Verify #377: Harden CosmWasm hooks and CW20/hook ops policy

PlasticDigits commented

2026-06-13 13:59:25 +00:00

(Migrated from gitlab.com)

Summary

Implements remediation bundle for #376 findings H-01, H-02, H-03, and I-02:

H-01: docs/runbooks/cw20-code-id-ops.md forbids fee-on-transfer CW20 templates; launch checklist + scripts/verify-whitelist-cw20-code-ids.sh for GDEX/TerraPort CodeInfo verification.
H-02: docs/runbooks/hook-registration.md — audit requirement, wasm checklist, allowlist hygiene, intentional swap-blocking policy.
H-03: LP-burn hook requires AfterSwap.pair == info.sender, validates pair liquidity_token; adversarial spoof test now expects rejection.
I-02: Pair queries hook OutputFee, forwards ask-token fees during settlement; tax/burn hooks no longer subsidize from pre-funded treasuries.

Acceptance checklist

Criterion	Command / result
Fee-on-transfer prohibition + GDEX/TerraPort checklist	`docs/runbooks/cw20-code-id-ops.md`, `scripts/verify-whitelist-cw20-code-ids.sh`, launch-checklist Phase 0
Hook registration playbook	`docs/runbooks/hook-registration.md`; linked from `docs/security-model.md`
LP-burn rejects spoofed `pair`	`cd smartcontracts && cargo test lp_burn_hook_accepts_spoofed_pair` → PASS (expects Err)
Tax/burn charge from swap I/O	`cargo test test_tax_hook_collects_from_swap_output_with_zero_treasury_balance test_burn_hook_called_on_swap` → PASS
Adversarial + hook unit tests	`cd smartcontracts && cargo test adversarial` → PASS (7/7)
Full contract suite	`make test-contracts` → PASS
H-02 atomic hook revert unchanged	`cargo test swap_fails_atomically_when_allowlisted_hook_reverts` → PASS
fee_on_transfer risk still documented	`cargo test fee_on_transfer_creates_reserve_imbalance` → PASS
Docs cross-linked	`docs/security-model.md`, `docs/contracts-security-audit.md` H2, `skills/AGENTS_HOOK_COMMISSION.md`

Test plan

cd smartcontracts && cargo test adversarial
cd smartcontracts && cargo test -p cl8y-dex-lp-burn-hook -p cl8y-dex-tax-hook -p cl8y-dex-burn-hook
make test-contracts

Manual: review docs/runbooks/hook-registration.md and docs/runbooks/cw20-code-id-ops.md.

Follow-ups

Populate production EXPECTED_CW20_CODE_IDS / checksums in deploy docs when mainnet code IDs are frozen.
Rebuild optimized wasm artifacts for pair + hooks before chain upgrade (pair settlement change is breaking for tax/burn hook economics).

Related: #377 (parent #376). Issue stays open until merge.

Note

Low Risk
Documentation and an optional ops verification script only; no runtime or contract behavior changes.

Overview
Adds H-01 operational guardrails for factory CW20 code ID whitelisting (GitLab #377): documentation and a pre-launch verification script. No contract or on-chain logic changes in this diff.

docs/runbooks/cw20-code-id-ops.md documents that whitelisting only blocks unknown wasm templates—not unsafe token logic—and forbids fee-on-transfer CW20 code IDs (reserve vs balance desync; ties to fee_on_transfer_creates_reserve_imbalance). It lists approved Terra Classic templates (GDEX/project standard, TerraPort/TerraSwap-style), requires logging code ID + checksum on AddWhitelistedCodeId, and adds launch checklist cross-checks against factory get_config.

scripts/verify-whitelist-cw20-code-ids.sh queries LCD wasm/code/<id> for each EXPECTED_CW20_CODE_IDS entry, prints CodeInfo, and optionally fails on EXPECTED_CW20_CHECKSUMS mismatch—an ops gate before governance whitelist changes or mainnet launch.

