cosmwasm

# CosmWasm (Rust) detection ## When this applies - Any `.rs` file importing `cosmwasm_std` (`use cosmwasm_std::{...}`) - Macros/attrs `#[entry_point]`, `#[cw_serde]`; enums `ExecuteMsg`, `InstantiateMsg`, `QueryMsg`, `MigrateMsg`, `SudoMsg` - `cw_storage_plus` types `Map`, `Item`, `IndexedMap`; `DepsMut`/`Deps`, `MessageInfo`, `Env` - `SubMsg`, `Reply`, `reply()`, `set_contract_version`, `cw2` CosmWasm has no `msg.sender`-gated visibility and no implicit auth. Every `execute` branch is callable by anyone unless the handler checks `info.sender`. ## Detection patterns ### Missing info.sender authorization in execute (CRITICAL) ```rust ExecuteMsg::SetConfig { admin } => { let mut cfg = CONFIG.load(deps.storage)?; cfg.admin = admin; // ← no info.sender check CONFIG.save(deps.storage, &cfg)?; Ok(Response::new()) } ``` **Signal:** an `ExecuteMsg` arm that mutates privileged state (`admin`, `owner`, `mint`, `withdraw`, `pause`) with no `if info.sender != cfg.admin { return Err(Unauthorized) }`. Anyone can dispatch any message. ### Unbounded map iteration → gas exhaustion DoS (HIGH) ```rust let all: Vec<_> = BALANCES .range(deps.storage, None, None, Order::Ascending) // ← whole map .collect::<StdResult<_>>()?; for (addr, bal) in all { /* mutate each */ } ``` **Signal:** `.range(.., None, None, ..)` / `.keys(..)` over a user-growable `Map` inside `execute`, or a loop whose length attackers control. Each entry costs gas; an attac...