Security (CW-20): cw20-mintable git dependency not pinned to commit SHA

Brouie commented

2026-04-21 08:16:35 +00:00

(Migrated from gitlab.com)

@PlasticDigits finding from security review on #5.

Severity

Medium. Supply-chain risk — affects every future clean build.

Description

Workspace Cargo.toml:

[workspace.dependencies]
cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", features = ["library"] }

No rev, tag, or branch specified. Cargo resolves this to the default branch HEAD at the time of cargo build or cargo update.

Why this matters

Whatever commit happens to be on the default branch of github.com/PlasticDigits/cw20-mintable when a build runs is what gets compiled into ust1-oracle and ust1-window. That includes:

Fresh CI builds from scratch
make build-optimized for release artifacts
Local developer rebuilds after cargo clean
Any node that restores the workspace without the committed Cargo.lock

Risks:

Upstream compromise: if cw20-mintable repo is breached (push access, account takeover), attacker commits can flow directly into the next clean build
Force-push drift: if the default branch is force-pushed, Cargo.lock will disagree with the remote hash on the next cargo update and developers may paper over with --allow-dirty
Accidental breakage: a legitimate but breaking change on cw20-mintable main affects both ust1-oracle and ust1-window simultaneously, with no pinned fallback

Since cw20-mintable is first-party (PlasticDigits/...), the compromise surface is the same GitHub org running this contract — but a pinned SHA bounds the blast radius to "review each bump" rather than "trust all future commits on main".

Recommendation

Pin to a specific commit SHA:

cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", rev = "<40-char-sha>", features = ["library"] }

Bumping the pin then becomes an explicit, reviewable change. Optionally use tag if the cw20-mintable repo publishes semver tags.

Additionally, consider running cargo audit and cargo deny in CI (observed to not be available on QA server this session — worth adding as a GitHub Actions step against committed Cargo.lock).

Review parent: #5
Related recommendation: add cargo audit + cargo deny to CI (EVM-19 hygiene)

@PlasticDigits finding from security review on #5. ## Severity Medium. Supply-chain risk — affects every future clean build. ## Description Workspace `Cargo.toml`: ```toml [workspace.dependencies] cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", features = ["library"] } ``` No `rev`, `tag`, or `branch` specified. Cargo resolves this to the default branch HEAD at the time of `cargo build` or `cargo update`. ## Why this matters Whatever commit happens to be on the default branch of `github.com/PlasticDigits/cw20-mintable` when a build runs is what gets compiled into ust1-oracle and ust1-window. That includes: - Fresh CI builds from scratch - `make build-optimized` for release artifacts - Local developer rebuilds after `cargo clean` - Any node that restores the workspace without the committed `Cargo.lock` Risks: - **Upstream compromise:** if `cw20-mintable` repo is breached (push access, account takeover), attacker commits can flow directly into the next clean build - **Force-push drift:** if the default branch is force-pushed, `Cargo.lock` will disagree with the remote hash on the next `cargo update` and developers may paper over with `--allow-dirty` - **Accidental breakage:** a legitimate but breaking change on cw20-mintable main affects both ust1-oracle and ust1-window simultaneously, with no pinned fallback Since `cw20-mintable` is first-party (PlasticDigits/...), the compromise surface is the same GitHub org running this contract — but a pinned SHA bounds the blast radius to "review each bump" rather than "trust all future commits on main". ## Recommendation Pin to a specific commit SHA: ```toml cw20-mintable = { git = "https://github.com/PlasticDigits/cw20-mintable", rev = "<40-char-sha>", features = ["library"] } ``` Bumping the pin then becomes an explicit, reviewable change. Optionally use `tag` if the cw20-mintable repo publishes semver tags. Additionally, consider running `cargo audit` and `cargo deny` in CI (observed to not be available on QA server this session — worth adding as a GitHub Actions step against committed Cargo.lock). ## Related - Review parent: #5 - Related recommendation: add `cargo audit` + `cargo deny` to CI (EVM-19 hygiene)

Brouie commented

2026-04-21 08:17:07 +00:00

(Migrated from gitlab.com)

mentioned in issue #5

PlasticDigits commented

2026-04-21 13:48:45 +00:00

(Migrated from gitlab.com)

mentioned in commit 7bcc285afe

mentioned in commit 7bcc285afe1cde0391291ec152bdff980c2e5313

PlasticDigits commented

2026-04-21 13:48:49 +00:00

(Migrated from gitlab.com)

cw20-mintable pinned (CW-20 / #14)

Pinned SHA: 73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8 — this is HEAD of PlasticDigits/cw20-mintable at the time of the change (git ls-remote … HEAD), matching what was already resolved in Cargo.lock so behavior is unchanged; the manifest now encodes the same revision explicitly.

Changes: Workspace Cargo.toml uses rev = "73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8" for the git dependency; Cargo.lock source URL updated to the ?rev= form.

Workflow: Implemented on branch fix/issue-14-pin-cw20-mintable in a git worktree, rebased onto latest main, merged (fast-forward), verified with cargo check --workspace, pushed to origin/main (merge commit: 7bcc285).

Bumping the dependency is now an explicit, reviewable edit to rev (or a tag if you publish those).

## cw20-mintable pinned (CW-20 / #14) **Pinned SHA:** `73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8` — this is `HEAD` of [PlasticDigits/cw20-mintable](https://github.com/PlasticDigits/cw20-mintable) at the time of the change (`git ls-remote … HEAD`), matching what was already resolved in `Cargo.lock` so behavior is unchanged; the manifest now encodes the same revision explicitly. **Changes:** Workspace `Cargo.toml` uses `rev = "73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8"` for the git dependency; `Cargo.lock` source URL updated to the `?rev=` form. **Workflow:** Implemented on branch `fix/issue-14-pin-cw20-mintable` in a git worktree, rebased onto latest `main`, merged (fast-forward), verified with `cargo check --workspace`, pushed to `origin/main` (merge commit: `7bcc285`). Bumping the dependency is now an explicit, reviewable edit to `rev` (or a tag if you publish those).

Brouie commented

2026-04-22 00:33:54 +00:00

(Migrated from gitlab.com)

@PlasticDigits verified fix on 7bcc285.

Cargo.toml workspace dep now cw20-mintable = { git = "...", rev = "73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8", features = ["library"] }
Cargo.lock source line updated: git+https://github.com/PlasticDigits/cw20-mintable?rev=73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8#73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8

Clean builds now locked to this SHA. Future bumps require explicit reviewable change to Cargo.toml. Supply-chain risk closed.

@PlasticDigits verified fix on 7bcc285. - `Cargo.toml` workspace dep now `cw20-mintable = { git = "...", rev = "73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8", features = ["library"] }` - `Cargo.lock` source line updated: `git+https://github.com/PlasticDigits/cw20-mintable?rev=73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8#73a206b5c39c5bd8f9d3574bda32fc5ae8f52ec8` Clean builds now locked to this SHA. Future bumps require explicit reviewable change to Cargo.toml. Supply-chain risk closed.

Brouie (Migrated from gitlab.com) closed this issue

2026-04-22 00:33:56 +00:00

Rows
Columns

Security (CW-20): cw20-mintable git dependency not pinned to commit SHA #14

Severity

Description

Why this matters

Recommendation

Related

cw20-mintable pinned (CW-20 / #14)