check counterparty nextSequenceSend in recvPacket

modules/core/04-channel/keeper/packet.go

@@ -132,6 +132,27 @@ func (k Keeper) RecvPacket(
 		return errorsmod.Wrapf(types.ErrInvalidChannelState, "expected channel state to be one of [%s, %s], but got %s", types.OPEN, types.FLUSHING, channel.State)
 	}
 
+	// In the case of the channel being in FLUSHING we need to ensure that the
+	// packet sequence is < counterparty next sequence send. This is a defensive
+	// check and if the counterparty is implemented correctly, this should never abort.
+	if channel.State == types.FLUSHING {
+		counterpartyUpgrade, found := k.GetCounterpartyUpgrade(ctx, packet.GetDestPort(), packet.GetDestChannel())
+		if !found {
+			return errorsmod.Wrapf(types.ErrUpgradeNotFound, "counterparty upgrade not found: portID (%s), channelID (%s)", packet.GetDestPort(), packet.GetDestChannel())
+		}
+
+		// only error if the counterparty next sequence send is set (> 0)
+		// this error should never be reached, as under normal circumstances the counterparty
+		// should not send any packets after the upgrade has been started.
+		counterpartyNextSequenceSend := counterpartyUpgrade.NextSequenceSend
+		if counterpartyNextSequenceSend != 0 && packet.GetSequence() >= counterpartyNextSequenceSend {
+			return errorsmod.Wrapf(
+				types.ErrInvalidPacket,
+				"failed to receive packet, cannot flush packet at sequence greater than or equal to counterparty next sequence send (%d) ≥ (%d)", packet.GetSequence(), counterpartyNextSequenceSend,
+			)
+		}
+	}
+
 	// Authenticate capability to ensure caller has authority to receive packet on this channel
 	capName := host.ChannelCapabilityPath(packet.GetDestPort(), packet.GetDestChannel())
 	if !k.scopedKeeper.AuthenticateCapability(ctx, chanCap, capName) {

modules/core/04-channel/keeper/packet_test.go

@@ -352,14 +352,14 @@ func (suite *KeeperTestSuite) TestRecvPacket() {
 				channel.State = types.FLUSHING
 				path.EndpointB.SetChannel(channel)
 
-				// set last packet sent sequence to sequence + 1
-				counterpartyUpgrade := types.Upgrade{LatestSequenceSend: sequence + 1}
+				// set upgrade next sequence send to sequence + 1
+				counterpartyUpgrade := types.Upgrade{NextSequenceSend: sequence + 1}
 				path.EndpointB.SetChannelCounterpartyUpgrade(counterpartyUpgrade)
 			},
 			nil,
 		},
 		{
-			"success with an counterparty latest sequence send set to 0",
+			"success with an counterparty next sequence send set to 0",
 			func() {
 				suite.coordinator.Setup(path)
 				sequence, err := path.EndpointA.SendPacket(defaultTimeoutHeight, disabledTimeoutTimestamp, ibctesting.MockPacketData)
@@ -372,12 +372,49 @@ func (suite *KeeperTestSuite) TestRecvPacket() {
 				channel.State = types.FLUSHING
 				path.EndpointB.SetChannel(channel)
 
-				// set last packet sent sequence to zero.
-				counterpartyUpgrade := types.Upgrade{LatestSequenceSend: 0}
+				// set upgrade next sequence send to zero.
+				counterpartyUpgrade := types.Upgrade{NextSequenceSend: 0}
 				path.EndpointB.SetChannelCounterpartyUpgrade(counterpartyUpgrade)
 			},
 			nil,
 		},
+		{
+			"failure while upgrading channel, counterparty upgrade not found",
+			func() {
+				suite.coordinator.Setup(path)
+				sequence, err := path.EndpointA.SendPacket(defaultTimeoutHeight, disabledTimeoutTimestamp, ibctesting.MockPacketData)
+				suite.Require().NoError(err)
+				packet = types.NewPacket(ibctesting.MockPacketData, sequence, path.EndpointA.ChannelConfig.PortID, path.EndpointA.ChannelID, path.EndpointB.ChannelConfig.PortID, path.EndpointB.ChannelID, defaultTimeoutHeight, disabledTimeoutTimestamp)
+				channelCap = suite.chainB.GetChannelCapability(path.EndpointB.ChannelConfig.PortID, path.EndpointB.ChannelID)
+
+				channel := path.EndpointB.GetChannel()
+				channel.State = types.FLUSHING
+				path.EndpointB.SetChannel(channel)
+			},
+			types.ErrUpgradeNotFound,
+		},
+		{
+			"failure while upgrading channel, packet sequence ≥ counterparty next send sequence",
+			func() {
+				suite.coordinator.Setup(path)
+				// send 2 packets so that when NextSequenceSend is set to sequence - 1, it is not 0.
+				_, err := path.EndpointA.SendPacket(defaultTimeoutHeight, disabledTimeoutTimestamp, ibctesting.MockPacketData)
+				suite.Require().NoError(err)
+				sequence, err := path.EndpointA.SendPacket(defaultTimeoutHeight, disabledTimeoutTimestamp, ibctesting.MockPacketData)
+				suite.Require().NoError(err)
+				packet = types.NewPacket(ibctesting.MockPacketData, sequence, path.EndpointA.ChannelConfig.PortID, path.EndpointA.ChannelID, path.EndpointB.ChannelConfig.PortID, path.EndpointB.ChannelID, defaultTimeoutHeight, disabledTimeoutTimestamp)
+				channelCap = suite.chainB.GetChannelCapability(path.EndpointB.ChannelConfig.PortID, path.EndpointB.ChannelID)
+
+				channel := path.EndpointB.GetChannel()
+				channel.State = types.FLUSHING
+				path.EndpointB.SetChannel(channel)
+
+				// set upgrade next sequence send to sequence - 1
+				counterpartyUpgrade := types.Upgrade{NextSequenceSend: sequence - 1}
+				path.EndpointB.SetChannelCounterpartyUpgrade(counterpartyUpgrade)
+			},
+			types.ErrInvalidPacket,
+		},
 		{
 			"failure while upgrading channel, channel in flush complete state",
 			func() {

