SEC-D02: IBC-hooks deploy runbook gate (#407) #932

Merged
PlasticDigits merged 4 commits from issue-407-ibc-hooks-deploy-runbook-sec-d02 into main 2026-06-19 14:43:18 +00:00
PlasticDigits commented 2026-06-19 13:18:56 +00:00 (Migrated from gitlab.com)

Summary

Adds the SEC-D02 deploy runbook gate requested in #407: operators must record Terra Classic chain version and IBC-hooks module exposure at deploy time, attest that CL8Y DEX app contracts do not expose IBC receive/ack/timeout CosmWasm entry points, and re-verify after chain upgrades or new contract modules.

Changes:

  • Phase 0 launch checklist item with terrad probe commands, operator attestation template, and links to security model + agent playbook
  • Post-deployment checklist entry in docs/deployment-guide.md
  • Security model section documenting IBC-hooks chain dependency vs after-swap hooks
  • Automated verification: make verify-no-ibc-hooks-in-contracts (static grep), make check-ibc-hooks-deploy-docs, make verify-issue-407
  • Operator helper: scripts/lib/record-chain-ibc-hooks-version.sh
  • Agent playbook: skills/AGENTS_IBC_HOOKS_DEPLOY.md

Related to #407 (issue stays open until merge).

Acceptance checklist

Criterion Verification Result
Launch runbook records Terra Classic chain version + IBC-hooks module version at deploy time docs/runbooks/launch-checklist.md Phase 0 SEC-D02 block; make check-ibc-hooks-deploy-docs PASS
Checklist includes explicit statement that deployed contracts do not use IBC hooks Phase 0 operator attestation + make verify-no-ibc-hooks-in-contracts PASS
Step requires re-review when chain is upgraded or contracts extended Phase 0 text + security-model § IBC hooks chain dependency PASS
Deployment guide cross-linked docs/deployment-guide.md Post-Deployment Checklist SEC-D02 item PASS
Automated regression make verify-issue-407 PASS

Verification checklist (third parties)

make verify-issue-407
make check-ibc-hooks-deploy-docs
make verify-no-ibc-hooks-in-contracts
grep -n SEC-D02 docs/runbooks/launch-checklist.md docs/deployment-guide.md docs/security-model.md

Optional (production LCD): TERRA_LCD_URL=https://lcd.terra.dev ./scripts/lib/record-chain-ibc-hooks-version.sh

Test plan

  • make verify-issue-407 — 6/6 PASS
  • make check-ibc-hooks-deploy-docs — doc drift guard PASS
  • make verify-no-ibc-hooks-in-contracts — no IBC entry-point patterns in smartcontracts/contracts/
## Summary Adds the **SEC-D02** deploy runbook gate requested in #407: operators must record Terra Classic chain version and IBC-hooks module exposure at deploy time, attest that CL8Y DEX app contracts do not expose IBC receive/ack/timeout CosmWasm entry points, and re-verify after chain upgrades or new contract modules. Changes: - **Phase 0** launch checklist item with `terrad` probe commands, operator attestation template, and links to security model + agent playbook - Post-deployment checklist entry in `docs/deployment-guide.md` - **Security model** section documenting IBC-hooks chain dependency vs after-swap hooks - Automated verification: `make verify-no-ibc-hooks-in-contracts` (static grep), `make check-ibc-hooks-deploy-docs`, `make verify-issue-407` - Operator helper: `scripts/lib/record-chain-ibc-hooks-version.sh` - Agent playbook: `skills/AGENTS_IBC_HOOKS_DEPLOY.md` Related to #407 (issue stays open until merge). ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Launch runbook records Terra Classic chain version + IBC-hooks module version at deploy time | `docs/runbooks/launch-checklist.md` Phase 0 SEC-D02 block; `make check-ibc-hooks-deploy-docs` | PASS | | Checklist includes explicit statement that deployed contracts do not use IBC hooks | Phase 0 operator attestation + `make verify-no-ibc-hooks-in-contracts` | PASS | | Step requires re-review when chain is upgraded or contracts extended | Phase 0 text + security-model § IBC hooks chain dependency | PASS | | Deployment guide cross-linked | `docs/deployment-guide.md` Post-Deployment Checklist SEC-D02 item | PASS | | Automated regression | `make verify-issue-407` | PASS | ## Verification checklist (third parties) ```bash make verify-issue-407 make check-ibc-hooks-deploy-docs make verify-no-ibc-hooks-in-contracts grep -n SEC-D02 docs/runbooks/launch-checklist.md docs/deployment-guide.md docs/security-model.md ``` Optional (production LCD): `TERRA_LCD_URL=https://lcd.terra.dev ./scripts/lib/record-chain-ibc-hooks-version.sh` ## Test plan - [x] `make verify-issue-407` — 6/6 PASS - [x] `make check-ibc-hooks-deploy-docs` — doc drift guard PASS - [x] `make verify-no-ibc-hooks-in-contracts` — no IBC entry-point patterns in `smartcontracts/contracts/`
PlasticDigits commented 2026-06-19 13:21:22 +00:00 (Migrated from gitlab.com)

