# Amino legacy signing method broken because of name mismatch

Amino legacy codec registration names mismatched protobuf amino.name options across Initia, MiniEVM and MiniWASM, breaking legacy signing/encoding for several messages.

- Payout: Contest reward
- Severity: medium
- Program: Initia
- Credited: Franfran
- Disclosed: 2025-04-10
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-initia-cosmos#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-05
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:misconfiguration

**Target:** Cosmos SDK amino codec registration (RegisterConcrete) vs protobuf amino.name options
**Root cause:** RegisterConcrete names in codec.go do not match the amino.name/amino.oneof_name options declared in the protobuf messages, so the codec cannot resolve the interface and fails to encode/decode legacy Amino messages.
**Steps:**
1. Read codec.go RegisterConcrete calls for each module (evm, tokenfactory, move, ibc-hooks, mstaking).
2. Compare each registered name against the corresponding proto amino.name option.
3. Observe mismatches: `evm/MsgUpdateParams` missing, `move/MsgUpdateParams` vs `tokenfactory/MsgUpdateParams`, `move/MsgWhitelist` vs `move/MsgDelist`, `ibchooks/Params` vs `ibc-hooks/Params`, `mstake/StakeAuthorization` vs `mstaking/StakeAuthorization`, and oneof names for AllowList/DenyList.
4. Attempt legacy Amino encode/decode of affected messages to confirm failure.
**How found:** Code review comparing amino RegisterConcrete registrations in Go codec files against amino.name options in the protobuf definitions, spotting naming inconsistencies across modules.
**Insight:** When auditing Cosmos SDK chains, diff every RegisterConcrete/RegisterAminoMsg string against the proto amino.name and amino.oneof_name options; a single character mismatch silently breaks legacy Amino signing for that message type.