chore: merge v0.47.9 into v0.47.x-ics-lsm branch (cosmos#19498)

Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> Co-authored-by: Julien Robert <[email protected]> Co-authored-by: yihuang <[email protected]> Co-authored-by: samricotta <[email protected]> Co-authored-by: samricotta <[email protected]> Co-authored-by: Eric Warehime <[email protected]> Co-authored-by: gsai967 <[email protected]> Co-authored-by: Dev Ojha <[email protected]> Co-authored-by: Dong Lieu <[email protected]> Co-authored-by: marbar3778 <[email protected]> Co-authored-by: atheeshp <[email protected]> Co-authored-by: mmsqe <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Callum Waters <[email protected]> Co-authored-by: Yoksirod <[email protected]> Co-authored-by: Brann Bronzebeard <[email protected]> Co-authored-by: Facundo <[email protected]> Co-authored-by: Facundo Medica <[email protected]> Co-authored-by: Aleksandr Bezobchuk <[email protected]>
sagaxyz · Feb 20, 2024 · 099fa4a · 099fa4a
1 parent 7a03edb
commit 099fa4a
Show file tree

Hide file tree

Showing 29 changed files with 680 additions and 124 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -35,7 +35,24 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 # Changelog
 
-## [Unreleased]
+## v0.47.9-ics-lsm
+
+This is a special cosmos-sdk release with support for both ICS and LSM.
+All the changes to the special release are state machine breaking - this release should 
+be used only to upgrade from [v0.45.16-ics-lsm](https://github.com/cosmos/cosmos-sdk/tree/v0.45.16-ics-lsm).
+
+### Features
+
+* (x/auth/vesting) [GHSA-4j93-fm92-rp4m](#bug-fixes) Add `BlockedAddr` check in `CreatePeriodicVestingAccount`.
+* (baseapp) [#19177](https://github.com/cosmos/cosmos-sdk/pull/19177) Fix baseapp `DefaultProposalHandler` same-sender non-sequential sequence.
+
+
+## [v0.47.9](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.47.9) - 2024-02-19
+
+### Bug Fixes
+
+* (x/auth/vesting) [GHSA-4j93-fm92-rp4m](#bug-fixes) Add `BlockedAddr` check in `CreatePeriodicVestingAccount`.
+* (baseapp) [#19177](https://github.com/cosmos/cosmos-sdk/pull/19177) Fix baseapp `DefaultProposalHandler` same-sender non-sequential sequence.
 
 ## v0.47.8-ics-lsm
 

diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
@@ -1,18 +1,19 @@
-# Cosmos SDK v0.47.8 Release Notes
+# Cosmos SDK v0.47.9 Release Notes
 
 💬 [**Release Discussion**](https://github.com/orgs/cosmos/discussions/6)
 
 ## 🚀 Highlights
 
-First and foremost, happy new year! 🎉
+This patch release includes a fix in baseapp in `DefaultProposalHandler` and fixes [GHSA-4j93-fm92-rp4m](https://github.com/cosmos/cosmos-sdk/security/advisories/GHSA-4j93-fm92-rp4m).
 
-There is no specific notable change in this release apart from the usual bug fixes and improvements.
+We recommended to upgrade to this patch release as soon as possible.
+When upgrading from <= v0.47.8, please ensure that 2/3 of the validator power upgrade to v0.47.9.
 
-Curious? Check out the [changelog](https://github.com/cosmos/cosmos-sdk/blob/v0.47.8/CHANGELOG.md) for an exhaustive list of changes or [compare changes](https://github.com/cosmos/cosmos-sdk/compare/v0.47.7...v0.47.8) from last release.
+Curious? Check out the [changelog](https://github.com/cosmos/cosmos-sdk/blob/v0.47.9/CHANGELOG.md) for an exhaustive list of changes or [compare changes](https://github.com/cosmos/cosmos-sdk/compare/v0.47.8...v0.47.9) from last release.
 
 Refer to the [upgrading guide](https://github.com/cosmos/cosmos-sdk/blob/release/v0.50.x/UPGRADING.md) when migrating from `v0.47.x` to `v0.50.x`.
 
 ## Maintenance Policy
 
 v0.50 has been released which means the v0.47.x line is now supported for bug fixes only, as per our release policy.
-Start integrating with [Cosmos SDK Eden (v0.50)](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.3) and enjoy and the new features and performance improvements.
+Start integrating with [Cosmos SDK Eden (v0.50)](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.50.4) and enjoy and the new features and performance improvements.
diff --git a/api/go.mod b/api/go.mod
@@ -3,16 +3,16 @@ module cosmossdk.io/api
 go 1.19
 
 require (
- github.com/cosmos/cosmos-proto v1.0.0-beta.2
+ github.com/cosmos/cosmos-proto v1.0.0-beta.4
  github.com/cosmos/gogoproto v1.4.10
  google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4
  google.golang.org/grpc v1.55.0
- google.golang.org/protobuf v1.30.0
+ google.golang.org/protobuf v1.32.0
 )
 
 require (
  github.com/golang/protobuf v1.5.3 // indirect
- github.com/google/go-cmp v0.5.9 // indirect
+ github.com/google/go-cmp v0.6.0 // indirect
  golang.org/x/exp v0.0.0-20230131160201-f062dba9d201 // indirect
  golang.org/x/net v0.9.0 // indirect
  golang.org/x/sys v0.7.0 // indirect

