autopilot hashed sender

app/app.go

@@ -613,6 +613,7 @@ func NewStrideApp(
 		appCodec,
 		keys[autopilottypes.StoreKey],
 		app.GetSubspace(autopilottypes.ModuleName),
+		app.BankKeeper,
 		app.StakeibcKeeper,
 		app.ClaimKeeper,
 		app.TransferKeeper,

x/autopilot/keeper/airdrop.go

@@ -12,16 +12,15 @@ import (
 	channeltypes "github.com/cosmos/ibc-go/v7/modules/core/04-channel/types"
 
 	"github.com/Stride-Labs/stride/v16/utils"
-	"github.com/Stride-Labs/stride/v16/x/autopilot/types"
 	claimtypes "github.com/Stride-Labs/stride/v16/x/claim/types"
 	stakeibctypes "github.com/Stride-Labs/stride/v16/x/stakeibc/types"
 )
 
+// Attempt to link a host address with a stride address to enable airdrop claims
 func (k Keeper) TryUpdateAirdropClaim(
 	ctx sdk.Context,
 	packet channeltypes.Packet,
-	data transfertypes.FungibleTokenPacketData,
-	packetMetadata types.ClaimPacketMetadata,
+	transferMetadata transfertypes.FungibleTokenPacketData,
 ) error {
 	params := k.GetParams(ctx)
 	if !params.ClaimActive {
@@ -39,11 +38,11 @@ func (k Keeper) TryUpdateAirdropClaim(
 	}
 
 	// grab relevant addresses
-	senderStrideAddress := utils.ConvertAddressToStrideAddress(data.Sender)
+	senderStrideAddress := utils.ConvertAddressToStrideAddress(transferMetadata.Sender)
 	if senderStrideAddress == "" {
-		return errorsmod.Wrapf(sdkerrors.ErrInvalidAddress, fmt.Sprintf("invalid sender address (%s)", data.Sender))
+		return errorsmod.Wrapf(sdkerrors.ErrInvalidAddress, fmt.Sprintf("invalid sender address (%s)", transferMetadata.Sender))
 	}
-	newStrideAddress := packetMetadata.StrideAddress
+	newStrideAddress := transferMetadata.Receiver
 
 	// find the airdrop for this host chain ID
 	airdrop, found := k.claimKeeper.GetAirdropByChainId(ctx, hostZone.ChainId)
@@ -56,7 +55,7 @@ func (k Keeper) TryUpdateAirdropClaim(
 
 	airdropId := airdrop.AirdropIdentifier
 	k.Logger(ctx).Info(fmt.Sprintf("updating airdrop address %s (orig %s) to %s for airdrop %s",
-		senderStrideAddress, data.Sender, newStrideAddress, airdropId))
+		senderStrideAddress, transferMetadata.Sender, newStrideAddress, airdropId))
 
 	return k.claimKeeper.UpdateAirdropAddress(ctx, senderStrideAddress, newStrideAddress, airdropId)
 }

x/autopilot/keeper/keeper.go

@@ -20,6 +20,7 @@ type (
 		Cdc            codec.BinaryCodec
 		storeKey       storetypes.StoreKey
 		paramstore     paramtypes.Subspace
+		bankKeeper     types.BankKeeper
 		stakeibcKeeper stakeibckeeper.Keeper
 		claimKeeper    claimkeeper.Keeper
 		transferKeeper types.IbcTransferKeeper
@@ -30,6 +31,7 @@ func NewKeeper(
 	Cdc codec.BinaryCodec,
 	storeKey storetypes.StoreKey,
 	ps paramtypes.Subspace,
+	bankKeeper types.BankKeeper,
 	stakeibcKeeper stakeibckeeper.Keeper,
 	claimKeeper claimkeeper.Keeper,
 	transferKeeper types.IbcTransferKeeper,
@@ -43,6 +45,7 @@ func NewKeeper(
 		Cdc:            Cdc,
 		storeKey:       storeKey,
 		paramstore:     ps,
+		bankKeeper:     bankKeeper,
 		stakeibcKeeper: stakeibcKeeper,
 		claimKeeper:    claimKeeper,
 		transferKeeper: transferKeeper,

x/autopilot/keeper/liquidstake.go

@@ -3,11 +3,11 @@ package keeper
 import (
 	"errors"
 	"fmt"
+	"time"
 
 	errorsmod "cosmossdk.io/errors"
-
+	sdkmath "cosmossdk.io/math"
 	sdk "github.com/cosmos/cosmos-sdk/types"
-	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
 	transfertypes "github.com/cosmos/ibc-go/v7/modules/apps/transfer/types"
 	channeltypes "github.com/cosmos/ibc-go/v7/modules/core/04-channel/types"
 