Security review — MR !932

Commit reviewed: 7af3556e66757f557ef43bdb9baca96fea22aa68
Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh).

Method: Full MR diff review; traced attacker-controlled inputs to sinks in new/modified executable paths; compared TERRA_LCD_URL handling to existing operator scripts; ran make verify-issue-407 (6/6 PASS). No prior security-review threads on this MR.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings to anchor)

Areas examined (no issues)

Area Result
Injection record-chain-ibc-hooks-version.sh passes TERRA_LCD_URL via quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.
SSRF LCD helper is operator-invoked only (not in CI/make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.
Authn/authz No runtime auth surfaces added.
Secret leakage / logging Scripts emit chain version metadata only; no credentials.
Supply chain No new dependencies.
On-chain / CosmWasm Static grep is a deploy-time posture check on fixed smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.

Security review: no medium+ findings on this diff.

## Security review — MR !932 **Commit reviewed:** `7af3556e66757f557ef43bdb9baca96fea22aa68` **Scope:** SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (`scripts/verify-no-ibc-hooks-in-contracts.sh`), doc drift guard (`scripts/check_ibc_hooks_deploy_docs.py`), QA verifier (`scripts/qa/verify-issue-407.sh`), optional operator LCD helper (`scripts/lib/record-chain-ibc-hooks-version.sh`). **Method:** Full MR diff review; traced attacker-controlled inputs to sinks in new/modified executable paths; compared `TERRA_LCD_URL` handling to existing operator scripts; ran `make verify-issue-407` (6/6 PASS). No prior security-review threads on this MR. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings to anchor) ### Areas examined (no issues) | Area | Result | |------|--------| | **Injection** | `record-chain-ibc-hooks-version.sh` passes `TERRA_LCD_URL` via quoted array (`NODE_FLAG=(--node "$LCD_URL")`); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths. | | **SSRF** | LCD helper is operator-invoked only (not in CI/`make lint`/`verify-issue-407`); same intentional pattern as existing deploy/smoke scripts. | | **Authn/authz** | No runtime auth surfaces added. | | **Secret leakage / logging** | Scripts emit chain version metadata only; no credentials. | | **Supply chain** | No new dependencies. | | **On-chain / CosmWasm** | Static grep is a deploy-time posture check on fixed `smartcontracts/contracts/`; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface. | **Security review: no medium+ findings on this diff.**
PlasticDigits commented 2026-06-19 13:51:19 +00:00 (Migrated from gitlab.com)

added 11 commits

  • 7af3556e...e9d32c9b - 10 commits from branch main
  • 4b844baf - Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02

Compare with previous version

added 11 commits <ul><li>7af3556e...e9d32c9b - 10 commits from branch <code>main</code></li><li>4b844baf - Merge branch &#39;main&#39; into issue-407-ibc-hooks-deploy-runbook-sec-d02</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/214/diffs?diff_id=1861290610&start_sha=7af3556e66757f557ef43bdb9baca96fea22aa68)
PlasticDigits commented 2026-06-19 13:51:24 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main by integrating both feature sets:

  • Makefile — merged .PHONY and lint targets to include SEC-D02 (check-ibc-hooks-deploy-docs, verify-no-ibc-hooks-in-contracts, verify-issue-407) alongside SEC-B09 governance emergency rehearsal targets from main.
  • skills/AGENTS_LAUNCH_GO_NO_GO.md — kept both related-playbook links (SEC-D02 IBC-hooks deploy + SEC-B09 governance emergency rehearsal).

Sanity: make verify-issue-407, make check-ibc-hooks-deploy-docs, and make check-governance-emergency-rehearsal-docs all pass.

