Sentinel Root Fix (#234)

* fix sentinel value

* add godoc and test

* fix grammar

* add changelog

Co-authored-by: colin axnér <25233464+colin-axner@users.noreply.github.com>

CHANGELOG.md

@@ -38,6 +38,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 ### Bug Fixes
 
+* (07-tendermint) [\#234](https://github.com/cosmos/ibc-go/pull/234) Use sentinel value for the consensus state root set during a client upgrade. This prevents genesis validation from failing.
 * (modules) [\#223](https://github.com/cosmos/ibc-go/pull/223) Use correct Prometheus format for metric labels.
 * (06-solomachine) [\#214](https://github.com/cosmos/ibc-go/pull/214) Disable defensive timestamp check in SendPacket for solo machine clients.
 * (07-tendermint) [\#210](https://github.com/cosmos/ibc-go/pull/210) Export all consensus metadata on genesis restarts for tendermint clients.

modules/light-clients/07-tendermint/types/consensus_state.go

@@ -12,6 +12,9 @@ import (
 	"github.com/cosmos/ibc-go/modules/core/exported"
 )
 
+// SentinelRoot is used as a stand-in root value for the consensus state set at the upgrade height
+const SentinelRoot = "sentinel_root"
+
 // NewConsensusState creates a new ConsensusState instance.
 func NewConsensusState(
 	timestamp time.Time, root commitmenttypes.MerkleRoot, nextValsHash tmbytes.HexBytes,

modules/light-clients/07-tendermint/types/consensus_state_test.go

@@ -21,6 +21,13 @@ func (suite *TendermintTestSuite) TestConsensusStateValidateBasic() {
 				NextValidatorsHash: suite.valsHash,
 			},
 			true},
+		{"success with sentinel",
+			&types.ConsensusState{
+				Timestamp:          suite.now,
+				Root:               commitmenttypes.NewMerkleRoot([]byte(types.SentinelRoot)),
+				NextValidatorsHash: suite.valsHash,
+			},
+			true},
 		{"root is nil",
 			&types.ConsensusState{
 				Timestamp:          suite.now,

modules/light-clients/07-tendermint/types/upgrade.go

@@ -108,14 +108,14 @@ func (cs ClientState) VerifyUpgradeAndUpdateState(
 	}
 
 	// The new consensus state is merely used as a trusted kernel against which headers on the new
-	// chain can be verified. The root is empty as it cannot be known in advance, thus no proof verification will pass.
+	// chain can be verified. The root is just a stand-in sentinel value as it cannot be known in advance, thus no proof verification will pass.
 	// The timestamp and the NextValidatorsHash of the consensus state is the blocktime and NextValidatorsHash
 	// of the last block committed by the old chain. This will allow the first block of the new chain to be verified against
 	// the last validators of the old chain so long as it is submitted within the TrustingPeriod of this client.
 	// NOTE: We do not set processed time for this consensus state since this consensus state should not be used for packet verification
 	// as the root is empty. The next consensus state submitted using update will be usable for packet-verification.
 	newConsState := NewConsensusState(
-		tmUpgradeConsState.Timestamp, commitmenttypes.MerkleRoot{}, tmUpgradeConsState.NextValidatorsHash,
+		tmUpgradeConsState.Timestamp, commitmenttypes.NewMerkleRoot([]byte(SentinelRoot)), tmUpgradeConsState.NextValidatorsHash,
 	)
 
 	// set metadata for this consensus state