diff --git a/modules/core/02-client/keeper/grpc_query.go b/modules/core/02-client/keeper/grpc_query.go index 01cbaacdc2f..9ba5241fe57 100644 --- a/modules/core/02-client/keeper/grpc_query.go +++ b/modules/core/02-client/keeper/grpc_query.go @@ -4,6 +4,7 @@ import ( "bytes" "context" "fmt" + "slices" "sort" "strings" @@ -341,6 +342,16 @@ func (k Keeper) VerifyMembership(c context.Context, req *types.QueryVerifyMember return nil, status.Error(codes.InvalidArgument, err.Error()) } + clientType, _, err := types.ParseClientIdentifier(req.ClientId) + if err != nil { + return nil, status.Error(codes.InvalidArgument, err.Error()) + } + + denyClients := []string{exported.Localhost, exported.Solomachine} + if slices.Contains(denyClients, clientType) { + return nil, status.Error(codes.InvalidArgument, errorsmod.Wrapf(types.ErrInvalidClientType, "verify membership is disabled for client types %s", denyClients).Error()) + } + if len(req.Proof) == 0 { return nil, status.Error(codes.InvalidArgument, "empty proof") } diff --git a/modules/core/02-client/keeper/grpc_query_test.go b/modules/core/02-client/keeper/grpc_query_test.go index 75520f1935c..379e9ea2670 100644 --- a/modules/core/02-client/keeper/grpc_query_test.go +++ b/modules/core/02-client/keeper/grpc_query_test.go @@ -713,6 +713,24 @@ func (suite *KeeperTestSuite) TestQueryVerifyMembershipProof() { }, host.ErrInvalidID, }, + { + "localhost client ID is denied", + func() { + req = &types.QueryVerifyMembershipRequest{ + ClientId: exported.LocalhostClientID, + } + }, + types.ErrInvalidClientType, + }, + { + "solomachine client ID is denied", + func() { + req = &types.QueryVerifyMembershipRequest{ + ClientId: types.FormatClientIdentifier(exported.Solomachine, 1), + } + }, + types.ErrInvalidClientType, + }, { "empty proof", func() {