Resolved merge conflicts with `main` by integrating both feature sets: - **Makefile** — merged `.PHONY` and `lint` targets to include SEC-D02 (`check-ibc-hooks-deploy-docs`, `verify-no-ibc-hooks-in-contracts`, `verify-issue-407`) alongside SEC-B09 governance emergency rehearsal targets from main. - **skills/AGENTS_LAUNCH_GO_NO_GO.md** — kept both related-playbook links (SEC-D02 IBC-hooks deploy + SEC-B09 governance emergency rehearsal). Sanity: `make verify-issue-407`, `make check-ibc-hooks-deploy-docs`, and `make check-governance-emergency-rehearsal-docs` all pass.
PlasticDigits commented 2026-06-19 13:53:12 +00:00 (Migrated from gitlab.com)

Security review — MR !932 (re-review)

Commit reviewed: 4b844baf67da1c1f2e86ab556eefa43e1c85773b
Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after merge-conflict resolution with main (prior review was on 7af3556e).

Method: Full MR diff vs main; traced attacker-controlled inputs to sinks in new/modified executable paths; compared TERRA_LCD_URL handling to existing operator scripts (smoke-pool-swap.sh, verify-cw20-code-ids.sh); ran make verify-issue-407 (6/6 PASS).

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings to anchor)

Areas examined (no issues)

Area Result
Injection record-chain-ibc-hooks-version.sh passes TERRA_LCD_URL via quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.
SSRF LCD helper is operator-invoked only (not in CI/make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.
Authn/authz No runtime auth surfaces added.
Secret leakage / logging Scripts emit chain version metadata only; no credentials.
Supply chain No new dependencies.
On-chain / CosmWasm Static grep is a deploy-time posture check on fixed smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.

Security review: no medium+ findings on this diff.

## Security review — MR !932 (re-review) **Commit reviewed:** `4b844baf67da1c1f2e86ab556eefa43e1c85773b` **Scope:** SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (`scripts/verify-no-ibc-hooks-in-contracts.sh`), doc drift guard (`scripts/check_ibc_hooks_deploy_docs.py`), QA verifier (`scripts/qa/verify-issue-407.sh`), optional operator LCD helper (`scripts/lib/record-chain-ibc-hooks-version.sh`). Re-reviewed after merge-conflict resolution with `main` (prior review was on `7af3556e`). **Method:** Full MR diff vs `main`; traced attacker-controlled inputs to sinks in new/modified executable paths; compared `TERRA_LCD_URL` handling to existing operator scripts (`smoke-pool-swap.sh`, `verify-cw20-code-ids.sh`); ran `make verify-issue-407` (6/6 PASS). **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings to anchor) ### Areas examined (no issues) | Area | Result | |------|--------| | **Injection** | `record-chain-ibc-hooks-version.sh` passes `TERRA_LCD_URL` via quoted array (`NODE_FLAG=(--node "$LCD_URL")`); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths. | | **SSRF** | LCD helper is operator-invoked only (not in CI/`make lint`/`verify-issue-407`); same intentional pattern as existing deploy/smoke scripts. | | **Authn/authz** | No runtime auth surfaces added. | | **Secret leakage / logging** | Scripts emit chain version metadata only; no credentials. | | **Supply chain** | No new dependencies. | | **On-chain / CosmWasm** | Static grep is a deploy-time posture check on fixed `smartcontracts/contracts/`; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface. | **Security review: no medium+ findings on this diff.**
PlasticDigits commented 2026-06-19 14:20:46 +00:00 (Migrated from gitlab.com)

added 6 commits

  • 4b844baf...6f4fd29b - 5 commits from branch main
  • b7e67faf - Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02

Compare with previous version

added 6 commits <ul><li>4b844baf...6f4fd29b - 5 commits from branch <code>main</code></li><li>b7e67faf - Merge branch &#39;main&#39; into issue-407-ibc-hooks-deploy-runbook-sec-d02</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/214/diffs?diff_id=1861350868&start_sha=4b844baf67da1c1f2e86ab556eefa43e1c85773b)
PlasticDigits commented 2026-06-19 14:20:49 +00:00 (Migrated from gitlab.com)

Resolved merge conflict with main in Makefile by combining both sides:

  • Kept SEC-D02 targets from this branch: check-ibc-hooks-deploy-docs, verify-no-ibc-hooks-in-contracts, verify-issue-407
  • Kept emergency-commands targets from main: check-emergency-commands-docs, verify-issue-399
  • Updated .PHONY, lint, and help to include all targets from both branches

Sanity checks: make check-ibc-hooks-deploy-docs, make check-emergency-commands-docs, and make verify-no-ibc-hooks-in-contracts all pass.

