SEC-D02: IBC-hooks deploy runbook gate (#407) #932
No reviewers
Labels
No labels
agent:fix_bugfix
agent:fix_conflicts
agent:fix_security
agent:gap_analysis
agent:implement
agent:implement
agent:implement
agent:open_issues
agent:ready
agent:research
agent:security_audit
agent:verify
architecture
backend
blocker:hybrid
blocker:launch
blocker:limit-orders
blocker:v2
block:log_only
block:security
bug
ci
contracts
correctness
deploy
dev
devops
docs
documentation
duplicate
e2e
enhancement
epic
feature
frontend
functional-completion
gas
good first issue
governance
help wanted
high-risk
hooks
hybrid
indexer
infra
infrastructure
integrators
invalid
launch-blocker
limit-orders
localnet
localterra
low priority
missing-implementation
needs-design
ops
performance
priority
high
priority
medium
product
qa
QA
question
ready
ready
research
scripts
security
security-hardening
smartcontracts
tech-debt
testing
ux
UX
v2
verification
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
code/cl8y-dex-terraclassic!932
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-407-ibc-hooks-deploy-runbook-sec-d02"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Adds the SEC-D02 deploy runbook gate requested in #407: operators must record Terra Classic chain version and IBC-hooks module exposure at deploy time, attest that CL8Y DEX app contracts do not expose IBC receive/ack/timeout CosmWasm entry points, and re-verify after chain upgrades or new contract modules.
Changes:
terradprobe commands, operator attestation template, and links to security model + agent playbookdocs/deployment-guide.mdmake verify-no-ibc-hooks-in-contracts(static grep),make check-ibc-hooks-deploy-docs,make verify-issue-407scripts/lib/record-chain-ibc-hooks-version.shskills/AGENTS_IBC_HOOKS_DEPLOY.mdRelated to #407 (issue stays open until merge).
Acceptance checklist
docs/runbooks/launch-checklist.mdPhase 0 SEC-D02 block;make check-ibc-hooks-deploy-docsmake verify-no-ibc-hooks-in-contractsdocs/deployment-guide.mdPost-Deployment Checklist SEC-D02 itemmake verify-issue-407Verification checklist (third parties)
Optional (production LCD):
TERRA_LCD_URL=https://lcd.terra.dev ./scripts/lib/record-chain-ibc-hooks-version.shTest plan
make verify-issue-407— 6/6 PASSmake check-ibc-hooks-deploy-docs— doc drift guard PASSmake verify-no-ibc-hooks-in-contracts— no IBC entry-point patterns insmartcontracts/contracts/Security review — MR !932
Commit reviewed:
7af3556e66757f557ef43bdb9baca96fea22aa68Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (
scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh).Method: Full MR diff review; traced attacker-controlled inputs to sinks in new/modified executable paths; compared
TERRA_LCD_URLhandling to existing operator scripts; ranmake verify-issue-407(6/6 PASS). No prior security-review threads on this MR.Outcome:
FINDINGS: 0medium+Inline threads: none (no medium+ findings to anchor)
Areas examined (no issues)
record-chain-ibc-hooks-version.shpassesTERRA_LCD_URLvia quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.Security review: no medium+ findings on this diff.
added 11 commits
main4b844baf- Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02Compare with previous version
Resolved merge conflicts with
mainby integrating both feature sets:.PHONYandlinttargets to include SEC-D02 (check-ibc-hooks-deploy-docs,verify-no-ibc-hooks-in-contracts,verify-issue-407) alongside SEC-B09 governance emergency rehearsal targets from main.Sanity:
make verify-issue-407,make check-ibc-hooks-deploy-docs, andmake check-governance-emergency-rehearsal-docsall pass.Security review — MR !932 (re-review)
Commit reviewed:
4b844baf67da1c1f2e86ab556eefa43e1c85773bScope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation, Makefile targets, static contract grep (
scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after merge-conflict resolution withmain(prior review was on7af3556e).Method: Full MR diff vs
main; traced attacker-controlled inputs to sinks in new/modified executable paths; comparedTERRA_LCD_URLhandling to existing operator scripts (smoke-pool-swap.sh,verify-cw20-code-ids.sh); ranmake verify-issue-407(6/6 PASS).Outcome:
FINDINGS: 0medium+Inline threads: none (no medium+ findings to anchor)
Areas examined (no issues)
record-chain-ibc-hooks-version.shpassesTERRA_LCD_URLvia quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.Security review: no medium+ findings on this diff.