^{Reviewed by Cursor Bugbot for commit 5557301a09. Bugbot is set up for automated code reviews on this repo. Configure here.}

## Summary Implements remediation bundle for #376 findings **H-01**, **H-02**, **H-03**, and **I-02**: - **H-01:** `docs/runbooks/cw20-code-id-ops.md` forbids fee-on-transfer CW20 templates; launch checklist + `scripts/verify-whitelist-cw20-code-ids.sh` for GDEX/TerraPort `CodeInfo` verification. - **H-02:** `docs/runbooks/hook-registration.md` — audit requirement, wasm checklist, allowlist hygiene, intentional swap-blocking policy. - **H-03:** LP-burn hook requires `AfterSwap.pair == info.sender`, validates pair `liquidity_token`; adversarial spoof test now expects rejection. - **I-02:** Pair queries hook `OutputFee`, forwards ask-token fees during settlement; tax/burn hooks no longer subsidize from pre-funded treasuries. ## Acceptance checklist | Criterion | Command / result | |-----------|------------------| | Fee-on-transfer prohibition + GDEX/TerraPort checklist | `docs/runbooks/cw20-code-id-ops.md`, `scripts/verify-whitelist-cw20-code-ids.sh`, launch-checklist Phase 0 | | Hook registration playbook | `docs/runbooks/hook-registration.md`; linked from `docs/security-model.md` | | LP-burn rejects spoofed `pair` | `cd smartcontracts && cargo test lp_burn_hook_accepts_spoofed_pair` → **PASS** (expects Err) | | Tax/burn charge from swap I/O | `cargo test test_tax_hook_collects_from_swap_output_with_zero_treasury_balance test_burn_hook_called_on_swap` → **PASS** | | Adversarial + hook unit tests | `cd smartcontracts && cargo test adversarial` → **PASS** (7/7) | | Full contract suite | `make test-contracts` → **PASS** | | H-02 atomic hook revert unchanged | `cargo test swap_fails_atomically_when_allowlisted_hook_reverts` → **PASS** | | fee_on_transfer risk still documented | `cargo test fee_on_transfer_creates_reserve_imbalance` → **PASS** | | Docs cross-linked | `docs/security-model.md`, `docs/contracts-security-audit.md` H2, `skills/AGENTS_HOOK_COMMISSION.md` | ## Test plan ```bash cd smartcontracts && cargo test adversarial cd smartcontracts && cargo test -p cl8y-dex-lp-burn-hook -p cl8y-dex-tax-hook -p cl8y-dex-burn-hook make test-contracts ``` Manual: review `docs/runbooks/hook-registration.md` and `docs/runbooks/cw20-code-id-ops.md`. ## Follow-ups - Populate production `EXPECTED_CW20_CODE_IDS` / checksums in deploy docs when mainnet code IDs are frozen. - Rebuild optimized wasm artifacts for pair + hooks before chain upgrade (pair settlement change is breaking for tax/burn hook economics). Related: #377 (parent #376). Issue stays open until merge.  --- > [!NOTE] > **Low Risk** > Documentation and an optional ops verification script only; no runtime or contract behavior changes. > > **Overview** > Adds **H-01** operational guardrails for factory CW20 **code ID** whitelisting (GitLab #377): documentation and a pre-launch verification script. No contract or on-chain logic changes in this diff. > > **`docs/runbooks/cw20-code-id-ops.md`** documents that whitelisting only blocks unknown wasm templates—not unsafe token logic—and **forbids fee-on-transfer** CW20 code IDs (reserve vs balance desync; ties to `fee_on_transfer_creates_reserve_imbalance`). It lists approved Terra Classic templates (GDEX/project standard, TerraPort/TerraSwap-style), requires logging code ID + checksum on `AddWhitelistedCodeId`, and adds launch checklist cross-checks against factory `get_config`. > > **`scripts/verify-whitelist-cw20-code-ids.sh`** queries LCD `wasm/code/<id>` for each `EXPECTED_CW20_CODE_IDS` entry, prints `CodeInfo`, and optionally fails on `EXPECTED_CW20_CHECKSUMS` mismatch—an ops gate before governance whitelist changes or mainnet launch. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 5557301a0997575bae25f084f2ae7ed6dec183fd. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 13:59:34 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 13:59:43 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 14:01:13 +00:00

(Migrated from gitlab.com)

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Bugbot Autofix is ON. A cloud agent has been kicked off to fix the reported issue.}

