Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Initia>Threat Model>Module cosmos.move
GeneralOverview
Findings
Critical (3)
High (12)
Medium (4)
Low (9)
Informational (3)
DiscussionGeneral DiscussionImprove AMM testsBridge executor minting powerCharge before using valuesEmpty allowed_publishers array allows every address to publishERC20Keeper with custom contractsSuggestions for additional security checksTable handle overflow leads to abort
Threat ModelWhat are threat models?
stdlibModule block.moveModule table.moveModule event.moveModule type_info.moveModules any.move and copyable_any.moveModule address.moveModule cosmos.moveModule multisig.moveModule object.moveModule transaction_context.moveModule debug.moveModule table_key.moveModule account.moveModule base64.moveModule hex.moveModule from_bcs.moveModule json.moveModule oracle.moveModule code.moveModule zapping.moveModule dex.moveModule reward.moveModule comparator.moveModule managed_coin.moveModules decimal128.move and decimal256.moveModule string_utils.move
Audit ResultsSummary
AppendixProof of concept: Reference safety verifier bypass

Module cosmos.move

This module exposes functions that can be used to interact with Cosmos modules by sending messages.

Function: stargate_vote

This function can be used to cast votes on Stargate.

Inputs

  • sender: &signer

    • Validation: None required.

    • Impact: Identifies the sender of the Cosmos message.

  • proposal_id: u64

    • Validation: None.

    • Impact: Identifies the proposal being voted.

  • voter: String

    • Validation: None (from the Move side).

    • Impact: The account address to be stored in the JSON.

  • option: u64

    • Validation: None.

    • Impact: Identifies the option being voted.

  • metadata: String

    • Validation: None.

    • Impact: Metadata associated with the vote message.

Function: stargate

This function can be used to send arbitrary Stargate messages.

Inputs

  • sender: &signer

    • Validation: None required.

    • Impact: Identifies the sender of the Cosmos message.

  • data: String

    • Validation: None.

    • Impact: JSON-encoded Cosmos message.

Function: move_execute

This function can be used to queue up a message that requests execution of a Move function. Note that this function allows for dynamic dispatching, which is not normally possible in Move. However, this function also has some additional constraints; arguments for the invoked function can only be primitive types or instances of allowlisted structs (such as String or Option). This ensures the caller cannot instantiate arbitrary Move objects.

Note that validation of the target function and of the arguments is not performed by move_execute or by the native helper function it invokes. It is possible to queue up Cosmos messages requesting the call of an invalid function or using invalid parameters. Such invalid calls will cause a revert when the call is processed.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Sender of the message (caller of the Move function).

  • module_address: address

    • Validation: None.

    • Impact: Address of the module to invoke.

  • module_name: String

    • Validation: None.

    • Impact: Name of the module to invoke.

  • function_name: String

    • Validation: None.

    • Impact: Name of the function to invoke.

  • type_args: vector<String>

    • Validation: None.

    • Impact: Type arguments to the invoked function (serialized as string).

  • args: vector<vector<u8>>

    • Validation: None.

    • Impact: BCS-serialized arguments.

Function: move_execute_with_json

This function can be used to queue up a message that requests execution of a Move function. The function is identical to move_execute, with the exception that the function arguments are expected to be encoded as JSON.

Function: move_script

This function can be used to queue up a message requesting to run a Move script. The considerations for move_execute also apply for this function; it allows dynamic dispatching, has the same constraints limiting the types of the arguments to primitive and allowlisted ones, and no strict checks are performed at the time the message is queued up, resulting in a revert only afterwards.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Sender of the message (caller of the Move script).

  • code_bytes: vector<u8>

    • Validation: None immediately — must be a valid script.

    • Impact: Script to be executed.

  • type_args: vector<String>

    • Validation: None.

    • Impact: Type arguments.

  • args: vector<vector<u8>>

    • Validation: None immediately — will be validated before running the script.

    • Impact: Arguments supplied to the script — BCS serialized.

Function: move_script_with_json

This function can be used to queue up a message requesting to run a Move script. It is identical to move_script, with the exception that the arguments are expected to be JSON encoded.