@@ -16,99 +16,154 @@ import (
 	stakeibctypes "github.com/Stride-Labs/stride/v16/x/stakeibc/types"
 )
 
+const (
+	// If the forward transfer fails, the tokens are sent to the fallback address
+	// which is a less than ideal UX
+	// As a result, we decided to use a long timeout here such, even in the case
+	// of high activity, a timeout should be very unlikely to occur
+	// Empirically we found that times of high market stress took roughly
+	// 2 hours for transfers to complete
+	LiquidStakeForwardTransferTimeout = (time.Hour * 3)
+)
+
+// Attempts to do an autopilot liquid stake (and optional forward)
+// The liquid stake is only allowed if the inbound packet came along a trusted channel
 func (k Keeper) TryLiquidStaking(
 	ctx sdk.Context,
 	packet channeltypes.Packet,
-	newData transfertypes.FungibleTokenPacketData,
-	packetMetadata types.StakeibcPacketMetadata,
+	transferMetadata transfertypes.FungibleTokenPacketData,
+	autopilotMetadata types.StakeibcPacketMetadata,
 ) error {
 	params := k.GetParams(ctx)
 	if !params.StakeibcActive {
 		return errorsmod.Wrapf(types.ErrPacketForwardingInactive, "autopilot stakeibc routing is inactive")
 	}
 
-	// In this case, we can't process a liquid staking transaction, because we're dealing with STRD tokens
-	if transfertypes.ReceiverChainIsSource(packet.GetSourcePort(), packet.GetSourceChannel(), newData.Denom) {
-		return errors.New("the native token is not supported for liquid staking")
-	}
-
-	amount, ok := sdk.NewIntFromString(newData.Amount)
+	// Verify the amount is valid
+	amount, ok := sdk.NewIntFromString(transferMetadata.Amount)
 	if !ok {
 		return errors.New("not a parsable amount field")
 	}
 
-	// Note: newData.denom is base denom e.g. uatom - not ibc/xxx
-	var token = sdk.NewCoin(newData.Denom, amount)
+	// In this case, we can't process a liquid staking transaction, because we're dealing with native tokens (e.g. STRD, stATOM)
+	if transfertypes.ReceiverChainIsSource(packet.GetSourcePort(), packet.GetSourceChannel(), transferMetadata.Denom) {
+		return errors.New("the native token is not supported for liquid staking")
+	}
 
-	prefixedDenom := transfertypes.GetPrefixedDenom(packet.GetDestPort(), packet.GetDestChannel(), newData.Denom)
+	// Note: the denom in the packet is the base denom e.g. uatom - not ibc/xxx
+	// We need to use the port and channel to build the IBC denom
+	prefixedDenom := transfertypes.GetPrefixedDenom(packet.GetDestPort(), packet.GetDestChannel(), transferMetadata.Denom)
 	ibcDenom := transfertypes.ParseDenomTrace(prefixedDenom).IBCDenom()
 
-	hostZone, err := k.stakeibcKeeper.GetHostZoneFromHostDenom(ctx, token.Denom)
+	hostZone, err := k.stakeibcKeeper.GetHostZoneFromHostDenom(ctx, transferMetadata.Denom)
 	if err != nil {
-		return err
+		return fmt.Errorf("host zone not found for denom (%s)", transferMetadata.Denom)
 	}
 
+	// Verify the IBC denom of the packet matches the host zone, to confirm the packet
+	// was sent over a trusted channel
 	if hostZone.IbcDenom != ibcDenom {
 		return fmt.Errorf("ibc denom %s is not equal to host zone ibc denom %s", ibcDenom, hostZone.IbcDenom)
 	}
 
-	strideAddress, err := sdk.AccAddressFromBech32(packetMetadata.StrideAddress)
-	if err != nil {
-		return errorsmod.Wrapf(sdkerrors.ErrInvalidAddress, "invalid stride_address (%s) in autopilot memo", strideAddress)
-	}
-
-	return k.RunLiquidStake(ctx, strideAddress, token, packetMetadata)
+	return k.RunLiquidStake(ctx, amount, transferMetadata, autopilotMetadata)
 }
 
-func (k Keeper) RunLiquidStake(ctx sdk.Context, addr sdk.AccAddress, token sdk.Coin, packetMetadata types.StakeibcPacketMetadata) error {
+// Submits a LiquidStake message from the transfer receiver
+// If a forwarding recipient is specified, the stTokens are ibc transferred
+func (k Keeper) RunLiquidStake(
+	ctx sdk.Context,
+	amount sdkmath.Int,
+	transferMetadata transfertypes.FungibleTokenPacketData,
+	autopilotMetadata types.StakeibcPacketMetadata,
+) error {
 	msg := &stakeibctypes.MsgLiquidStake{
-		Creator:   addr.String(),
-		Amount:    token.Amount,
-		HostDenom: token.Denom,
+		Creator:   transferMetadata.Receiver,
+		Amount:    amount,
+		HostDenom: transferMetadata.Denom,
 	}
 
 	if err := msg.ValidateBasic(); err != nil {
 		return err
 	}
 
 	msgServer := stakeibckeeper.NewMsgServerImpl(k.stakeibcKeeper)
-	result, err := msgServer.LiquidStake(
+	msgResponse, err := msgServer.LiquidStake(
 		sdk.WrapSDKContext(ctx),
 		msg,
 	)
 	if err != nil {
 		return errorsmod.Wrapf(err, "failed to liquid stake")
 	}
 
