From 87017b880d935f375f27055c3d88fbf0d1d4fa59 Mon Sep 17 00:00:00 2001 From: zemyblue Date: Fri, 3 May 2024 14:21:22 +0900 Subject: [PATCH] feat: add filtering function in StargateMsg of wasm Signed-off-by: zemyblue --- app/app.go | 3 + app/wasm_filter.go | 35 +++ app/wasm_filter_test.go | 603 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 641 insertions(+) create mode 100644 app/wasm_filter.go create mode 100644 app/wasm_filter_test.go diff --git a/app/app.go b/app/app.go index fc3c5167..b6ad5fe3 100644 --- a/app/app.go +++ b/app/app.go @@ -437,6 +437,9 @@ func NewLinkApp( panic("error while reading wasm config: " + err.Error()) } + // change wasm's StargateMsgEncoder to filtered encoder + wasmOpts = append(wasmOpts, wasmkeeper.WithMessageEncoders(filteredStargateMsgEncoders(appCodec))) + // The last arguments can contain custom message handlers, and custom query handlers, // if we want to allow any custom callbacks availableCapabilities := "iterator,staking,stargate,cosmwasm_1_1" diff --git a/app/wasm_filter.go b/app/wasm_filter.go new file mode 100644 index 00000000..e5cff9f7 --- /dev/null +++ b/app/wasm_filter.go @@ -0,0 +1,35 @@ +package app + +import ( + "strings" + + "github.com/Finschia/finschia-sdk/codec" + codectypes "github.com/Finschia/finschia-sdk/codec/types" + sdk "github.com/Finschia/finschia-sdk/types" + sdkerrors "github.com/Finschia/finschia-sdk/types/errors" + wasmkeeper "github.com/Finschia/wasmd/x/wasm/keeper" + wasmtypes "github.com/Finschia/wasmd/x/wasm/types" + wasmvmtypes "github.com/Finschia/wasmvm/types" +) + +// deniedModulesInStargateMsg is deny list in StargateMsg of wasm +var deniedModulesInStargateMsg = []string{"/lbm.fswap.v1", "/lbm.fbridge.v1"} + +func filteredStargateMsgEncoders(cdc codec.Codec) *wasmkeeper.MessageEncoders { + return &wasmkeeper.MessageEncoders{ + Stargate: wasmFilteredEncodeStargateMsg(cdc), + } +} + +func wasmFilteredEncodeStargateMsg(unpakcer codectypes.AnyUnpacker) wasmkeeper.StargateEncoder { + stargateMsgEncoder := wasmkeeper.EncodeStargateMsg(unpakcer) + return func(sender sdk.AccAddress, msg *wasmvmtypes.StargateMsg) ([]sdk.Msg, error) { + for _, moduleName := range deniedModulesInStargateMsg { + if strings.HasPrefix(msg.TypeURL, moduleName) { + return nil, sdkerrors.Wrap(wasmtypes.ErrUnsupportedForContract, moduleName+" not supported by Stargate") + } + } + + return stargateMsgEncoder(sender, msg) + } +} diff --git a/app/wasm_filter_test.go b/app/wasm_filter_test.go new file mode 100644 index 00000000..0cd57b7f --- /dev/null +++ b/app/wasm_filter_test.go @@ -0,0 +1,603 @@ +package app + +import ( + "testing" + + "github.com/golang/protobuf/proto" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + codectypes "github.com/Finschia/finschia-sdk/codec/types" + sdk "github.com/Finschia/finschia-sdk/types" + banktypes "github.com/Finschia/finschia-sdk/x/bank/types" + distributiontypes "github.com/Finschia/finschia-sdk/x/distribution/types" + govtypes "github.com/Finschia/finschia-sdk/x/gov/types" + stakingtypes "github.com/Finschia/finschia-sdk/x/staking/types" + wasmkeeper "github.com/Finschia/wasmd/x/wasm/keeper" + "github.com/Finschia/wasmd/x/wasm/keeper/wasmtesting" + wasmtypes "github.com/Finschia/wasmd/x/wasm/types" + wasmvmtypes "github.com/Finschia/wasmvm/types" + ibctransfertypes "github.com/cosmos/ibc-go/v4/modules/apps/transfer/types" + clienttypes "github.com/cosmos/ibc-go/v4/modules/core/02-client/types" + channeltypes "github.com/cosmos/ibc-go/v4/modules/core/04-channel/types" +) + +func TestFilteredStargateMsgEncoders(t *testing.T) { + var ( + addr1 = wasmkeeper.RandomAccountAddress(t) + addr2 = wasmkeeper.RandomAccountAddress(t) + addr3 = wasmkeeper.RandomAccountAddress(t) + invalidAddr = "xrnd1d02kd90n38qvr3qb9qof83fn2d2" + ) + valAddr := make(sdk.ValAddress, wasmtypes.SDKAddrLen) + valAddr[0] = 12 + valAddr2 := make(sdk.ValAddress, wasmtypes.SDKAddrLen) + valAddr2[1] = 123 + + jsonMsg := wasmtypes.RawContractMessage(`{"foo": 123}`) + + bankMsg := &banktypes.MsgSend{ + FromAddress: addr2.String(), + ToAddress: addr1.String(), + Amount: sdk.Coins{ + sdk.NewInt64Coin("uatom", 12345), + sdk.NewInt64Coin("utgd", 54321), + }, + } + bankMsgBin, err := proto.Marshal(bankMsg) + require.NoError(t, err) + + content, err := codectypes.NewAnyWithValue(wasmtypes.StoreCodeProposalFixture()) + require.NoError(t, err) + + proposalMsg := &govtypes.MsgSubmitProposal{ + Proposer: addr1.String(), + InitialDeposit: sdk.NewCoins(sdk.NewInt64Coin("uatom", 12345)), + Content: content, + } + proposalMsgBin, err := proto.Marshal(proposalMsg) + require.NoError(t, err) + + cases := map[string]struct { + sender sdk.AccAddress + srcMsg wasmvmtypes.CosmosMsg + srcContractIBCPort string + transferPortSource wasmtypes.ICS20TransferPortSource + // set if valid + output []sdk.Msg + // set if invalid + isError bool + }{ + "simple send": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Bank: &wasmvmtypes.BankMsg{ + Send: &wasmvmtypes.SendMsg{ + ToAddress: addr2.String(), + Amount: []wasmvmtypes.Coin{ + { + Denom: "uatom", + Amount: "12345", + }, + { + Denom: "usdt", + Amount: "54321", + }, + }, + }, + }, + }, + output: []sdk.Msg{ + &banktypes.MsgSend{ + FromAddress: addr1.String(), + ToAddress: addr2.String(), + Amount: sdk.Coins{ + sdk.NewInt64Coin("uatom", 12345), + sdk.NewInt64Coin("usdt", 54321), + }, + }, + }, + }, + "invalid send amount": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Bank: &wasmvmtypes.BankMsg{ + Send: &wasmvmtypes.SendMsg{ + ToAddress: addr2.String(), + Amount: []wasmvmtypes.Coin{ + { + Denom: "uatom", + Amount: "123.456", + }, + }, + }, + }, + }, + isError: true, + }, + "invalid address": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Bank: &wasmvmtypes.BankMsg{ + Send: &wasmvmtypes.SendMsg{ + ToAddress: invalidAddr, + Amount: []wasmvmtypes.Coin{ + { + Denom: "uatom", + Amount: "7890", + }, + }, + }, + }, + }, + isError: false, // addresses are checked in the handler + output: []sdk.Msg{ + &banktypes.MsgSend{ + FromAddress: addr1.String(), + ToAddress: invalidAddr, + Amount: sdk.Coins{ + sdk.NewInt64Coin("uatom", 7890), + }, + }, + }, + }, + "wasm execute": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Wasm: &wasmvmtypes.WasmMsg{ + Execute: &wasmvmtypes.ExecuteMsg{ + ContractAddr: addr2.String(), + Msg: jsonMsg, + Funds: []wasmvmtypes.Coin{ + wasmvmtypes.NewCoin(12, "eth"), + }, + }, + }, + }, + output: []sdk.Msg{ + &wasmtypes.MsgExecuteContract{ + Sender: addr1.String(), + Contract: addr2.String(), + Msg: jsonMsg, + Funds: sdk.NewCoins(sdk.NewInt64Coin("eth", 12)), + }, + }, + }, + "wasm