Add an entry to the unreleased provider section whenever merging a PR to main that is not targeted at a specific release. These entries will eventually be included in a provider release.
- (feat!) #1230 Throttle with retries provider changes.
- (feature!) #1280 provider proposal for changing reward denoms
- (feature!) #1244 Update the default consumer unbonding period to 2 weeks.
- (deps) #1259 Bump cosmos-sdk to v0.47.5.
- (deps!) #1258 Bump ibc-go to v7.3.0.
- (deps) #1258 Bump cosmos-sdk to v0.47.4.
- (deps!) #1196 Bump ibc-go to v7.2.0.
[x/ccv/provider](fix) #1076 AddInitTimeoutTimestampsandExportedVscSendTimestampsto exported genesis.
Add an entry to the unreleased consumer section whenever merging a PR to main that is not targeted at a specific release. These entries will eventually be included in a consumer release.
Date September 6th, 2023
A minor version upgrade to the CONSUMER CCV module. This release includes various changes involving throttling v2 functionality, validation, and bumps to deps like cosmos-sdk and ibc-go.
Note:
- This release is ONLY RELEVANT TO CONSUMERS. The most recent provider release is v3.1.0, and will eventually be a release postfixed with
-provider. - this is the first upgrade to the consumer module with a separate semver cycle from the provider module. See contributing.md and associated ADR for more info.
Changes:
- (feat) #1295 increment consumer consensus version and register consumer packet migration.
- (fix!) #1262 Remove incorrect address validation on
ProviderFeePoolAddrStrparam. - (feature!) #1244 Update the default consumer unbonding period to 2 weeks.
- (fix!) #1244 Validate token transfer messages before calling
Transfer(). - (deps) #1259 Bump cosmos-sdk to v0.47.5.
- (deps!) #1258 Bump ibc-go to v7.3.0.
- (deps) #1258 Bump cosmos-sdk to v0.47.4.
- (deps!) #1196 Bump ibc-go to v7.2.0.
- (feat!) #1024 Throttle with retries, consumer changes.
- (fix!) #1150 Revert consumer packet data changes from #1037.
- (fix!) #1146 Proper deletion of pending packets.
- (feat!) #1037 Optimize pending packets storage on consumer, with migration.
- (feat) #1164 Introduce the gRPC query
/interchain_security/ccv/consumer/provider-infoand CLI commandinterchain-security-cd q ccvconsumer provider-infoto retrieve provider info from the consumer chain.
Date July 11th, 2023
A minor upgrade to v3.0.0, which removes the panic in the consumer ccv module which would occur in an emergency scenario where the ccv channel is closed. This release also fixes how a distribution related event is emitted, and bumps cometbft.
- (feat) #1127 Remove consumer panic when ccv channel is closed
- (fix) #720 Fix the attribute
AttributeDistributionTotalvalue inFeeDistributionevent emit. - (deps) #1119 bump cometbft from
v0.37.1to0.37.2.
Date: June 21st, 2023
Interchain Security v3 uses SDK 0.47 and IBC 7.
- (fix) #1093 Make SlashPacketData backward compatible when sending data over the wire
- (deps) #1019 Bump multiple dependencies.
[x/ccv/provider](fix) #945 RefactorAfterUnbondingInitiatedto not panic whenPutUnbondingOnHoldreturns error.[x/ccv/provider](fix) #977 Avoids panicking the provider when an unbonding delegation was removed through aCancelUnbondingDelegationmessage.[x/ccv/democracy](feat) #1019 Whitelisting non-legacy params in the "democracy module" require the entire module to be whitelisted.
Date: September 15th, 2023
- (feature!) #1280 provider proposal for changing reward denoms
Date: August 18th, 2023
- (deps!) #1120 Bump Cosmos SDK to v0.45.16-ics-lsm. This requires adapting ICS to support this SDK release. Changes are state breaking.
- (fix) #720 Fix the attribute
AttributeDistributionTotalvalue inFeeDistributionevent emit.