-	if packetMetadata.IbcReceiver == "" {
+	// If the IBCReceiver is empty, there is no forwarding step
+	if autopilotMetadata.IbcReceiver == "" {
 		return nil
 	}
 
-	hostZone, err := k.stakeibcKeeper.GetHostZoneFromHostDenom(ctx, token.Denom)
+	// Otherwise, if there is forwarding info, submit the IBC transfer
+	return k.IBCTransferStToken(ctx, msgResponse.StToken, transferMetadata, autopilotMetadata)
+}
+
+// Submits an IBC transfer of the stToken to a non-stride zone (either back to the host zone or to a different zone)
+// The sender of the transfer is the hashed receiver of the original autopilot inbound transfer
+func (k Keeper) IBCTransferStToken(
+	ctx sdk.Context,
+	stToken sdk.Coin,
+	transferMetadata transfertypes.FungibleTokenPacketData,
+	autopilotMetadata types.StakeibcPacketMetadata,
+) error {
+	hostZone, err := k.stakeibcKeeper.GetHostZoneFromHostDenom(ctx, transferMetadata.Denom)
 	if err != nil {
 		return err
 	}
 
-	return k.IBCTransferStAsset(ctx, result.StToken, addr.String(), hostZone, packetMetadata)
-}
-
-func (k Keeper) IBCTransferStAsset(ctx sdk.Context, stAsset sdk.Coin, sender string, hostZone *stakeibctypes.HostZone, packetMetadata types.StakeibcPacketMetadata) error {
-	ibcTransferTimeoutNanos := k.stakeibcKeeper.GetParam(ctx, stakeibctypes.KeyIBCTransferTimeoutNanos)
-	timeoutTimestamp := uint64(ctx.BlockTime().UnixNano()) + ibcTransferTimeoutNanos
-	channelId := packetMetadata.TransferChannel
+	// If there's no channelID specified in the packet, default to the channel on the host zone
+	channelId := autopilotMetadata.TransferChannel
 	if channelId == "" {
 		channelId = hostZone.TransferChannelId
 	}
+
+	// Generate a hashed address for the sender to the next hop,
+	// to prevent impersonation at downstream zones
+	// Note: The channel ID here is different than the one used in PFM
+	// (we use the outbound channelID, they use the inbound channelID)
+	// DOUBLE CHECK ME that it shouldn't matter
+	hashedAddress, err := types.GenerateHashedAddress(channelId, transferMetadata.Sender)
+	if err != nil {
+		return err
+	}
+
+	// First we need to bank send to the hashed address
+	originalReceiver, err := sdk.AccAddressFromBech32(transferMetadata.Receiver)
+	if err != nil {
+		return err
+	}
+	hashedSender, err := sdk.AccAddressFromBech32(hashedAddress)
+	if err != nil {
+		return err
+	}
+	if err := k.bankKeeper.SendCoins(ctx, originalReceiver, hashedSender, sdk.NewCoins(stToken)); err != nil {
+		return err
+	}
+
+	// Use a long timeout for the transfer
+	timeoutTimestamp := uint64(ctx.BlockTime().UnixNano() + LiquidStakeForwardTransferTimeout.Nanoseconds())
+
+	// Submit the transfer from the hashed address
 	transferMsg := &transfertypes.MsgTransfer{
 		SourcePort:       transfertypes.PortID,
 		SourceChannel:    channelId,
-		Token:            stAsset,
-		Sender:           sender,
-		Receiver:         packetMetadata.IbcReceiver,
+		Token:            stToken,
+		Sender:           hashedAddress,
+		Receiver:         autopilotMetadata.IbcReceiver,
 		TimeoutTimestamp: timeoutTimestamp,
-		// TimeoutHeight and Memo are unused
+		Memo:             "autopilot-liquid-stake-and-forward",
+	}
+	_, err = k.transferKeeper.Transfer(sdk.WrapSDKContext(ctx), transferMsg)
+	if err != nil {
+		return errorsmod.Wrapf(err, "failed to submit transfer during autopilot liquid stake and forward")
 	}
 
-	_, err := k.transferKeeper.Transfer(sdk.WrapSDKContext(ctx), transferMsg)
 	return err
 }