instantiate": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Wasm: &wasmvmtypes.WasmMsg{ + Instantiate: &wasmvmtypes.InstantiateMsg{ + CodeID: 7, + Msg: jsonMsg, + Funds: []wasmvmtypes.Coin{ + wasmvmtypes.NewCoin(123, "eth"), + }, + Label: "myLabel", + Admin: addr2.String(), + }, + }, + }, + output: []sdk.Msg{ + &wasmtypes.MsgInstantiateContract{ + Sender: addr1.String(), + CodeID: 7, + Label: "myLabel", + Msg: jsonMsg, + Funds: sdk.NewCoins(sdk.NewInt64Coin("eth", 123)), + Admin: addr2.String(), + }, + }, + }, + "wasm migrate": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Wasm: &wasmvmtypes.WasmMsg{ + Migrate: &wasmvmtypes.MigrateMsg{ + ContractAddr: addr1.String(), + NewCodeID: 12, + Msg: jsonMsg, + }, + }, + }, + output: []sdk.Msg{ + &wasmtypes.MsgMigrateContract{ + Sender: addr2.String(), + Contract: addr1.String(), + CodeID: 12, + Msg: jsonMsg, + }, + }, + }, + "wasm update admin": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Wasm: &wasmvmtypes.WasmMsg{ + UpdateAdmin: &wasmvmtypes.UpdateAdminMsg{ + ContractAddr: addr1.String(), + Admin: addr3.String(), + }, + }, + }, + output: []sdk.Msg{ + &wasmtypes.MsgUpdateAdmin{ + Sender: addr2.String(), + Contract: addr1.String(), + NewAdmin: addr3.String(), + }, + }, + }, + "wasm clear admin": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Wasm: &wasmvmtypes.WasmMsg{ + ClearAdmin: &wasmvmtypes.ClearAdminMsg{ + ContractAddr: addr1.String(), + }, + }, + }, + output: []sdk.Msg{ + &wasmtypes.MsgClearAdmin{ + Sender: addr2.String(), + Contract: addr1.String(), + }, + }, + }, + "staking delegate": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Staking: &wasmvmtypes.StakingMsg{ + Delegate: &wasmvmtypes.DelegateMsg{ + Validator: valAddr.String(), + Amount: wasmvmtypes.NewCoin(777, "stake"), + }, + }, + }, + output: []sdk.Msg{ + &stakingtypes.MsgDelegate{ + DelegatorAddress: addr1.String(), + ValidatorAddress: valAddr.String(), + Amount: sdk.NewInt64Coin("stake", 777), + }, + }, + }, + "staking delegate to non-validator": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Staking: &wasmvmtypes.StakingMsg{ + Delegate: &wasmvmtypes.DelegateMsg{ + Validator: addr2.String(), + Amount: wasmvmtypes.NewCoin(777, "stake"), + }, + }, + }, + isError: false, // fails in the handler + output: []sdk.Msg{ + &stakingtypes.MsgDelegate{ + DelegatorAddress: addr1.String(), + ValidatorAddress: addr2.String(), + Amount: sdk.NewInt64Coin("stake", 777), + }, + }, + }, + "staking undelegate": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Staking: &wasmvmtypes.StakingMsg{ + Undelegate: &wasmvmtypes.UndelegateMsg{ + Validator: valAddr.String(), + Amount: wasmvmtypes.NewCoin(555, "stake"), + }, + }, + }, + output: []sdk.Msg{ + &stakingtypes.MsgUndelegate{ + DelegatorAddress: addr1.String(), + ValidatorAddress: valAddr.String(), + Amount: sdk.NewInt64Coin("stake", 555), + }, + }, + }, + "staking redelegate": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Staking: &wasmvmtypes.StakingMsg{ + Redelegate: &wasmvmtypes.RedelegateMsg{ + SrcValidator: valAddr.String(), + DstValidator: valAddr2.String(), + Amount: wasmvmtypes.NewCoin(222, "stake"), + }, + }, + }, + output: []sdk.Msg{ + &stakingtypes.MsgBeginRedelegate{ + DelegatorAddress: addr1.String(), + ValidatorSrcAddress: valAddr.String(), + ValidatorDstAddress: valAddr2.String(), + Amount: sdk.NewInt64Coin("stake", 222), + }, + }, + }, + "staking withdraw (explicit recipient)": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Distribution: &wasmvmtypes.DistributionMsg{ + WithdrawDelegatorReward: &wasmvmtypes.WithdrawDelegatorRewardMsg{ + Validator: valAddr2.String(), + }, + }, + }, + output: []sdk.Msg{ + &distributiontypes.MsgWithdrawDelegatorReward{ + DelegatorAddress: addr1.String(), + ValidatorAddress: valAddr2.String(), + }, + }, + }, + "staking set withdraw address": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Distribution: &wasmvmtypes.DistributionMsg{ + SetWithdrawAddress: &wasmvmtypes.SetWithdrawAddressMsg{ + Address: addr2.String(), + }, + }, + }, + output: []sdk.Msg{ + &distributiontypes.MsgSetWithdrawAddress{ + DelegatorAddress: addr1.String(), + WithdrawAddress: addr2.String(), + }, + }, + }, + "stargate encoded bank msg": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Stargate: &wasmvmtypes.StargateMsg{ + TypeURL: "/cosmos.bank.v1beta1.MsgSend", + Value: bankMsgBin, + }, + }, + output: []sdk.Msg{bankMsg}, + }, + "stargate encoded msg with any type": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Stargate: &wasmvmtypes.StargateMsg{ + TypeURL: "/cosmos.gov.v1beta1.MsgSubmitProposal", + Value: proposalMsgBin, + }, + }, + output: []sdk.Msg{proposalMsg}, + }, + "stargate encoded invalid typeUrl": { + sender: addr2, + srcMsg: wasmvmtypes.CosmosMsg{ + Stargate: &wasmvmtypes.StargateMsg{ + TypeURL: "/cosmos.bank.v2.MsgSend", + Value: bankMsgBin, + }, + }, + isError: true, + }, + "IBC transfer with block timeout": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + IBC: &wasmvmtypes.IBCMsg{ + Transfer: &wasmvmtypes.TransferMsg{ + ChannelID: "myChanID", + ToAddress: addr2.String(), + Amount: wasmvmtypes.Coin{ + Denom: "ALX", + Amount: "1", + }, + Timeout: wasmvmtypes.IBCTimeout{ + Block: &wasmvmtypes.IBCTimeoutBlock{Revision: 1, Height: 2}, + }, + }, + }, + }, + transferPortSource: wasmtesting.MockIBCTransferKeeper{GetPortFn: func(ctx sdk.Context) string { + return "myTransferPort" + }}, + output: []sdk.Msg{ + &ibctransfertypes.MsgTransfer{ + SourcePort: "myTransferPort", + SourceChannel: "myChanID", + Token: sdk.Coin{ + Denom: "ALX", + Amount: sdk.NewInt(1), + }, + Sender: addr1.String(), + Receiver: addr2.String(), + TimeoutHeight: clienttypes.Height{RevisionNumber: 1, RevisionHeight: 2}, + }, + }, + }, + "IBC transfer with time timeout": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + IBC: &wasmvmtypes.IBCMsg{ + Transfer: &wasmvmtypes.TransferMsg{ + ChannelID: "myChanID", + ToAddress: addr2.String(), + Amount: wasmvmtypes.Coin{ + Denom: "ALX", + Amount: "1", + }, + Timeout: wasmvmtypes.IBCTimeout{Timestamp: 100}, + }, + }, + }, + transferPortSource: wasmtesting.MockIBCTransferKeeper{GetPortFn: func(ctx sdk.Context) string { + return "transfer" + }}, + output: []sdk.Msg{ + &ibctransfertypes.MsgTransfer{ + SourcePort: "transfer", + SourceChannel: "myChanID", + Token: sdk.Coin{ + Denom: "ALX", + Amount: sdk.NewInt(1), + }, + Sender: addr1.String(), + Receiver: addr2.String(), + TimeoutTimestamp: 100, + }, + }, + }, + "IBC transfer with time and height timeout": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + IBC: &wasmvmtypes.IBCMsg{ + Transfer: &wasmvmtypes.TransferMsg{ + ChannelID: "myChanID", + ToAddress: addr2.String(), + Amount: wasmvmtypes.Coin{ + Denom: "ALX", + Amount: "1", + }, + Timeout: wasmvmtypes.IBCTimeout{Timestamp: 100, Block: &wasmvmtypes.IBCTimeoutBlock{Height: 1, Revision: 2}}, + }, + }, + }, + transferPortSource: wasmtesting.MockIBCTransferKeeper{GetPortFn: func(ctx sdk.Context) string { + return "transfer" + }}, + output: []sdk.Msg{ + &ibctransfertypes.MsgTransfer{ + SourcePort: "transfer", + SourceChannel: "myChanID", + Token: sdk.Coin{ + Denom: "ALX", + Amount: sdk.NewInt(1), + }, + Sender: addr1.String(), + Receiver: addr2.String(), + TimeoutTimestamp: 100, + TimeoutHeight: clienttypes.NewHeight(2, 1), + }, + }, + }, + "IBC close channel": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + IBC: &wasmvmtypes.IBCMsg{ + CloseChannel: &wasmvmtypes.CloseChannelMsg{ + ChannelID: "channel-1", + }, + }, + }, + output: []sdk.Msg{ + &channeltypes.MsgChannelCloseInit{ + PortId: "wasm." + addr1.String(), + ChannelId: "channel-1", + Signer: addr1.String(), + }, + }, + }, + "Gov vote: yes": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + Gov: &wasmvmtypes.GovMsg{ + Vote: &wasmvmtypes.VoteMsg{ProposalId: 1, Vote: wasmvmtypes.Yes}, + }, + }, + output: []sdk.Msg{ + &govtypes.MsgVote{ + ProposalId: 1, + Voter: addr1.String(), + Option: govtypes.OptionYes, + }, + }, + }, + "Gov vote: No": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + Gov: &wasmvmtypes.GovMsg{ + Vote: &wasmvmtypes.VoteMsg{ProposalId: 1, Vote: wasmvmtypes.No}, + }, + }, + output: []sdk.Msg{ + &govtypes.MsgVote{ + ProposalId: 1, + Voter: addr1.String(), + Option: govtypes.OptionNo, + }, + }, + }, + "Gov vote: Abstain": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + Gov: &wasmvmtypes.GovMsg{ + Vote: &wasmvmtypes.VoteMsg{ProposalId: 10, Vote: wasmvmtypes.Abstain}, + }, + }, + output: []sdk.Msg{ + &govtypes.MsgVote{ + ProposalId: 10, + Voter: addr1.String(), + Option: govtypes.OptionAbstain, + }, + }, + }, + "Gov vote: No with veto": { + sender: addr1, + srcContractIBCPort: "myIBCPort", + srcMsg: wasmvmtypes.CosmosMsg{ + Gov: &wasmvmtypes.GovMsg{ + Vote: &wasmvmtypes.VoteMsg{ProposalId: 1, Vote: wasmvmtypes.NoWithVeto}, + }, + }, + output: []sdk.Msg{ + &govtypes.MsgVote{ + ProposalId: 1, + Voter: addr1.String(), + Option: govtypes.OptionNoWithVeto, + }, + }, + }, + "stargate encoded filtered (fswap)": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Stargate: &wasmvmtypes.StargateMsg{ + TypeURL: "/lbm.fswap.v1.MsgSwap", + Value: nil, + }, + }, + isError: true, + }, + "stargate encoded filtered (fbridge)": { + sender: addr1, + srcMsg: wasmvmtypes.CosmosMsg{ + Stargate: &wasmvmtypes.StargateMsg{ + TypeURL: "/lbm.fbridge.v1.MsgTransfer", + Value: nil, + }, + }, + isError: true, + }, + } + encodingConfig := MakeEncodingConfig() + for name, tc := range cases { + t.Run(name, func(t *testing.T) { + var ctx sdk.Context + encoder := wasmkeeper.DefaultEncoders(encodingConfig.Marshaler, tc.transferPortSource) + encoder.Merge(filteredStargateMsgEncoders(encodingConfig.Marshaler)) + res, err := encoder.Encode(ctx, tc.sender, tc.srcContractIBCPort, tc.srcMsg) + if tc.isError { + require.Error(t, err) + } else { + require.NoError(t, err) + assert.Equal(t, tc.output, res) + } + }) + } +}