Date: June 1st, 2023
Unlike prior releases, the ICS v2.0.0 release will be based on the main branch. v2.0.0 will contain all the accumulated PRs from the various releases below, along with other PRs that were merged, but not released to production. After v2.0.0, we plan to revamp release practices, and how we modularize the repo for consumer/provider.
Upgrading a provider from v1.1.0-multiden to v2.0.0 will require state migrations. See migration.go. See the provider module's ConsensusVersion in module
Upgrading a consumer from v1.2.0-multiden to v2.0.0 will NOT require state migrations. See the consumer module's ConsensusVersion in module
Some PRs from v2.0.0 may reappear from other releases below. This is due to the fact that ICS v1.1.0 deviates from the commit ordering of the main branch, and other releases thereafter are based on v1.1.0.
- MVP for standalone to consumer changeover, see EPIC
- MVP for soft opt out, see EPIC
- Various fixes, critical and non-critical
- Docs updates which should not affect production code
- (feat!) Add DistributionTransmissionChannel to ConsumerAdditionProposal #965
- (feat/fix) limit vsc matured packets handled per endblocker #1004
- (fix) cosumer key prefix order to avoid complex migrations #963 and #991. The latter PR is the proper fix.
- (feat) v1->v2 migrations to accommodate a bugfix having to do with store keys, introduce new params, and deal with consumer genesis state schema changes #975 and #997
- (deps) Bump github.com/cosmos/ibc-go/v4 from 4.4.0 to 4.4.2 #982
- (fix) partially revert key assignment type safety PR #980
- (fix) Remove panics on failure to send IBC packets #876
- (fix) Prevent denom DOS #931
- (fix) multisig for assigning consumer key, use json #916
- (deps) Bump github.com/cosmos/ibc-go/v4 from 4.3.0 to 4.4.0 #902
- (feat) Add warnings when provider unbonding is shorter than consumer unbonding #858
- (chore) use go 1.19 #899, #840
- (feat) Standalone to consumer changeover - recycle existing transfer channel #832
- (deps) Bump IBC 862
- (testing) Add tests for soft opt out #857
- (feat) Standalone to consumer changeover - staking functionalities #794
- (fix) prevent provider from sending VSCPackets with multiple updates for the same validator #850
- (feat) Soft opt out #833
- (fix) Correctly handle VSC packet with duplicate val updates on consumer #846
- (deps) bump sdk to v0.45.15.ics #805
- (refactor) Remove spm module #812
- (feat) Standalone to consumer changeover part 1 #757
- (chore) Swap names of e2e and integration tests #681
- (fix) fix StopConsumerChain not running in cachedContext #802. Also in earlier releases with different commit order!
- (docs) Introduce docs website #759
- (fix) Serialize correct byte prefix for SlashLogKey #786
- (feature) Improve keeper field validation #766
- (docs) Contributing guidelines #744
- (refactor) Key assignment type safety #725
- (fix) Update protos and fix deps #752
- (api) Add consumer QueryParams #746
- (feature) New validation for keeper fields #740
The first release candidate for a fix built on top of v1.2.0, intended for consumers. This release adds a list of denoms on the consumer that are allowed to be sent to the provider as rewards. This prevents a potential DOS attack that was discovered during the audit of Replicated Security performed by Oak Security and funded by the Cosmos Hub community through Proposal 687. In an effort to move quickly, this release also includes a multisig fix that is effective only for provider. It shouldn't affect the consumer module.
Note PRs were made in a private security repo.
This release combines two fixes on top of v1.1.0, that we judged were urgent to get onto the Cosmos Hub before the launch of the first ICS consumer chain. This is an emergency release intended for providers.
The first fix is to enable the use of multisigs and Ledger devices when assigning keys for consumer chains. The second is to prevent a possible DOS vector involving the reward distribution system.
Note PRs were made in a private security repo.
