Govshuttle module does not register it messages to LegacyAminoCodec

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-05-canto/blob/d1d51b2293d4689f467b8b1c82bba84f8f7ea008/canto-main/x/govshuttle/module.go#L53

Vulnerability details

The GovShuttle implements the AppModuleBasic interface by implementing its methods.

Among these, the RegisterLegacyAminoCodec has an incorrect implementation (canto-main/x/govshuttle/module.go):

func (AppModuleBasic) RegisterCodec(cdc *codec.LegacyAmino) {
	types.RegisterCodec(cdc)
}

func (AppModuleBasic) RegisterLegacyAminoCodec(cdc *codec.LegacyAmino) {
	types.RegisterCodec(cdc)
}

In the (AppModuleBasic) RegisterLegacyAminoCodec function we can see that the Govshuttle module calls the types.RegisterCodec(cdc)
function that does nothing:

func RegisterCodec(cdc *codec.LegacyAmino) {
	// this line is used by starport scaffolding # 2
}

This means that the cdc.RegisterConcrete calls that other modules make, aren't made for the messages directed to the
Govshuttle module, so these types won't be properly decoded when signed with the LegacyAmino codec.

Impact

Messages to the Govshuttle module will fail when signed with the legacy Amino method

Proof of Concept

To prove this issue it is sufficient to send any message signed with the Legacy Amino method to the GovShuttle module

Tools Used

Code review

Recommended Mitigation Steps

Consider modifying the RegisterLegacyAminoCodec function as follows:

func (AppModuleBasic) RegisterLegacyAminoCodec(cdc *codec.LegacyAmino) {
    cdc.RegisterConcrete(&types.MsgLendingMarketProposal, "...")
    cdc.RegisterConcrete(&types.MsgTreasuryProposal, "...")
}

The AppModuleBasic RegisterCodec function can also be removed as it has no caller.

Assessed type

Other

[thebrittfactor]

Warden will be acting as the judge for this audit and therefore, has agreed to forfeit their submissions and will not be eligible for awards for this audit.

[C4-Staff]

CloudEllie marked the issue as duplicate of #29

[c4-judge]

3docSec marked the issue as unsatisfactory:
Insufficient proof