modules/core/04-channel/keeper/upgrade.go

@@ -323,10 +323,6 @@ func (k Keeper) WriteUpgradeAckChannel(ctx sdk.Context, portID, channelID string
 	if !k.HasInflightPackets(ctx, portID, channelID) {
 		channel.State = types.FLUSHCOMPLETE
 		k.SetChannel(ctx, portID, channelID, channel)
-	} else {
-		// the counterparty upgrade is only required if the channel is still in the FLUSHING state.
-		// this gets read when timing out and acknowledging packets.
-		k.SetCounterpartyUpgrade(ctx, portID, channelID, counterpartyUpgrade)
 	}
 
 	upgrade, found := k.GetUpgrade(ctx, portID, channelID)
@@ -337,6 +333,7 @@ func (k Keeper) WriteUpgradeAckChannel(ctx sdk.Context, portID, channelID string
 	upgrade.Fields.Version = counterpartyUpgrade.Fields.Version
 
 	k.SetUpgrade(ctx, portID, channelID, upgrade)
+	k.SetCounterpartyUpgrade(ctx, portID, channelID, counterpartyUpgrade)
 
 	k.Logger(ctx).Info("channel state updated", "port-id", portID, "channel-id", channelID, "state", channel.State.String())
 	return channel, upgrade
@@ -432,13 +429,10 @@ func (k Keeper) WriteUpgradeConfirmChannel(ctx sdk.Context, portID, channelID st
 		previousState := channel.State
 		channel.State = types.FLUSHCOMPLETE
 		k.SetChannel(ctx, portID, channelID, channel)
-
 		k.Logger(ctx).Info("channel state updated", "port-id", portID, "channel-id", channelID, "previous-state", previousState, "new-state", channel.State)
-	} else {
-		// the counterparty upgrade is only required if the channel is still in the FLUSHING state.
-		// this gets read when timing out and acknowledging packets.
-		k.SetCounterpartyUpgrade(ctx, portID, channelID, counterpartyUpgrade)
 	}
+
+	k.SetCounterpartyUpgrade(ctx, portID, channelID, counterpartyUpgrade)
 	return channel
 }
 
@@ -539,6 +533,26 @@ func (k Keeper) WriteUpgradeOpenChannel(ctx sdk.Context, portID, channelID strin
 		panic(fmt.Errorf("could not find upgrade when updating channel state, channelID: %s, portID: %s", channelID, portID))
 	}
 
+	counterpartyUpgrade, found := k.GetCounterpartyUpgrade(ctx, portID, channelID)
+	if !found {
+		panic(fmt.Errorf("could not find counterparty upgrade when updating channel state, channelID: %s, portID: %s", channelID, portID))
+	}
+
+	// next seq recv and ack is used for ordered channels to verify the packet has been received/acked in the correct order
+	// this is no longer necessary if the channel is UNORDERED and should be reset to 1
+	if channel.Ordering == types.ORDERED && upgrade.Fields.Ordering == types.UNORDERED {
+		k.SetNextSequenceRecv(ctx, portID, channelID, 1)
+		k.SetNextSequenceAck(ctx, portID, channelID, 1)
+	}
+
+	// next seq recv and ack should updated when moving from UNORDERED to ORDERED using the latest packet sequence sent before the upgrade
+	// we can be sure that the next packet we are set to receive will be the first packet the counterparty sends after reopening.
+	// we can be sure that our next acknowledgement will be our first packet sent after upgrade, as the counterparty processed all sent packets after flushing completes.
+	if channel.Ordering == types.UNORDERED && upgrade.Fields.Ordering == types.ORDERED {
+		k.SetNextSequenceRecv(ctx, portID, channelID, counterpartyUpgrade.NextSequenceSend)
+		k.SetNextSequenceAck(ctx, portID, channelID, upgrade.NextSequenceSend)
+	}
+
 	// Switch channel fields to upgrade fields and set channel state to OPEN
 	previousState := channel.State
 	channel.Ordering = upgrade.Fields.Ordering
@@ -774,7 +788,7 @@ func (k Keeper) startFlushing(ctx sdk.Context, portID, channelID string, upgrade
 		return errorsmod.Wrapf(types.ErrSequenceSendNotFound, "port ID (%s) channel ID (%s)", portID, channelID)
 	}
 
-	upgrade.LatestSequenceSend = nextSequenceSend - 1
+	upgrade.NextSequenceSend = nextSequenceSend
 	upgrade.Timeout = k.getAbsoluteUpgradeTimeout(ctx)
 	k.SetUpgrade(ctx, portID, channelID, *upgrade)