[GH-ISSUE #3739] [Feature] CosmWasm and IBC reverse engineering: Wasm contracts, schemas, packet lifecycles and cross-chain state machines #1449

New issue

Open

opened 2026-10-16 21:05:31 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:31 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3739

Problem Statement & Context

The Cosmos ecosystem and interchain network rely on two foundational smart contract and networking standards:

CosmWasm (WebAssembly Smart Contracts): Rust-compiled WebAssembly binaries (.wasm) tailored for the Cosmos SDK, exporting deterministic actor entrypoints: instantiate, execute, query, sudo, migrate, reply. Uses JSON message passing over raw memory pointers.
CosmWasm JSON Schemas (schema/*.json): JSON Schema definitions declaring message variants (ExecuteMsg, QueryMsg, InstantiateMsg), state models, and response formats generated via cosmwasm-schema.
Storage Namespaces: Key-value storage partitioned by length-prefixed ASCII prefixes (e.g. ^Fconfig, ^Gbalance<address>).
Inter-Blockchain Communication (IBC / ICS): Trust-minimized cross-chain communication protocol:
- Client: Light client tracking consensus state of a counterparty chain (e.g. Tendermint light client).
- Connection: Cryptographic connection handshake across clients.
- Channel: Ordered or unordered communication pipe between contract ports (ics20-1 token transfer, custom CosmWasm contract ports).
- Packet Lifecycle: SendPacket -> RecvPacket -> WriteAcknowledgement -> AcknowledgePacket / TimeoutPacket.

REA needs a CosmWasm and IBC reverse engineering engine capable of decompiling CosmWasm Wasm bytecode, extracting message schemas, and modeling IBC packet transmission state machines across chains.

Proposed Architecture

flowchart TD
    A["CosmWasm Contract (.wasm) / IBC Transaction Trace"] --> B["CosmWasm & IBC Semantic Engine"]
    B --> C["CosmWasm Actor Entrypoint Decompiler"]
    B --> D["Storage Key & Schema Reconstructor"]
    B --> E["IBC Protocol Packet & Channel Tracker"]
    
    C --> C1["Exported Wasm Functions (instantiate, execute, query, reply)"]
    C --> C2["JSON Message Slicing & Submessage Handlers"]
    
    D --> D1["Namespace Prefix Parsing (cw-storage-plus conventions)"]
    D --> D2["Reconstructed ExecuteMsg & QueryMsg Schemas"]
    
    E --> E1["IBC Handshake (Client, Connection, Channel Open/Ack)"]
    E --> E2["Packet Lifecycle (Sequence, Timeout, Data, Ack)"]
    E --> E3["Cross-Chain Causality Graph (Chain A -> Chain B)"]
    
    C & D & E --> F["Synthesized Contract Interface & Cross-Chain IBC Flowchart"]

Technical Capabilities & Modules

CosmWasm Wasm Binary Decompilation:
- Ingest CosmWasm .wasm binaries using REA's Wasm framework (#2298).
- Identify standard CosmWasm export signatures: instantiate, execute, query, sudo, migrate, reply.
- Trace JSON deserialization logic (serde_json_wasm) to reconstruct expected message fields.
Storage Layout & Key Prefix Mapping:
- Detect cw-storage-plus conventions: Item<T>, Map<K, V>, IndexedMap.
- Decode composite storage keys (length prefixes, namespace prefixes, byte-encoded keys).
Submessage & Reply Handling:
- Trace SubMsg dispatches and map reply handlers (ReplyOn::Success, ReplyOn::Error, ReplyOn::Always).
- Reconstruct intra-contract and cross-contract call graphs.
IBC Handshake & Packet Dissection:
- Dissect IBC message types in Cosmos transactions:
  - MsgCreateClient, MsgUpdateClient.
  - MsgConnectionOpenInit, MsgConnectionOpenTry, MsgConnectionOpenAck, MsgConnectionOpenConfirm.
  - MsgChannelOpenInit, MsgChannelOpenTry, MsgChannelOpenAck, MsgChannelOpenConfirm.
  - MsgRecvPacket, MsgAcknowledgement, MsgTimeout.
- Decode ICS-20 fungible token transfer payloads and custom contract IBC packets.
Cross-Chain State Machine Reconstruction:
- Reconstruct complete packet lifecycles from recorded chain transactions: track a packet from issuance on Chain A, receipt on Chain B, to final acknowledgement on Chain A.

Acceptance Criteria

Automated detection and entrypoint classification of CosmWasm .wasm binaries.
Reconstruction of ExecuteMsg and QueryMsg JSON schemas from bytecode or accompanying schema artifacts.
Decoding of storage namespaces and key access patterns.
Dissection of IBC transaction messages and channel handshakes.
Generation of an interactive cross-chain packet lifecycle diagram.

