search

crypto-com / cosmos-sdk-codeql

A query suite for common bug patterns in Cosmos SDK-based applications
Apache License 2.0
20 stars 6 forks source link

Explanation of Bech32 rule #7

Closed JasperSurmont closed 1 year ago

JasperSurmont commented 1 year ago

Hey,

As a part of my thesis I'm scanning live cosmos-sdk chains for possible vulnerabilities, and one way is using these CodeQl rules. However, I am unsure on why using variables called Bech32... is a vulnerability (like this rule suggests).

A more concrete example: this line in the osmosis repo is being flagged as a warning. I cannot seem to figure out why this would be insecure.

Would you mind explaining it a bit?

Thanks!

JasperSurmont commented 1 year ago

After some research, I found the original explanation here