Atomicity
EVM success/failure must agree with native state, callbacks, conversions and cache writes.
TWIX SECURITY STACK · AUGUST 2026 REMEDIATION
Fifteen targets.
Fifteen passes.
The hardened TWIX chain stack was upgraded against the complete 15-point Cosmos EVM module security review. The work focused especially on the dangerous boundary between EVM execution and Cosmos SDK state, gas, authorization, token conversion, callbacks and IBC behavior.
HARDENED QUALIFICATION15 / 15PASS
The result records completion of the defined remediation qualification after the upgraded build. It is evidence of a disciplined hardening program—not a claim that a blockchain, EVM implementation or future upgrade can never contain another defect.
WHY THIS REVIEW MATTERED
The hard part is the seam between runtimes.
TWIX combines Cosmos SDK state machines with Ethereum-compatible execution. That creates powerful interoperability, but it also creates failure modes that do not exist inside a single-runtime system.
Gas + balances
Native work must remain correctly priced and owned/spendable token semantics must remain unambiguous.
Precompiles
Stateful capabilities must exist, be explicitly enabled and fail deterministically rather than expanding attack surface by default.
Resource control
Tracing, WebSockets, profiling and background workers must remain bounded under pathological input and runtime faults.
15-POINT REMEDIATION MATRIX
Audit concern → hardened treatment → qualification.
This public matrix intentionally explains the engineering changes without publishing exploit recipes, private PoCs or weaponized reproduction sequences.
01
Precompile registration & startup validation
PASSPhantom Vesting Precompile
Audit severity
HIGH
TWIX hardened treatment
Removed the unsafe phantom-active state from the production surface and hardened registration/availability checks so an advertised address must resolve to an implementation rather than becoming a panic path.
Qualification focus
Startup/registration regression and deterministic failure behavior.
02
Canonical trace state & replay limits
PASSTrace API Trusts Caller-Supplied Block Data
Audit severity
HIGH when public
TWIX hardened treatment
Separated public tracing expectations from synthetic/internal replay behavior. Canonical identifiers and operator-defined workload boundaries prevent callers from inventing historical block environments or unbounded replay jobs.
Qualification focus
Canonical-state and replay-boundary qualification.
03
Server-controlled trace budgets
PASSCaller-Selected Excessive Trace Timeout
Audit severity
HIGH when public
TWIX hardened treatment
Trace execution is bounded by operator policy rather than caller-selected long durations; resource and output constraints are treated independently from timeout alone.
Qualification focus
Timeout-clamp and resource-boundary tests.
04
ERC20 capability consistency
PASSInconsistent Disabled Token-Pair Semantics
Audit severity
HIGH / MEDIUM
TWIX hardened treatment
Hardened the meaning of pair enable/disable state so the relevant ERC20/conversion paths do not drift into contradictory transfer, approval or conversion behavior after governance changes state.
Qualification focus
Disabled-pair behavior matrix across transfer/approval/conversion paths.
05
Gas accounting integrity
PASSGas Meter Accounting on Overflow
Audit severity
HIGH / MEDIUM
TWIX hardened treatment
Overflow checks preserve prior consumed-gas accounting instead of mutating the meter into a misleading state before failure; boundary semantics were qualified explicitly.
Qualification focus
Overflow boundary and recovery regression.
06
EVM/Cosmos rollback integrity
PASSFailed EVM Transactions Persisting Native Hook State
Audit severity
HIGH with writable hooks
TWIX hardened treatment
Failed EVM execution is treated as a cross-runtime atomicity boundary. Native post-processing behavior was hardened so failure does not silently create unmetered application-state side effects outside the intended semantics.
Qualification focus
Failure-injection against failed EVM execution and hook state.
07
Connection lifecycle & backpressure
PASSWebSocket Server Missing Timeouts
Audit severity
MEDIUM / HIGH public
TWIX hardened treatment
WebSocket and internal JSON-RPC communication are treated as bounded services with request-scoped lifetime, connection/message constraints and timeout expectations rather than indefinite background work.
Qualification focus
Connection/resource exhaustion qualification.
08
Debug/profiling isolation
PASSDebug Profiling Caller-Chosen Paths
Audit severity
HIGH if exposed
TWIX hardened treatment
Dangerous profiling capabilities remain outside the public surface and filesystem/duration behavior is constrained so remote callers cannot choose arbitrary write targets or occupy profiling resources indefinitely.
