AFBS-COSMOS-2026-01 · v1.0 · 30 October 2026 · ~6 min read
Summary
This audit covers nine Cosmos/CometBFT chains: Sei, Osmosis, Kava, Akash, Juno, Celestia, Agoric, Dymension and Namada. Sources were pinned to specific commits and verified by blob SHA-1; on-chain checks were read-only. No attack transaction was executed.
In the surfaces examined, no permissionless path allows funds to be stolen or tokens to be minted. This does not mean “Cosmos is safe”: several surfaces are not covered, and the P1/P2 risks below are real. P1/P2 denote non-direct loss or accounting inconsistencies, not permissionless theft paths.
Scope
- Sei — EVM ↔ Cosmos precompiles, EndBlock, OCC;
- Osmosis — concentrated liquidity, rounding, rewards;
- Kava — CDP, hard, earn, auction, swap;
- Akash — bme, escrow, market;
- Juno — feeshare, stream, drip, feepay, feemarket and related modules;
- Celestia — fibre, minfee, blob, zkism;
- Agoric — ERTP, Zoe, fast-usdc;
- Dymension — eibc, forward, delayedack;
- Namada — MASP, nullifier, per-asset value balance.
Key results
| Chain | Result | Main risk |
|---|---|---|
| Kava | No direct theft | P1 — bad debt is deleted instead of accounted; ghost debt keeps accruing interest, borne by the last depositors. |
| Akash | No direct theft | P2 — escrow payment and accounting are separated; swallowed errors can create a double-payment surface. |
| Sei | No dual ledger | P2 — EndBlock swallows settlement errors; supply drift is possible. |
| Celestia | Fund flow self-consistent | R3/R4 — fibre payer is not bound to the tx signer; Finalize/ReCheck skip signature verification. |
| Osmosis | No principal loss | Rewards: forfeited incentives remain in the pool; uptime forfeiture can be bypassed by removing liquidity. |
| Juno | No direct defect | 4 Low; revenue-share ownership follows admin (design). |
| Agoric | No double claim | Risk in mint-presence propagation and vat upgrades; vault package absent from this commit. |
| Dymension | No P0/P1/P2 | P3 only; eibc signer = payer, no double spend observed in delayedack. |
| Namada | Per-asset conservation | MASP core holds; remaining trust is in the decoding table and governance. |
What this report does not prove
“0 direct path” applies only to the surfaces examined. Not covered: Sei’s in-tree SDK and consensus, OCC, most Osmosis modules, Agoric’s SwingSet/vat layer, Namada circuits and conversion, Celestia’s PFF selection/settlement, and several submodules of Kava, Akash, Juno and Dymension.
None of these chains should be described as “fully audited” on the basis of this report.
Method
Sources pinned to specific commits, files fetched by blob and verified by SHA-1. On-chain checks used read-only calls; no attack transaction or local PoC was executed. P1/P2 are loss or accounting inconsistencies, not permissionless direct-theft paths.
Disclosure
The full technical report remains restricted. For teams and partners: security@frblockchain.icu. Do not send private keys, seeds or exploitation secrets.