An underappreciated requirement of peer-to-peer blockchain client implementations is high resistance to DoS attacks. These are not exploits targeting the consensus ruleset, just malicious nodes spamming expensive-to-reject transactions to slow other clients down, and possibly to attempt network partition attacks (which may be of particular concern due to Tendermint's requirement of a 2/3 stake-weighted quorum for liveness). See e.g. this Bitcoin wiki page for a list of the DoS mitigation techniques used by Bitcoin Core.

Any user of the Cosmos SDK will need to ensure that their application does not perform expensive transaction validations that can be repeatedly invoked by another node. The SDK will need to work in cooperation with Tendermint to detect peers spamming invalid transactions (which may or may not be intentional - could be an automated script gone awry) and ban them after appropriate thresholds.

One way to make this an easier property for SDK users to ensure would be to implement a simple "attack client" - a Cosmos SDK application with methods to construct and repeatedly send transactions, which SDK users can fork, add details for their application's additional transaction types, then use to simulate a malicious node and ensure their application handles the attacks gracefully.