added 6 commits
mainb7e67faf- Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02Compare with previous version
Resolved merge conflict with
maininMakefileby combining both sides:check-ibc-hooks-deploy-docs,verify-no-ibc-hooks-in-contracts,verify-issue-407main:check-emergency-commands-docs,verify-issue-399.PHONY,lint, andhelpto include all targets from both branchesSanity checks:
make check-ibc-hooks-deploy-docs,make check-emergency-commands-docs, andmake verify-no-ibc-hooks-in-contractsall pass.Security review — MR !932
Commit reviewed:
b7e67faf8c452130efcf80490f961f18f9c41e9eScope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (
launch-checklist.md,deployment-guide.md,security-model.md,testing.md, agent skill), Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after merge withmain(prior reviews:7af3556e,4b844baf).Method: Full MR diff vs
main; traced attacker-controlled inputs to sinks in new/modified executable paths; comparedTERRA_LCD_URLhandling to existing operator scripts (smoke-pool-swap.sh,verify-cw20-code-ids.sh); ranmake verify-issue-407(6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head.Outcome:
FINDINGS: 0medium+Inline threads: none (no medium+ findings to anchor)
Areas examined (no issues)
record-chain-ibc-hooks-version.shpassesTERRA_LCD_URLvia quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.Security review: no medium+ findings on this diff.
added 6 commits
mainf05612cf- Merge branch 'main' into issue-407-ibc-hooks-deploy-runbook-sec-d02Compare with previous version
Resolved merge conflicts with
main(commitf05612cf).Makefile — kept both SEC-D02 targets (
check-ibc-hooks-deploy-docs,verify-no-ibc-hooks-in-contracts,verify-issue-407) and main's SEC-D12 deploy-trace targets (check-deploy-trace-docs,verify-issue-410); updated.PHONY,lint, andhelpaccordingly.docs/deployment-guide.md — post-deployment checklist now includes both the SEC-D02 IBC-hooks gate item and the deploy-trace item from main.
Sanity:
make verify-issue-407,make check-ibc-hooks-deploy-docs, andmake check-deploy-trace-docsall pass.mentioned in commit
6c23276f89Security review — MR !932
Commit reviewed:
f05612cfec8e8532606e2d3106a785aa67741897Scope: SEC-D02 IBC-hooks deploy runbook gate (#407) — documentation (
launch-checklist.md,deployment-guide.md,security-model.md,testing.md, agent skill), Makefile targets, static contract grep (scripts/verify-no-ibc-hooks-in-contracts.sh), doc drift guard (scripts/check_ibc_hooks_deploy_docs.py), QA verifier (scripts/qa/verify-issue-407.sh), optional operator LCD helper (scripts/lib/record-chain-ibc-hooks-version.sh). Re-reviewed after latest merge withmain(prior reviews:7af3556e,4b844baf,b7e67faf).Method: Full MR diff vs
main(0e2eaa8d..f05612cf); traced attacker-controlled inputs to sinks in new/modified executable paths; comparedTERRA_LCD_URLhandling to existing operator scripts (smoke-pool-swap.sh,verify-cw20-code-ids.sh); ranmake verify-issue-407(6/6 PASS). Prior security-review threads reported zero medium+ findings; re-validated with fresh evidence on current head.Outcome:
FINDINGS: 0medium+Inline threads: none (no medium+ findings to anchor)
Areas examined (no issues)
record-chain-ibc-hooks-version.shpassesTERRA_LCD_URLvia quoted array (NODE_FLAG=(--node "$LCD_URL")); no shell metacharacter expansion. Doc/QA scripts read fixed repo paths only; no user-controlled paths.make lint/verify-issue-407); same intentional pattern as existing deploy/smoke scripts.smartcontracts/contracts/; contracts currently have zero IBC callback patterns. Grep limitations are control-effectiveness, not new exploitable attack surface.Security review: no medium+ findings on this diff.