Complements #2350 (Inspect WebAssembly binaries)
Complements #2298 (Decompile WebAssembly modules)
Complements #3621 (Unknown binary file-format inference)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3739 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Blockchain RE](https://img.shields.io/badge/domain-blockchain_RE-orange.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context The Cosmos ecosystem and interchain network rely on two foundational smart contract and networking standards: 1. **CosmWasm (WebAssembly Smart Contracts)**: Rust-compiled WebAssembly binaries (`.wasm`) tailored for the Cosmos SDK, exporting deterministic actor entrypoints: `instantiate`, `execute`, `query`, `sudo`, `migrate`, `reply`. Uses JSON message passing over raw memory pointers. 2. **CosmWasm JSON Schemas (`schema/*.json`)**: JSON Schema definitions declaring message variants (`ExecuteMsg`, `QueryMsg`, `InstantiateMsg`), state models, and response formats generated via `cosmwasm-schema`. 3. **Storage Namespaces**: Key-value storage partitioned by length-prefixed ASCII prefixes (e.g. `^Fconfig`, `^Gbalance<address>`). 4. **Inter-Blockchain Communication (IBC / ICS)**: Trust-minimized cross-chain communication protocol: - Client: Light client tracking consensus state of a counterparty chain (e.g. Tendermint light client). - Connection: Cryptographic connection handshake across clients. - Channel: Ordered or unordered communication pipe between contract ports (`ics20-1` token transfer, custom CosmWasm contract ports). - Packet Lifecycle: `SendPacket` -> `RecvPacket` -> `WriteAcknowledgement` -> `AcknowledgePacket` / `TimeoutPacket`. REA needs a CosmWasm and IBC reverse engineering engine capable of decompiling CosmWasm Wasm bytecode, extracting message schemas, and modeling IBC packet transmission state machines across chains. ### Proposed Architecture ```mermaid flowchart TD A["CosmWasm Contract (.wasm) / IBC Transaction Trace"] --> B["CosmWasm & IBC Semantic Engine"] B --> C["CosmWasm Actor Entrypoint Decompiler"] B --> D["Storage Key & Schema Reconstructor"] B --> E["IBC Protocol Packet & Channel Tracker"] C --> C1["Exported Wasm Functions (instantiate, execute, query, reply)"] C --> C2["JSON Message Slicing & Submessage Handlers"] D --> D1["Namespace Prefix Parsing (cw-storage-plus conventions)"] D --> D2["Reconstructed ExecuteMsg & QueryMsg Schemas"] E --> E1["IBC Handshake (Client, Connection, Channel Open/Ack)"] E --> E2["Packet Lifecycle (Sequence, Timeout, Data, Ack)"] E --> E3["Cross-Chain Causality Graph (Chain A -> Chain B)"] C & D & E --> F["Synthesized Contract Interface & Cross-Chain IBC Flowchart"] ``` ### Technical Capabilities & Modules 1. **CosmWasm Wasm Binary Decompilation:** - Ingest CosmWasm `.wasm` binaries using REA's Wasm framework (#2298). - Identify standard CosmWasm export signatures: `instantiate`, `execute`, `query`, `sudo`, `migrate`, `reply`. - Trace JSON deserialization logic (`serde_json_wasm`) to reconstruct expected message fields. 2. **Storage Layout & Key Prefix Mapping:** - Detect `cw-storage-plus` conventions: `Item<T>`, `Map<K, V>`, `IndexedMap`. - Decode composite storage keys (length prefixes, namespace prefixes, byte-encoded keys). 3. **Submessage & Reply Handling:** - Trace `SubMsg` dispatches and map `reply` handlers (`ReplyOn::Success`, `ReplyOn::Error`, `ReplyOn::Always`). - Reconstruct intra-contract and cross-contract call graphs. 4. **IBC Handshake & Packet Dissection:** - Dissect IBC message types in Cosmos transactions: - `MsgCreateClient`, `MsgUpdateClient`. - `MsgConnectionOpenInit`, `MsgConnectionOpenTry`, `MsgConnectionOpenAck`, `MsgConnectionOpenConfirm`. - `MsgChannelOpenInit`, `MsgChannelOpenTry`, `MsgChannelOpenAck`, `MsgChannelOpenConfirm`. - `MsgRecvPacket`, `MsgAcknowledgement`, `MsgTimeout`. - Decode ICS-20 fungible token transfer payloads and custom contract IBC packets. 5. **Cross-Chain State Machine Reconstruction:** - Reconstruct complete packet lifecycles from recorded chain transactions: track a packet from issuance on Chain A, receipt on Chain B, to final acknowledgement on Chain A. ### Acceptance Criteria - [ ] Automated detection and entrypoint classification of CosmWasm `.wasm` binaries. - [ ] Reconstruction of `ExecuteMsg` and `QueryMsg` JSON schemas from bytecode or accompanying schema artifacts. - [ ] Decoding of storage namespaces and key access patterns. - [ ] Dissection of IBC transaction messages and channel handshakes. - [ ] Generation of an interactive cross-chain packet lifecycle diagram. ### Related Issues & Dependencies - Complements #2350 (Inspect WebAssembly binaries) - Complements #2298 (Decompile WebAssembly modules) - Complements #3621 (Unknown binary file-format inference)

bsakaguchi referenced this issue

2026-10-17 21:11:40 +00:00

[PR #1468] [CLOSED] fix(javascript): attribute writes through a simple thunk's call result #2907

bsakaguchi referenced this issue

2026-10-17 21:11:41 +00:00

[PR #1471] [MERGED] fix(javascript): retain returned-reference mutation uncertainty #2909