Cosmos is an ecosystem of independent blockchains, often called application chains, built with shared open-source components and connected by the Inter-Blockchain Communication protocol (IBC). A project can either deploy smart contracts on an existing chain or build its own chain. The choice defines what must be audited: contract code only, or the chain's modules and configuration as well.
Building on Cosmos
Chains are built with the Cosmos SDK in Go and use CometBFT for consensus. Chain logic lives in modules, while chains that enable CosmWasm let developers deploy smart contracts written in Rust and compiled to WebAssembly. IBC allows tokens and messages to move between chains through channels, with acknowledgements and timeouts.
- Languages: Go for chain modules, Rust for CosmWasm contracts
- Tooling: the Cosmos SDK, CosmWasm libraries and multi-test framework
- Some chains also run an EVM, which then brings EVM risks into scope
What auditors look at
- IBC handling: acknowledgements, timeouts and refunds, validation of channels and of the origin of tokens
- CosmWasm: submessages and reply handling, authorization of execute messages, contract migration rights
- Chain modules: non-deterministic code, panics in block hooks that can halt the chain, unbounded loops and gas metering
- Governance and parameter changes that can alter module behavior
- Arithmetic, rounding and denomination handling across chains
Before requesting quotes
- State whether you deliver CosmWasm contracts, SDK modules or a full chain, and the SDK and CosmWasm versions
- Describe IBC flows, counterparty chains and expected behavior on timeout
- Share tests, including multi-contract or multi-chain simulations
- List who holds governance, admin and migration rights