-
Notifications
You must be signed in to change notification settings - Fork 173
Open
Description
In the following code, when the sender of the IBC package is DefaultGMPAddress, and a special memoPayload will be added and a special event will append. But it is not checked whether the peer chain is axelar. Considering that anyone can establish an IBC connection with their own chain, it means that the sender here is not trustworthy, and the safest way is to add an additional ChannelID check in addition to the DefaultGMPAddress check.
if strings.EqualFold(ftData.Sender, gmp.DefaultGMPAddress) {
events = append(events, "Axelar GMP")
mh.isGMP = true
gmpMessage, err := gmp.ParseMemo(*ctx, mh.received, mh.memo, mh.receiver)
if err != nil {
logger.Debug("Can't parse the gmp memo", "err", err)
return events, errMemoValidation{err}
}
memoPayload = gmpMessage.Payload
}
umee/x/uibc/uics20/memo_handler.go
Lines 63 to 72 in 94e1b7d
| if strings.EqualFold(ftData.Sender, gmp.DefaultGMPAddress) { | |
| events = append(events, "Axelar GMP") | |
| mh.isGMP = true | |
| gmpMessage, err := gmp.ParseMemo(*ctx, mh.received, mh.memo, mh.receiver) | |
| if err != nil { | |
| logger.Debug("Can't parse the gmp memo", "err", err) | |
| return events, errMemoValidation{err} | |
| } | |
| memoPayload = gmpMessage.Payload | |
| } else { |
Metadata
Metadata
Assignees
Labels
No labels