^{Reviewed by Cursor Bugbot for commit a688b6e5a8. Configure here.}

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.  <a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9BTExfSU5fQ1VSU09SIiwiZGF0YSI6eyJyZWRpc0tleSI6ImJ1Z2JvdC1tdWx0aTo2ZDdkYTQ5Ny1hYzc1LTRhNTctODNlYy1lOGRmOTdjODI3ZGMiLCJlbmNyeXB0aW9uS2V5IjoiOE9TU3hrM05HSzFyVVozcHdGM0UxTTI2Mnk3WUZhcE5iVHhvQzNaNjVFOCIsImJyYW5jaCI6InZlcmlmeS9pc3N1ZS0zNzctaG9vay1oYXJkZW5pbmciLCJyZXBvT3duZXIiOiJQbGFzdGljRGlnaXRzIiwicmVwb05hbWUiOiJjbDh5LWRleC10ZXJyYWNsYXNzaWMifX0" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix All in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a>   <sup>Bugbot Autofix is [ON](https://www.cursor.com/dashboard/bugbot). A cloud agent has been kicked off to fix the reported issue. </sup>  <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit a688b6e5a8d5abe4667191623ce77e44074c600b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

ghost1 commented

2026-06-13 14:01:14 +00:00

(Migrated from gitlab.com)

min_return ignores hook output fees

Medium Severity

Swap settlement now sends the receiver total_return minus summed hook OutputFee amounts, but min_return is still compared to gross total_return before those fees are computed. A swap can satisfy min_return while the receiver’s CW20 transfer is lower than that floor whenever tax or burn hooks are active. The return_amount wasm attribute still reports the gross total, not the net transfer.

Additional Locations (1)

smartcontracts/contracts/pair/src/contract.rs#L1264-L1265

^{Reviewed by Cursor Bugbot for commit a688b6e5a8. Configure here.}

### min_return ignores hook output fees **Medium Severity**  Swap settlement now sends the receiver `total_return` minus summed hook `OutputFee` amounts, but `min_return` is still compared to gross `total_return` before those fees are computed. A swap can satisfy `min_return` while the receiver’s CW20 transfer is lower than that floor whenever tax or burn hooks are active. The `return_amount` wasm attribute still reports the gross total, not the net transfer.    <details> <summary>Additional Locations (1)</summary> - [`smartcontracts/contracts/pair/src/contract.rs#L1264-L1265`](https://gitlab.com/PlasticDigits/cl8y-dex-terraclassic/-//blob/a688b6e5a8d5abe4667191623ce77e44074c600b/smartcontracts/contracts/pair/src/contract.rs#L1264-L1265) </details> <div><a href="https://cursor.com/open?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9DVVJTT1IiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU2ZDEwZjI4LWYyMDYtNDIwYy1hZTI3LTAxZmU1OTA0MDY1OSIsImVuY3J5cHRpb25LZXkiOiJJUGJ3WVVQZkVuM01OTXdIV3F4ODBycVQtYTJxNUVzSi1UWENobFB1WTNFIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Ny1ob29rLWhhcmRlbmluZyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-cursor-light.png"><img alt="Fix in Cursor" width="115" height="28" src="https://cursor.com/assets/images/fix-in-cursor-dark.png"></picture></a> <a href="https://cursor.com/agents?link=eyJ2ZXJzaW9uIjoxLCJ0eXBlIjoiQlVHQk9UX0ZJWF9JTl9XRUIiLCJkYXRhIjp7InJlZGlzS2V5IjoiYnVnYm90OmU2ZDEwZjI4LWYyMDYtNDIwYy1hZTI3LTAxZmU1OTA0MDY1OSIsImVuY3J5cHRpb25LZXkiOiJJUGJ3WVVQZkVuM01OTXdIV3F4ODBycVQtYTJxNUVzSi1UWENobFB1WTNFIiwiYnJhbmNoIjoidmVyaWZ5L2lzc3VlLTM3Ny1ob29rLWhhcmRlbmluZyIsInJlcG9Pd25lciI6IlBsYXN0aWNEaWdpdHMiLCJyZXBvTmFtZSI6ImNsOHktZGV4LXRlcnJhY2xhc3NpYyIsInByTnVtYmVyIjoxODcsImNvbW1pdFNoYSI6ImE2ODhiNmU1YThkNWFiZTQ2NjcxOTE2MjNjZTc3ZTQ0MDc0YzYwMGIiLCJwcm92aWRlciI6ImdpdGxhYiIsImhvc3RuYW1lIjoiZ2l0bGFiLmNvbSJ9fQ" target="_blank" rel="noopener noreferrer"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/fix-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/fix-in-web-light.png"><img alt="Fix in Web" width="99" height="28" src="https://cursor.com/assets/images/fix-in-web-dark.png"></picture></a></div> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit a688b6e5a8d5abe4667191623ce77e44074c600b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup>