diff --git a/api/go.sum b/api/go.sum
@@ -1,13 +1,13 @@
-github.com/cosmos/cosmos-proto v1.0.0-beta.2 h1:X3OKvWgK9Gsejo0F1qs5l8Qn6xJV/AzgIWR2wZ8Nua8=
-github.com/cosmos/cosmos-proto v1.0.0-beta.2/go.mod h1:+XRCLJ14pr5HFEHIUcn51IKXD1Fy3rkEQqt4WqmN4V0=
+github.com/cosmos/cosmos-proto v1.0.0-beta.4 h1:aEL7tU/rLOmxZQ9z4i7mzxcLbSCY48OdY7lIWTLG7oU=
+github.com/cosmos/cosmos-proto v1.0.0-beta.4/go.mod h1:oeB+FyVzG3XrQJbJng0EnV8Vljfk9XvTIpGILNU/9Co=
 github.com/cosmos/gogoproto v1.4.10 h1:QH/yT8X+c0F4ZDacDv3z+xE3WU1P1Z3wQoLMBRJoKuI=
 github.com/cosmos/gogoproto v1.4.10/go.mod h1:3aAZzeRWpAwr+SS/LLkICX2/kDFyaYVzckBDzygIxek=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
 github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 golang.org/x/exp v0.0.0-20230131160201-f062dba9d201 h1:BEABXpNXLEz0WxtA+6CQIz2xkg80e+1zrhWyMcq8VzE=
 golang.org/x/exp v0.0.0-20230131160201-f062dba9d201/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
@@ -23,5 +23,5 @@ google.golang.org/grpc v1.55.0 h1:3Oj82/tFSCeUrRTg/5E/7d/W5A1tj6Ky1ABAuZuv5ag=
 google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGONTY8=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.30.0 h1:kPPoIgf3TsEvrm0PFe15JQ+570QVxYzEvvHqChK+cng=
-google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.32.0 h1:pPC6BG5ex8PDFnkbrGU3EixyhKcQ2aDuBS36lqK/C7I=
+google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
diff --git a/baseapp/abci_utils.go b/baseapp/abci_utils.go
@@ -1,11 +1,14 @@
 package baseapp
 
 import (
+ "fmt"
+
  "github.com/cockroachdb/errors"
  abci "github.com/cometbft/cometbft/abci/types"
 
  sdk "github.com/cosmos/cosmos-sdk/types"
  "github.com/cosmos/cosmos-sdk/types/mempool"
+ "github.com/cosmos/cosmos-sdk/x/auth/signing"
 )
 
 type (
@@ -93,8 +96,40 @@ func (h *DefaultProposalHandler) PrepareProposalHandler() sdk.PrepareProposalHan
  }
 
  iterator := h.mempool.Select(ctx, req.Txs)
+ selectedTxsSignersSeqs := make(map[string]uint64)
+ var selectedTxsNums int
  for iterator != nil {
  memTx := iterator.Tx()
+ sigs, err := memTx.(signing.SigVerifiableTx).GetSignaturesV2()
+ if err != nil {
+ panic(fmt.Errorf("failed to get signatures: %w", err))
+ }
+
+ // If the signers aren't in selectedTxsSignersSeqs then we haven't seen them before
+ // so we add them and continue given that we don't need to check the sequence.
+ shouldAdd := true
+ txSignersSeqs := make(map[string]uint64)
+ for _, sig := range sigs {
+ signer := sdk.AccAddress(sig.PubKey.Address()).String()
+ seq, ok := selectedTxsSignersSeqs[signer]
+ if !ok {
+ txSignersSeqs[signer] = sig.Sequence
+ continue
+ }
+
+ // If we have seen this signer before in this block, we must make
+ // sure that the current sequence is seq+1; otherwise is invalid
+ // and we skip it.
+ if seq+1 != sig.Sequence {
+ shouldAdd = false
+ break
+ }
+ txSignersSeqs[signer] = sig.Sequence
+ }
+ if !shouldAdd {
+ iterator = iterator.Next()
+ continue
+ }
 
  // NOTE: Since transaction verification was already executed in CheckTx,
  // which calls mempool.Insert, in theory everything in the pool should be
@@ -111,6 +146,23 @@ func (h *DefaultProposalHandler) PrepareProposalHandler() sdk.PrepareProposalHan
  if stop {
  break
  }
+
+ txsLen := len(h.txSelector.SelectedTxs())
+ for sender, seq := range txSignersSeqs {
+ // If txsLen != selectedTxsNums is true, it means that we've
+ // added a new tx to the selected txs, so we need to update
+ // the sequence of the sender.
+ if txsLen != selectedTxsNums {
+ selectedTxsSignersSeqs[sender] = seq
+ } else if _, ok := selectedTxsSignersSeqs[sender]; !ok {
+ // The transaction hasn't been added but it passed the
+ // verification, so we know that the sequence is correct.
+ // So we set this sender's sequence to seq-1, in order
+ // to avoid unnecessary calls to PrepareProposalVerifyTx.
+ selectedTxsSignersSeqs[sender] = seq - 1
+ }
+ }
+ selectedTxsNums = txsLen
  }
 
  iterator = iterator.Next()