Resolved merge conflict with `main` in `Makefile` by combining both sides: - Kept SEC-D02 targets from this branch: `check-ibc-hooks-deploy-docs`, `verify-no-ibc-hooks-in-contracts`, `verify-issue-407` - Kept emergency-commands targets from `main`: `check-emergency-commands-docs`, `verify-issue-399` - Updated `.PHONY`, `lint`, and `help` to include all targets from both branches Sanity checks: `make check-ibc-hooks-deploy-docs`, `make check-emergency-commands-docs`, and `make verify-no-ibc-hooks-in-contracts` all pass.
PlasticDigits commented 2026-06-19 14:22:59 +00:00 (Migrated from gitlab.com)

Security review — MR !932

Commit reviewed: b7e67faf8c452130efcf80490f961f18f9c41e9e
Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (launch-checklist.md, deployment-guide.md, security-model.md, testing.md, agent skill), Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after merge with main (prior reviews: 7af3556e, 4b844baf).

Method: Full MR diff vs main; traced attacker-controlled inputs to sinks in new/modified executable paths; compared TERRA_LCD_URL handling to existing operator scripts (smoke-pool-swap.sh, verify-cw20-code-ids.sh); ran make verify-issue-407 (6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings to anchor)

Areas examined (no issues)

Area Result
Injection record-chain-ibc-hooks-version.sh passes TERRA_LCD_URL via quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.
SSRF LCD helper is operator-invoked only (not in CI/make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.
Authn/authz No runtime auth surfaces added.
Secret leakage / logging Scripts emit chain version metadata only; no credentials.
Supply chain No new dependencies.
On-chain / CosmWasm Static grep is a deploy-time posture check on fixed smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.

Security review: no medium+ findings on this diff.

## Security review — MR !932 **Commit reviewed:** `b7e67faf8c452130efcf80490f961f18f9c41e9e` **Scope:** SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (`launch-checklist.md`, `deployment-guide.md`, `security-model.md`, `testing.md`, agent skill), Makefile targets, static contract grep (`scripts/verify-no-ibc-hooks-in-contracts.sh`), doc drift guard (`scripts/check_ibc_hooks_deploy_docs.py`), QA verifier (`scripts/qa/verify-issue-407.sh`), optional operator LCD helper (`scripts/lib/record-chain-ibc-hooks-version.sh`). Re-reviewed after merge with `main` (prior reviews: `7af3556e`, `4b844baf`). **Method:** Full MR diff vs `main`; traced attacker-controlled inputs to sinks in new/modified executable paths; compared `TERRA_LCD_URL` handling to existing operator scripts (`smoke-pool-swap.sh`, `verify-cw20-code-ids.sh`); ran `make verify-issue-407` (6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings to anchor) ### Areas examined (no issues) | Area | Result | |------|--------| | **Injection** | `record-chain-ibc-hooks-version.sh` passes `TERRA_LCD_URL` via quoted array (`NODE_FLAG=(--node "$LCD_URL")`); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths. | | **SSRF** | LCD helper is operator-invoked only (not in CI/`make lint`/`verify-issue-407`); same intentional pattern as existing deploy/smoke scripts. | | **Authn/authz** | No runtime auth surfaces added. | | **Secret leakage / logging** | Scripts emit chain version metadata only; no credentials. | | **Supply chain** | No new dependencies. | | **On-chain / CosmWasm** | Static grep is a deploy-time posture check on fixed `smartcontracts/contracts/`; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface. | **Security review: no medium+ findings on this diff.**
PlasticDigits commented 2026-06-19 14:40:02 +00:00 (Migrated from gitlab.com)

added 6 commits

  • b7e67faf...0e2eaa8d - 5 commits from branch main
  • f05612cf - Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02

Compare with previous version

added 6 commits <ul><li>b7e67faf...0e2eaa8d - 5 commits from branch <code>main</code></li><li>f05612cf - Merge branch &#39;main&#39; into issue-407-ibc-hooks-deploy-runbook-sec-d02</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/214/diffs?diff_id=1861387754&start_sha=b7e67faf8c452130efcf80490f961f18f9c41e9e)
PlasticDigits commented 2026-06-19 14:40:11 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (commit f05612cf).

Makefile — kept both SEC-D02 targets (check-ibc-hooks-deploy-docs, verify-no-ibc-hooks-in-contracts, verify-issue-407) and main's SEC-D12 deploy-trace targets (check-deploy-trace-docs, verify-issue-410); updated .PHONY, lint, and help accordingly.

docs/deployment-guide.md — post-deployment checklist now includes both the SEC-D02 IBC-hooks gate item and the deploy-trace item from main.

