imp: return Unauthorised if code hash is not stored (#5102)

* imp: client is unauthorized if code hash not stored

* change comment

modules/light-clients/08-wasm/types/client_state.go

@@ -59,8 +59,12 @@ func (cs ClientState) Validate() error {
 // A frozen client will become expired, so the Frozen status
 // has higher precedence.
 func (cs ClientState) Status(ctx sdk.Context, clientStore storetypes.KVStore, _ codec.BinaryCodec) exported.Status {
-	payload := QueryMsg{Status: &StatusMsg{}}
+	// Return unauthorized if the code hash hasn't been previously stored via storeWasmCode.
+	if !HasCodeHash(ctx, cs.CodeHash) {
+		return exported.Unauthorized
+	}
 
+	payload := QueryMsg{Status: &StatusMsg{}}
 	result, err := wasmQuery[StatusResult](ctx, clientStore, &cs, payload)
 	if err != nil {
 		return exported.Unknown

modules/light-clients/08-wasm/types/client_state_test.go

@@ -11,6 +11,7 @@ import (
 
 	storetypes "cosmossdk.io/store/types"
 
+	"github.com/cosmos/ibc-go/modules/light-clients/08-wasm/internal/ibcwasm"
 	wasmtesting "github.com/cosmos/ibc-go/modules/light-clients/08-wasm/testing"
 	"github.com/cosmos/ibc-go/modules/light-clients/08-wasm/types"
 	clienttypes "github.com/cosmos/ibc-go/v8/modules/core/02-client/types"
@@ -65,6 +66,14 @@ func (suite *TypesTestSuite) TestStatus() {
 			},
 			exported.Unknown,
 		},
+		{
+			"client status is unauthorized: code hash is not stored",
+			func() {
+				err := ibcwasm.CodeHashes.Remove(suite.chainA.GetContext(), suite.codeHash)
+				suite.Require().NoError(err)
+			},
+			exported.Unauthorized,
+		},
 	}
 
 	for _, tc := range testCases {