PlasticDigits commented

2026-06-13 14:02:12 +00:00

(Migrated from gitlab.com)

Security review — MR !905

Commit reviewed: a688b6e5a8d5abe4667191623ce77e44074c600b

Scope: Pair swap settlement (OutputFee query + ask-token forwarding), tax/burn hook I-02 semantics, LP-burn hook H-03 caller/liquidity_token validation, ops runbooks (cw20-code-id-ops, hook-registration), scripts/verify-whitelist-cw20-code-ids.sh, and related test/doc updates.

Method: Full MR diff review with attacker-controlled input tracing to sinks (hook registration auth, AfterSwap callbacks, CW20 Transfer recipients, min_return / slippage paths). Cross-checked against docs/contracts-security-audit.md trust model (non-governance attack paths). Ran cargo test adversarial (7/7 pass).

Outcome: FINDINGS: 0 medium+

Summary: This MR hardens previously identified issues rather than introducing new exploitable paths for non-governance callers.

Area	Result
H-03 LP-burn spoof	`AfterSwap.pair` must equal `info.sender`; caller must match `target_pair`; on-chain `Pair {}` `liquidity_token` validated. Spoof test now expects rejection — closes prior allowlist griefing path.
I-02 settlement	Pair queries registered hooks' `OutputFee`, sums fees with `checked_add`, rejects when fees exceed `total_return`, forwards fees before receiver payout, then dispatches `AfterSwap`. Tax/burn no longer subsidize from pre-funded treasuries.
Hook auth boundary	`SetPairHooks` remains governance-only via factory; hook `assert_allowed_pair` unchanged. No new unauthenticated admin surface.
OutputFee query `if let Ok`	Failed/missing `OutputFee` skips fee forwarding but burn hook `AfterSwap` errors on insufficient forwarded balance (atomic swap rollback). Tax hook `AfterSwap` is attribute-only post-settlement. Residual mis-collection requires a governance-registered hook — within documented trust model.
`min_return` vs net output	`min_return` still asserted on gross `total_return` before hook deductions; users on hooked pairs receive `total_return − hook fees`. Documented breaking integrator semantics; not a non-governance attack path (hook registration is governance-gated).
Ops script	`verify-whitelist-cw20-code-ids.sh` is read-only LCD `CodeInfo` verification for trusted operators; no production runtime attack surface.

Inline threads: None (no medium+ findings to anchor).

Security review: no medium+ findings on this diff.

## Security review — MR !905 **Commit reviewed:** `a688b6e5a8d5abe4667191623ce77e44074c600b` **Scope:** Pair swap settlement (`OutputFee` query + ask-token forwarding), tax/burn hook I-02 semantics, LP-burn hook H-03 caller/`liquidity_token` validation, ops runbooks (`cw20-code-id-ops`, `hook-registration`), `scripts/verify-whitelist-cw20-code-ids.sh`, and related test/doc updates. **Method:** Full MR diff review with attacker-controlled input tracing to sinks (hook registration auth, `AfterSwap` callbacks, CW20 `Transfer` recipients, `min_return` / slippage paths). Cross-checked against `docs/contracts-security-audit.md` trust model (non-governance attack paths). Ran `cargo test adversarial` (7/7 pass). **Outcome:** `FINDINGS: 0` medium+ **Summary:** This MR hardens previously identified issues rather than introducing new exploitable paths for non-governance callers. | Area | Result | |------|--------| | **H-03 LP-burn spoof** | `AfterSwap.pair` must equal `info.sender`; caller must match `target_pair`; on-chain `Pair {}` `liquidity_token` validated. Spoof test now expects rejection — closes prior allowlist griefing path. | | **I-02 settlement** | Pair queries registered hooks' `OutputFee`, sums fees with `checked_add`, rejects when fees exceed `total_return`, forwards fees before receiver payout, then dispatches `AfterSwap`. Tax/burn no longer subsidize from pre-funded treasuries. | | **Hook auth boundary** | `SetPairHooks` remains governance-only via factory; hook `assert_allowed_pair` unchanged. No new unauthenticated admin surface. | | **OutputFee query `if let Ok`** | Failed/missing `OutputFee` skips fee forwarding but burn hook `AfterSwap` errors on insufficient forwarded balance (atomic swap rollback). Tax hook `AfterSwap` is attribute-only post-settlement. Residual mis-collection requires a governance-registered hook — within documented trust model. | | **`min_return` vs net output** | `min_return` still asserted on gross `total_return` before hook deductions; users on hooked pairs receive `total_return − hook fees`. Documented breaking integrator semantics; not a non-governance attack path (hook registration is governance-gated). | | **Ops script** | `verify-whitelist-cw20-code-ids.sh` is read-only LCD `CodeInfo` verification for trusted operators; no production runtime attack surface. | **Inline threads:** None (no medium+ findings to anchor). Security review: **no medium+ findings** on this diff.