Sanity: make verify-issue-407, make check-ibc-hooks-deploy-docs, and make check-deploy-trace-docs all pass.

Resolved merge conflicts with `main` (commit f05612cf). **Makefile** — kept both SEC-D02 targets (`check-ibc-hooks-deploy-docs`, `verify-no-ibc-hooks-in-contracts`, `verify-issue-407`) and main's SEC-D12 deploy-trace targets (`check-deploy-trace-docs`, `verify-issue-410`); updated `.PHONY`, `lint`, and `help` accordingly. **docs/deployment-guide.md** — post-deployment checklist now includes both the SEC-D02 IBC-hooks gate item and the deploy-trace item from main. Sanity: `make verify-issue-407`, `make check-ibc-hooks-deploy-docs`, and `make check-deploy-trace-docs` all pass.
PlasticDigits commented 2026-06-19 14:43:18 +00:00 (Migrated from gitlab.com)

mentioned in commit 6c23276f89

mentioned in commit 6c23276f896b5fad4da0878594fc8eb5bc3d24eb
PlasticDigits (Migrated from gitlab.com) merged commit 6c23276f89 into main 2026-06-19 14:43:18 +00:00
PlasticDigits commented 2026-06-19 14:43:27 +00:00 (Migrated from gitlab.com)

Security review — MR !932

Commit reviewed: f05612cfec8e8532606e2d3106a785aa67741897
Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (launch-checklist.md, deployment-guide.md, security-model.md, testing.md, agent skill), Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after latest merge with main (prior reviews: 7af3556e, 4b844baf, b7e67faf).

Method: Full MR diff vs main (0e2eaa8d..f05612cf); traced attacker-controlled inputs to sinks in new/modified executable paths; compared TERRA_LCD_URL handling to existing operator scripts (smoke-pool-swap.sh, verify-cw20-code-ids.sh); ran make verify-issue-407 (6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head.

Outcome: FINDINGS: 0 medium+

Inline threads: none (no medium+ findings to anchor)

Areas examined (no issues)

Area Result
Injection record-chain-ibc-hooks-version.sh passes TERRA_LCD_URL via quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.
SSRF LCD helper is operator-invoked only (not in CI/make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.
Authn/authz No runtime auth surfaces added.
Secret leakage / logging Scripts emit chain version metadata only; no credentials.
Supply chain No new dependencies.
On-chain / CosmWasm Static grep is a deploy-time posture check on fixed smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.

Security review: no medium+ findings on this diff.

## Security review — MR !932 **Commit reviewed:** `f05612cfec8e8532606e2d3106a785aa67741897` **Scope:** SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (`launch-checklist.md`, `deployment-guide.md`, `security-model.md`, `testing.md`, agent skill), Makefile targets, static contract grep (`scripts/verify-no-ibc-hooks-in-contracts.sh`), doc drift guard (`scripts/check_ibc_hooks_deploy_docs.py`), QA verifier (`scripts/qa/verify-issue-407.sh`), optional operator LCD helper (`scripts/lib/record-chain-ibc-hooks-version.sh`). Re-reviewed after latest merge with `main` (prior reviews: `7af3556e`, `4b844baf`, `b7e67faf`). **Method:** Full MR diff vs `main` (`0e2eaa8d..f05612cf`); traced attacker-controlled inputs to sinks in new/modified executable paths; compared `TERRA_LCD_URL` handling to existing operator scripts (`smoke-pool-swap.sh`, `verify-cw20-code-ids.sh`); ran `make verify-issue-407` (6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head. **Outcome:** `FINDINGS: 0` medium+ **Inline threads:** none (no medium+ findings to anchor) ### Areas examined (no issues) | Area | Result | |------|--------| | **Injection** | `record-chain-ibc-hooks-version.sh` passes `TERRA_LCD_URL` via quoted array (`NODE_FLAG=(--node "$LCD_URL")`); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths. | | **SSRF** | LCD helper is operator-invoked only (not in CI/`make lint`/`verify-issue-407`); same intentional pattern as existing deploy/smoke scripts. | | **Authn/authz** | No runtime auth surfaces added. | | **Secret leakage / logging** | Scripts emit chain version metadata only; no credentials. | | **Supply chain** | No new dependencies. | | **On-chain / CosmWasm** | Static grep is a deploy-time posture check on fixed `smartcontracts/contracts/`; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface. | **Security review: no medium+ findings on this diff.**
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!932
No description provided.