Repository navigation
chore: merge audit-fixes into develop - #55
Merged
Merged
Conversation
…erflow StateDB Balance Enabling Native Mint and Drain (#40) * fix: guard StateDB SubBalance against underflow (F-2026-18201) Cherry-picks the security-relevant part of upstream cosmos/evm 264aa70 (cosmos#1176). * test: cover the precompile balance-handler underflow path (F-2026-18201)
…VM Ante for MsgEthereumTx (#41) * fix: verify the eth sender in Keeper.EthereumTx before applying the tx The EVM ante only runs over a tx's top-level messages, so an MsgEthereumTx nested inside a dispatching module reaches the executor with its signature unchecked (F-2026-18197). Require VerifySender in the msg server so From is always the recovered signer, whatever route the message took. * docs: changelog entry for the EthereumTx sender verification fix * fix: reject an MsgEthereumTx whose raw transaction is empty ValidateBasic lives in the same ante path a nested message skips, so the msg server must not dereference a nil transaction.
…ists SDK Tally Vote Deletions (#42) * fix(gov): discard the store writes of the getTallyResult query The SDK tally deletes the votes it counts; precompiles commit unconditionally. * test(gov): getTallyResult must not delete votes via CALL or STATICCALL * docs: changelog entry for the getTallyResult vote deletion fix
CallEVMWithData and DerivedEVMCallWithData returned on res.Failed() before reaching ctx.GasMeter().ConsumeGas(res.GasUsed), so a reverting or deliberately out-of-gas internal call was free at the Cosmos meter. DerivedEVMCallWithData also clamps a caller-supplied gasLimit to config.DefaultGasCap: on an out-of-gas halt res.GasUsed equals the cap, so without the clamp the caller would choose how much gas the enclosing Cosmos tx is forced to consume and could panic it with OutOfGas.
… fails (#45) The escrow was applied to the parent context before CallEVM, so a VM failure left the sender's coins stranded on the erc20 module account - permanently on the IBC refund path, which swallows the error.
#48) Stateful precompiles ran the full native-action preamble - including a state DB commit that replays the caller's dirty set - before SetupABI resolved the selector, and RequiredGas returns 0 for an unresolvable one so none of it was charged.
The parameter was accepted and ignored, so callers sandboxing EVM work got a 25M gas message regardless. Also runs the timeout callback on cachedCtx, as the ack path already does.
…ted Approval event (#44) Wire the orphaned validateApprovalEventDoesNotExist guard into both native-ERC20 convert directions.
…l Synchronous EVM Execution (#49) * fix: charge parent gas meter for failed EVM calls (F-2026-18824) CallEVMWithData and DerivedEVMCallWithData returned on res.Failed() before reaching ctx.GasMeter().ConsumeGas(res.GasUsed), so a reverting or deliberately out-of-gas internal call was free at the Cosmos meter. DerivedEVMCallWithData also clamps a caller-supplied gasLimit to config.DefaultGasCap: on an out-of-gas halt res.GasUsed equals the cap, so without the clamp the caller would choose how much gas the enclosing Cosmos tx is forced to consume and could panic it with OutOfGas. * fix: reject a non-uint64 payload gas limit instead of truncating it (F-2026-18182)
…47) * v0.6.0 * chore: changelog (cosmos#1025) * Changelog * fix line length * fix: solhint line length and build-v05 legacy binary ref * test: raise TestChainUpgrade block-height wait for 5s block time * ci: move jobs off dead Depot runners to GitHub-hosted Seven jobs never run — they queue until GitHub cancels them at 24h. Bumps test/lint timeouts 15m->30m for the smaller GitHub runners. * fix(rpc): report base fee as the gas price of derived txs * refactor(statedb): use OverrideEvents instead of the reflect/unsafe shim The shim existed because cosmos-sdk v0.50.x had no in-place events setter; the fork now pins v0.53.6, where OverrideEvents is exactly em.events = events. * style(statedb): let prevEvents infer its type (staticcheck ST1023) --------- Co-authored-by: Vlad <vlad@cosmoslabs.io> Co-authored-by: Vlad J <vladjdk@gmail.com> Co-authored-by: Arya Lanjewar <102943033+AryaLanjewar3005@users.noreply.github.com>
…the block (F-2026-18144) (#50) EndBlock returned an error when the block's cumulative gasWanted (or gasUsed) did not fit in an int64. gasWanted is an unchecked uint64 sum of per-tx declarations, so under max_gas: -1 two txs declaring MaxInt64 land it in (MaxInt64, MaxUint64] with neither individually rejectable, and the error surfaces through FinalizeBlock after the block is decided. Clamp both to MaxInt64 and log instead. AddTransientGasWanted now saturates rather than wrapping.
… v0.50.x v0.6.0 calls EventManager.OverrideEvents directly, which exists only on cosmos-sdk v0.53. push-chain-node pins cosmos-sdk to v0.50.10 via replace, so the direct call compiles in this repo but breaks the node build with 'OverrideEvents undefined'. Restores the reflect-based in-place setter and documents why it must stay until the node moves off v0.50.x.
Callers bill GasUsed from the receipt; returning nil made that a no-op.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.