feat!: add protection against accidental downgrades

x/upgrade/abci.go

@@ -22,10 +22,18 @@ import (
 // skipUpgradeHeightArray is a set of block heights for which the upgrade must be skipped
 func BeginBlocker(k keeper.Keeper, ctx sdk.Context, _ abci.RequestBeginBlock) {
 	defer telemetry.ModuleMeasureSince(types.ModuleName, time.Now(), telemetry.MetricKeyBeginBlocker)
+
+	lastAppliedPlan, _ := k.GetNextOrLastUpgrade(ctx)
+	// Throw an error if there is no upgrade handler is registered for last applied upgrade(meaning this is a wrong binary)
+	if lastAppliedPlan != "" && !k.HasHandler(lastAppliedPlan) {
+		panic(fmt.Sprintf("upgrade handler is missing for %s upgrade plan", lastAppliedPlan))
+	}
+
 	plan, found := k.GetUpgradePlan(ctx)
 	if !found {
 		return
 	}
+
 	logger := ctx.Logger()
 
 	// To make sure clear upgrade is executed at the same block

x/upgrade/abci_test.go

@@ -410,3 +410,51 @@ func TestDumpUpgradeInfoToFile(t *testing.T) {
 	err = os.Remove(upgradeInfoFilePath)
 	require.Nil(err)
 }
+
+func TestBinaryVersion(t *testing.T) {
+	s := setupTest(t, 10, map[int64]bool{})
+
+	t.Log("verify not panic: upgrade handler is present for applied upgrade")
+	s.keeper.SetUpgradeHandler("test0", func(_ sdk.Context, _ types.Plan, vm module.VersionMap) (module.VersionMap, error) {
+		return vm, nil
+	})
+
+	err := s.handler(s.ctx, &types.SoftwareUpgradeProposal{Title: "Upgrade test", Plan: types.Plan{Name: "test0", Height: s.ctx.BlockHeight() + 2}})
+	require.Nil(t, err)
+
+	newCtx := s.ctx.WithBlockHeight(12)
+	s.keeper.ApplyUpgrade(newCtx, types.Plan{
+		Name:   "test0",
+		Height: 12,
+	})
+
+	newCtx = s.ctx.WithBlockHeight(13)
+	req := abci.RequestBeginBlock{Header: newCtx.BlockHeader()}
+	require.NotPanics(t, func() {
+		s.module.BeginBlock(newCtx, req)
+	})
+
+	t.Log("verify not panic: upgrade handler is present for scheduled upgrade")
+	s.keeper.SetUpgradeHandler("test1", func(_ sdk.Context, _ types.Plan, vm module.VersionMap) (module.VersionMap, error) {
+		return vm, nil
+	})
+
+	err = s.handler(s.ctx, &types.SoftwareUpgradeProposal{Title: "Upgrade test", Plan: types.Plan{Name: "test1", Height: s.ctx.BlockHeight() + 2}})
+	require.Nil(t, err)
+
+	newCtx = s.ctx.WithBlockHeight(13)
+	req = abci.RequestBeginBlock{Header: newCtx.BlockHeader()}
+	require.NotPanics(t, func() {
+		s.module.BeginBlock(newCtx, req)
+	})
+
+	t.Log("verify test panic: upgrade handler is not present for scheduled upgrade")
+	err = s.handler(s.ctx, &types.SoftwareUpgradeProposal{Title: "Upgrade test", Plan: types.Plan{Name: "test2", Height: s.ctx.BlockHeight() + 2}})
+	require.Nil(t, err)
+
+	newCtx = s.ctx.WithBlockHeight(13)
+	req = abci.RequestBeginBlock{Header: newCtx.BlockHeader()}
+	require.Panics(t, func() {
+		s.module.BeginBlock(newCtx, req)
+	})
+}

x/upgrade/keeper/keeper.go

@@ -16,6 +16,7 @@ import (
 	"github.com/cosmos/cosmos-sdk/store/prefix"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+	"github.com/cosmos/cosmos-sdk/types/kv"
 	"github.com/cosmos/cosmos-sdk/types/module"
 	xp "github.com/cosmos/cosmos-sdk/x/upgrade/exported"
 	"github.com/cosmos/cosmos-sdk/x/upgrade/types"
@@ -227,6 +228,23 @@ func (k Keeper) GetUpgradedConsensusState(ctx sdk.Context, lastHeight int64) ([]
 	return bz, true
 }
 
+// GetNextOrLastUpgrade returns the last applied upgrade name and height.
+func (k Keeper) GetNextOrLastUpgrade(ctx sdk.Context) (string, int64) {
+	iter := sdk.KVStoreReversePrefixIterator(ctx.KVStore(k.storeKey), []byte{types.DoneByte})
+	defer iter.Close()
+	if iter.Valid() {
+		return parseDoneKey(iter.Key()), int64(binary.BigEndian.Uint64(iter.Value()))
+	}
+
+	return "", 0
+}
+
+// parseDoneKey - split upgrade name from the done key
+func parseDoneKey(key []byte) string {
+	kv.AssertKeyAtLeastLength(key, 2)
+	return string(key[1:])
+}
+
 // GetDoneHeight returns the height at which the given upgrade was executed
 func (k Keeper) GetDoneHeight(ctx sdk.Context, name string) int64 {
 	store := prefix.NewStore(ctx.KVStore(k.storeKey), []byte{types.DoneByte})

x/upgrade/keeper/keeper_test.go

@@ -232,6 +232,45 @@ func (s *KeeperTestSuite) TestMigrations() {
 	s.Require().Equal(vmBefore["bank"]+1, vm["bank"])
 }
 
+func (s *KeeperTestSuite) TestLastCompletedUpgrade() {
+	keeper := s.app.UpgradeKeeper
+	require := s.Require()
+
+	s.T().Log("verify empty name if applied upgrades are empty")
+	name, height := keeper.GetNextOrLastUpgrade(s.ctx)
+	require.Equal("", name)
+	require.Equal(int64(0), height)
+
+	keeper.SetUpgradeHandler("test0", func(_ sdk.Context, _ types.Plan, vm module.VersionMap) (module.VersionMap, error) {
+		return vm, nil
+	})
+
+	keeper.ApplyUpgrade(s.ctx, types.Plan{
+		Name:   "test0",
+		Height: 10,
+	})
+
+	s.T().Log("verify valid upgrade name and height")
+	name, height = keeper.GetNextOrLastUpgrade(s.ctx)
+	require.Equal("test0", name)
+	require.Equal(int64(10), height)
+
+	keeper.SetUpgradeHandler("test1", func(_ sdk.Context, _ types.Plan, vm module.VersionMap) (module.VersionMap, error) {
+		return vm, nil
+	})
+
+	newCtx := s.ctx.WithBlockHeight(15)
+	keeper.ApplyUpgrade(newCtx, types.Plan{
+		Name:   "test1",
+		Height: 15,
+	})
+
+	s.T().Log("verify valid upgrade name and height with multiple upgrades")
+	name, height = keeper.GetNextOrLastUpgrade(newCtx)
+	require.Equal("test1", name)
+	require.Equal(int64(15), height)
+}
+
 func TestKeeperTestSuite(t *testing.T) {
 	suite.Run(t, new(KeeperTestSuite))
 }