ghost1 commented

2026-06-13 14:03:12 +00:00

(Migrated from gitlab.com)

added 1 commit

0e5b7505 - fix(pair): enforce min_return against net output after hook fees

Compare with previous version

added 1 commit <ul><li>0e5b7505 - fix(pair): enforce min_return against net output after hook fees</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/187/diffs?diff_id=1850342194&start_sha=a688b6e5a8d5abe4667191623ce77e44074c600b)

ghost1 commented

2026-06-13 14:03:27 +00:00

(Migrated from gitlab.com)

changed the description

ghost1 commented

2026-06-13 14:03:33 +00:00

(Migrated from gitlab.com)

resolved all threads

PlasticDigits commented

2026-06-13 14:15:59 +00:00

(Migrated from gitlab.com)

changed this line in version 3 of the diff

changed this line in [version 3 of the diff](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/187/diffs?diff_id=1850346217&start_sha=0e5b75055348dc8e3f66ddc29de48a8a1057c756#1802471b43a600c2c68314bfa68b35a80c30dd1e_1166_1167)

PlasticDigits commented

2026-06-13 14:15:59 +00:00

(Migrated from gitlab.com)

added 11 commits

0e5b7505...9f1d4cb2 - 10 commits from branch main
5557301a - Merge branch 'main' into verify/issue-377-hook-hardening

Compare with previous version

added 11 commits <ul><li>0e5b7505...9f1d4cb2 - 10 commits from branch <code>main</code></li><li>5557301a - Merge branch 'main' into verify/issue-377-hook-hardening</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/187/diffs?diff_id=1850346217&start_sha=0e5b75055348dc8e3f66ddc29de48a8a1057c756)

PlasticDigits commented

2026-06-13 14:16:02 +00:00

(Migrated from gitlab.com)

Resolved merge conflicts with main by aligning with the already-merged #377 implementation on main:

Pair/hooks: hook_settlement (GetConfig-based fee deduction), LP-burn assert_pair_caller, net min_return checks
Docs/runbooks: hook-registration.md, cw20-whitelist-policy.md, audit/security cross-links
Tests: main adversarial suite (lp_burn_hook_rejects_spoofed_pair_*, tax_hook_min_return_checked_against_net_payout)

Dropped verify-branch OutputFee query/msg drift that conflicted with main's settlement path.

Sanity: cargo test adversarial (9/9) and hook crate tests pass locally.

Resolved merge conflicts with `main` by aligning with the already-merged #377 implementation on `main`: - **Pair/hooks:** `hook_settlement` (`GetConfig`-based fee deduction), LP-burn `assert_pair_caller`, net `min_return` checks - **Docs/runbooks:** `hook-registration.md`, `cw20-whitelist-policy.md`, audit/security cross-links - **Tests:** main adversarial suite (`lp_burn_hook_rejects_spoofed_pair_*`, `tax_hook_min_return_checked_against_net_payout`) Dropped verify-branch `OutputFee` query/msg drift that conflicted with main's settlement path. Sanity: `cargo test adversarial` (9/9) and hook crate tests pass locally.

ghost1 commented

2026-06-13 14:16:26 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-06-13 14:18:00 +00:00

(Migrated from gitlab.com)

Security review — MR !905

Commit reviewed: 5557301a0997575bae25f084f2ae7ed6dec183fd

Scope (current diff vs main): docs/runbooks/cw20-code-id-ops.md and scripts/verify-whitelist-cw20-code-ids.sh only. Pair/hook contract remediation (#377 H-02/H-03/I-02) and net min_return settlement are already on main after merge-conflict resolution; not re-reviewed here.