Qualification focus
Public exposure and profiling-boundary checks.
09
ERC20 accounting semantics
PASSERC20 balanceOf Spendable vs Owned Balance
Audit severity
MEDIUM
TWIX hardened treatment
Hardened ERC20 balance semantics so integrations can distinguish ownership from transfer spendability and do not receive misleading balances for locked or vesting state.
Qualification focus
Locked/vesting/accounting integration regression.
10
Fee-path configuration validation
PASSVirtual Fee Collection Panic on Bad Metadata
Audit severity
MEDIUM / HIGH
TWIX hardened treatment
Gas-token metadata requirements are validated before fee processing depends on them, turning incompatible configuration into an explicit validation/error condition rather than an ordinary-transaction panic path.
Qualification focus
Invalid-metadata fee-path qualification.
11
Local callback atomicity
PASSIBC Destination Callback Writes Before Final Safety Check
Audit severity
MEDIUM
TWIX hardened treatment
Final callback safety checks are evaluated before committed state is made durable so the function remains locally atomic even when invoked outside the usual outer IBC cache assumptions.
Qualification focus
Direct callback failure/rollback regression.
12
Cross-runtime adversarial regression
PASSICS20 Precompile Missing Adversarial Suite
Audit severity
HIGH
TWIX hardened treatment
Built qualification coverage around the ICS20 boundary where ERC20 conversion, native balances, IBC sends, callbacks, rollback, gas and Solidity parent execution intersect.
Qualification focus
Failure, timeout, callback, conversion, revert, malformed-input and replay-oriented regression coverage.
13
Native-work gas economics
PASSERC20/WERC20 Gas Pricing Underpricing Native Work
Audit severity
HIGH / MEDIUM
TWIX hardened treatment
Native Cosmos work underlying EVM-compatible operations is treated as part of gas economics. Fixed compatibility costs must remain bounded by measured/worst-case native work rather than assumption alone.
Qualification focus
Gas-budget benchmarking and worst-case regression criteria.
14
Least-privilege precompile exposure
PASSProduction Genesis Enables Every Stateful Precompile
Audit severity
MEDIUM / HIGH
TWIX hardened treatment
Production capability exposure is treated as an explicit allowlist rather than inheriting a broad demo/example profile. Stateful precompiles are enabled intentionally, not merely because they exist.
Qualification focus
Production genesis/precompile allowlist qualification.
15
Worker fault containment
PASSTxpool Reset Panic in Long-Lived Worker
Audit severity
MEDIUM
TWIX hardened treatment
Txpool reset/recheck faults are handled as recoverable operational errors or controlled supervisor conditions instead of arbitrary panics inside long-lived asynchronous workers.
Qualification focus
Reset/rechecker fault-path regression.
QUALIFICATION MODEL
Fixes had to survive failure conditions.
The remediation program emphasized regression and failure-injection at the exact boundaries highlighted by the review.
Rollback paths
Exercise failed EVM transactions, callback failures, final safety checks and conversion paths where partial state would be dangerous.
Gas + resource ceilings
Check overflow boundaries, server-controlled timeouts, workload caps and worst-case native work behind EVM-compatible operations.
Consistent behavior
Test disabled-pair behavior, owned/spendable balance semantics and stateful precompile exposure across related methods rather than one happy path.
Long-lived services
Fault paths in WebSocket/profiling/txpool components are treated as availability and containment problems, not exceptional edge trivia.
DEFENSE IN DEPTH
Source hardening and deployment hardening reinforce each other.
INSIDE THE STACK
15/15 remediation qualification
Precompiles, tracing, gas, ERC20 semantics, fee metadata, cross-runtime rollback, IBC/ICS20, WebSockets, profiling and txpool reliability.
AROUND THE STACK
Restricted public edge
Unsafe Comet routes, EVM administration/debug namespaces and raw backend services remain outside the normal public interface, while consensus and application keys stay separate.
TWIX Lock begins with TWIX itself.The flagship security platform is intended to continuously model and challenge software behavior. The chain underneath it was first subjected to the same philosophy: identify failure assumptions, harden the implementation, then qualify the remediation.