 6c23276f89

mentioned in commit 6c23276f896b5fad4da0878594fc8eb5bc3d24eb

PlasticDigits commented

2026-06-25 11:36:26 +00:00

(Migrated from gitlab.com)

Verification — #407 (SEC-D02) — PASS

Verified as release QA on main (working tree clean; no MR required).

Acceptance criteria

Criterion	Result	How verified
Launch runbook records Terra Classic chain version and IBC-hooks module version at deploy time	PASS	`docs/runbooks/launch-checklist.md` Phase 0 SEC-D02 item (lines 17–32): `terrad version --long`, `params subspaces` / `module_versions` ibchooks probes, paste-to-issue instructions
Checklist includes explicit statement that deployed contracts do not use IBC hooks	PASS	Same Phase 0 block: required operator attestation text; `make verify-no-ibc-hooks-in-contracts`; cross-link to `docs/security-model.md` § IBC hooks
Step requires re-review on chain upgrade or new contract modules	PASS	Phase 0: "Re-run this gate after any chain upgrade or when adding new contract modules"; Phase 5 P0 table cites stale SEC-D02 record as BLOCK
Post-deployment guide coverage	PASS	`docs/deployment-guide.md` Post-Deployment Checklist SEC-D02 item
Contracts do not expose IBC callbacks	PASS	`make verify-no-ibc-hooks-in-contracts` — no `ibc_receive` / `ibc_ack` / `ibc_timeout` in `smartcontracts/contracts/`
Security model documents IBC-hooks threat	PASS	`docs/security-model.md` § "IBC hooks chain dependency (SEC-D02)"
Agent playbook + drift guard	PASS	`skills/AGENTS_IBC_HOOKS_DEPLOY.md`; `make check-ibc-hooks-deploy-docs`

Commands run

make verify-issue-407          → PASS (6/6)
make check-ibc-hooks-deploy-docs → OK
make verify-no-ibc-hooks-in-contracts → OK

Manual review

Read Phase 0 SEC-D02 gate, deployment-guide post-deploy item, and security-model section — content matches issue suggested fix (record chain/IBC-hooks version, static grep attestation with commit SHA, re-verification trigger).

Closing — implementation already on main; no doc fixes needed in this verify pass.

## Verification — #407 (SEC-D02) — **PASS** Verified as release QA on `main` (working tree clean; no MR required). ### Acceptance criteria | Criterion | Result | How verified | |-----------|--------|--------------| | Launch runbook records Terra Classic chain version and IBC-hooks module version at deploy time | **PASS** | `docs/runbooks/launch-checklist.md` Phase 0 SEC-D02 item (lines 17–32): `terrad version --long`, `params subspaces` / `module_versions` ibchooks probes, paste-to-issue instructions | | Checklist includes explicit statement that deployed contracts do not use IBC hooks | **PASS** | Same Phase 0 block: required operator attestation text; `make verify-no-ibc-hooks-in-contracts`; cross-link to `docs/security-model.md` § IBC hooks | | Step requires re-review on chain upgrade or new contract modules | **PASS** | Phase 0: "Re-run this gate after any chain upgrade or when adding new contract modules"; Phase 5 P0 table cites stale SEC-D02 record as BLOCK | | Post-deployment guide coverage | **PASS** | `docs/deployment-guide.md` Post-Deployment Checklist SEC-D02 item | | Contracts do not expose IBC callbacks | **PASS** | `make verify-no-ibc-hooks-in-contracts` — no `ibc_receive` / `ibc_ack` / `ibc_timeout` in `smartcontracts/contracts/` | | Security model documents IBC-hooks threat | **PASS** | `docs/security-model.md` § "IBC hooks chain dependency (SEC-D02)" | | Agent playbook + drift guard | **PASS** | `skills/AGENTS_IBC_HOOKS_DEPLOY.md`; `make check-ibc-hooks-deploy-docs` | ### Commands run ```text make verify-issue-407 → PASS (6/6) make check-ibc-hooks-deploy-docs → OK make verify-no-ibc-hooks-in-contracts → OK ``` ### Manual review Read Phase 0 SEC-D02 gate, deployment-guide post-deploy item, and security-model section — content matches issue suggested fix (record chain/IBC-hooks version, static grep attestation with commit SHA, re-verification trigger). Closing — implementation already on `main`; no doc fixes needed in this verify pass.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-25 11:36:34 +00:00

PlasticDigits commented

2026-06-25 11:37:42 +00:00

(Migrated from gitlab.com)

mentioned in issue #406