Method: MR diff review with attacker-controlled input tracing on the ops script (LCD_URL, EXPECTED_CW20_CODE_IDS, EXPECTED_CW20_CHECKSUMS → curl URL construction and jq parsing). Cross-checked prior threads (Bugbot min_return on gross output — stale for this diff; fixed on main via net_return slippage check and tax_hook_min_return_checked_against_net_payout).

Outcome: FINDINGS: 0 medium+

Area	Result
Ops script	Read-only LCD `CodeInfo` queries for trusted pre-launch operators. Env vars are quoted; no shell metacharacter expansion or command injection sink. `code_id` is path-segment interpolated into an HTTPS LCD URL — operator-controlled, not an on-chain or dapp user attack surface.
Checksum gate	Optional `EXPECTED_CW20_CHECKSUMS` mismatch fails closed; does not whitelist or mutate chain state.
Runbook	Documents fee-on-transfer prohibition and verification checklist (H-01 guardrail). No secret material or unsafe operational guidance beyond standard governance LCD queries.
Prior Bugbot thread	`min_return` vs hook fees targeted removed pair-settlement lines no longer in this MR; `main` enforces `min_return` against `net_return` after hook fee deduction.

Inline threads: None (no medium+ findings to anchor).

Security review: no medium+ findings on this diff.

## Security review — MR !905 **Commit reviewed:** `5557301a0997575bae25f084f2ae7ed6dec183fd` **Scope (current diff vs `main`):** `docs/runbooks/cw20-code-id-ops.md` and `scripts/verify-whitelist-cw20-code-ids.sh` only. Pair/hook contract remediation (#377 H-02/H-03/I-02) and net `min_return` settlement are already on `main` after merge-conflict resolution; not re-reviewed here. **Method:** MR diff review with attacker-controlled input tracing on the ops script (`LCD_URL`, `EXPECTED_CW20_CODE_IDS`, `EXPECTED_CW20_CHECKSUMS` → `curl` URL construction and `jq` parsing). Cross-checked prior threads (Bugbot `min_return` on gross output — stale for this diff; fixed on `main` via `net_return` slippage check and `tax_hook_min_return_checked_against_net_payout`). **Outcome:** `FINDINGS: 0` medium+ | Area | Result | |------|--------| | **Ops script** | Read-only LCD `CodeInfo` queries for trusted pre-launch operators. Env vars are quoted; no shell metacharacter expansion or command injection sink. `code_id` is path-segment interpolated into an HTTPS LCD URL — operator-controlled, not an on-chain or dapp user attack surface. | | **Checksum gate** | Optional `EXPECTED_CW20_CHECKSUMS` mismatch fails closed; does not whitelist or mutate chain state. | | **Runbook** | Documents fee-on-transfer prohibition and verification checklist (H-01 guardrail). No secret material or unsafe operational guidance beyond standard governance LCD queries. | | **Prior Bugbot thread** | `min_return` vs hook fees targeted removed pair-settlement lines no longer in this MR; `main` enforces `min_return` against `net_return` after hook fee deduction. | **Inline threads:** None (no medium+ findings to anchor). Security review: **no medium+ findings** on this diff.

PlasticDigits commented

2026-06-14 02:54:27 +00:00

(Migrated from gitlab.com)

mentioned in commit 0ca7e9865a

mentioned in commit 0ca7e9865a4deaad1758133f60ee8e3ad6865b9c

PlasticDigits (Migrated from gitlab.com) merged commit 0ca7e9865a into main

2026-06-14 02:54:27 +00:00

Rows
Columns

Verify #377: Harden CosmWasm hooks and CW20/hook ops policy #905

Summary

Acceptance checklist

Test plan

Follow-ups

min_return ignores hook output fees

Security review — MR !905

Security review — MR !905