On April 25th (a week and a half ago), we began receiving reports that validators using multisigs and Ledger devices were getting errors reading Error: unable to resolve type URL /interchain_security.ccv.provider.v1.MsgAssignConsumerKey: tx parse error when attempting to assign consensus keys for consumer chains.
We quickly narrowed the problem down to issues having to do with using the PubKey type directly in the MsgAssignConsumerKey transaction, and Amino (a deprecated serialization library still used in Ledger devices and multisigs) not being able to handle this. We attempted to fix this with the assistance of the Cosmos-SDK team, but after making no headway for a few days, we decided to simply use a JSON representation of the PubKey in the transaction. This is how it is usually represented anyway. We have verified that this fixes the problem.
The ICS distribution system works by allowing consumer chains to send rewards to a module address on the provider called the FeePoolAddress. From here they are automatically distributed to all validators and delegators through the distribution system that already exists to distribute staking rewards. The FeePoolAddress is usually blocked so that no tokens can be sent to it, but to enable ICS distribution we had to unblock it.
We recently realized that unblocking the FeePoolAddress could enable an attacker to send a huge number of different denoms into the distribution system. The distribution system would then attempt to distribute them all, leading to out of memory errors. Fixing a similar attack vector that existed in the distribution system before ICS led us to this realization.
To fix this problem, we have re-blocked the FeePoolAddress and created a new address called the ConsumerRewardsPool. Consumer chains now send rewards to this new address. There is also a new transaction type called RegisterConsumerRewardDenom. This transaction allows people to register denoms to be used as rewards from consumer chains. It costs 10 Atoms to run this transaction.The Atoms are transferred to the community pool. Only denoms registered with this command are then transferred to the FeePoolAddress and distributed out to delegators and validators.
Date: April 13th, 2023
- (feat) Soft opt-out #833
- (fix) Correctly handle VSC packet with duplicate val updates on consumer #846
- (chore) bump: sdk v0.45.15-ics #805
- (api) add interchain security consumer QueryParams #746
Date: March 24th, 2023
- (fix) StopConsumerChain not running in cachedContext #802
Date: February 6th, 2023
This is the first version of Interchain Security (ICS), also known as Replicated Security (RS). Replicated Security is a feature which will allow a chain -- referred to as the provider -- to share security with other chains -- referred to as consumers. This means that the provider's validator set will be granted the right to validate consumer chains. The communication between the provider and the consumer chains is done through the IBC protocol over a unique, ordered channel (one for each consumer chain). Thus, RS is an IBC application.
RS consist of the following core features:
- Channel Initialization: Enables the provider to add new consumer chains. This process is governance-gated, i.e., to add a new consumer chain, a
ConsumerAdditionProposalgovernance proposal must be sent to the provider and it must receive the necessary votes. - Validator Set Update: Enables the provider to (1) update the consumers on the voting power granted to validators (based on the changes in the active validator set on the provider chain), and (2) ensure the timely completion of unbonding operations (e.g., undelegations).
- Consumer Initiated Slashing: Enables the provider to jail validators for downtime infractions on the consumer chains.
- Reward Distribution: Enables the consumers to transfer to the provider (over IBC) a portion of their block rewards as payment for the security provided. Once transferred, these rewards are distributed on the provider using the protocol in the distribution module of Cosmos SDK.
- Consumer Chain Removal: Enables the provider to remove a consumer either after a
ConsumerRemovalProposalpasses governance or after one of the timeout periods elapses --InitTimeoutPeriod,VscTimeoutPeriod,IBCTimeoutPeriod. - Social Slashing: Equivocation offenses (double signing etc.) on consumer chains are logged, and then can be used in a governance proposal to slash the validators responsible.
In addition, RS has the following features:
- Key Assignment: Enables validator operators to use different consensus keys for each consumer chain validator node that they operate.
- Jail Throttling: Enables the provider to slow down a "worst case scenario" attack where a malicious consumer binary attempts to jail a significant amount (> 2/3) of the voting power, effectively taking control of the provider.