Function: delegate

This function can be used to delegate funds to a delegator.

Inputs

  • delegator: &signer

    • Validation: None.

    • Impact: Identifies the delegating party and authorizes the operation.

  • validator: String

    • Validation: None.

    • Impact: Identifies the validator receiving a delegation.

  • metadata: Object<Metadata>

    • Validation: None.

    • Impact: Identifies the asset being delegated.

  • amount: u64

    • Validation: None.

    • Impact: Amount to be delegated.

Function: fund_community_pool

This function can be used to transfer funds to the community pool. The assets are taken from the storage associated with the provided signer.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Account funding the community pool.

  • metadata: Object<Metadata>

    • Validation: None.

    • Impact: Identifies the asset to be transferred.

  • amount: u64

    • Validation: None.

    • Impact: Amount to be transferred.

Function: transfer

This function can be used to initiate an IBC transfer of a given amount of fungible tokens.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Sender initiating the transfer.

  • receiver: String

    • Validation: None.

    • Impact: Recipient of the transfer.

  • metadata: Object<Metadata>

    • Validation: None.

    • Impact: Identifies the asset to transfer.

  • token_amount: u64

    • Validation: None.

    • Impact: Amount to transfer.

  • source_port: String

    • Validation: None.

    • Impact: Source port for the IBC transfer.

  • source_channel: String

    • Validation: None.

    • Impact: Source channel for the IBC transfer.

  • revision_number: u64

    • Validation: None.

    • Impact: Specifies the height-based time-out for the transfer.

  • revision_height: u64

    • Validation: None.

    • Impact: Specifies the height-based time-out for the transfer.

  • timeout_timestamp: u64

    • Validation: None.

    • Impact: Time stamp specifying the time-out for the transfer.

  • memo: String

    • Validation: None.

    • Impact: Arbitrary data attached to the IBC-transfer message.

Function: nft_transfer

This function can be used to initiate an IBC transfer of a nonfungible asset.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Sender initiating the transfer.

  • receiver: String

    • Validation: None.

    • Impact: Recipient of the transfer.

  • collection: Object<Collection>

    • Validation: None.

    • Impact: Identifies the collection of which the asset being transferred is a part of.

  • token_ids: vector<String>

    • Validation: None.

    • Impact: Identifies the specific asset to be transferred.

  • source_port: String

    • Validation: None.

    • Impact: Source port for the IBC transfer.

  • source_channel: String

    • Validation: None.

    • Impact: Source channel for the IBC transfer.

  • revision_number: u64

    • Validation: None.

    • Impact: Specifies the height-based time-out for the transfer.

  • revision_height: u64

    • Validation: None.

    • Impact: Specifies the height-based time-out for the transfer.

  • timeout_timestamp: u64

    • Validation: None.

    • Impact: Time stamp specifying the time-out for the transfer.

  • memo: String

    • Validation: None.

    • Impact: Arbitrary data attached to the IBC-transfer message.

Function: pay_fee

This function can be used to pay for IBC-transfer fees.

Inputs

  • sender: &signer

    • Validation: None.

    • Impact: Sender paying the fees.

  • source_port: String

    • Validation: None.

    • Impact: Source port for the IBC transfer.

  • source_channel: String

    • Validation: None.

    • Impact: Source channel for the IBC transfer.

  • recv_fee_metadata: Object<Metadata>

    • Validation: None.

    • Impact: Asset to be used to pay for receive fees.

  • recv_fee_amount: u64

    • Validation: None.

    • Impact: Amount to be used as a receive fee.

  • ack_fee_metadata: Object<Metadata>

    • Validation: None.

    • Impact: Asset to be used to pay for fees in case of message acknowledgment.

  • ack_fee_amount: u64

    • Validation: None.

    • Impact: Amount to be used as an acknowledgment fee.

  • timeout_fee_metadata: Object<Metadata>

    • Validation: None.

    • Impact: Asset to be used for time-out fees.

  • timeout_fee_amount: u64

    • Validation: None.

    • Impact: Amount to be used to pay fees in case of message time-out.

Zellic © 2024Back to top ↑