Skip to content

Forgot to Check Wether if the IBC Packet Comes From axelar chain when send is DefaultGMPAddress #2745

@Hellobloc

Description

@Hellobloc

In the following code, when the sender of the IBC package is DefaultGMPAddress, and a special memoPayload will be added and a special event will append. But it is not checked whether the peer chain is axelar. Considering that anyone can establish an IBC connection with their own chain, it means that the sender here is not trustworthy, and the safest way is to add an additional ChannelID check in addition to the DefaultGMPAddress check.

if strings.EqualFold(ftData.Sender, gmp.DefaultGMPAddress) {
		events = append(events, "Axelar GMP")
		mh.isGMP = true
		gmpMessage, err := gmp.ParseMemo(*ctx, mh.received, mh.memo, mh.receiver)
		if err != nil {
			logger.Debug("Can't parse the gmp memo", "err", err)
			return events, errMemoValidation{err}
		}
		memoPayload = gmpMessage.Payload
	} 

if strings.EqualFold(ftData.Sender, gmp.DefaultGMPAddress) {
events = append(events, "Axelar GMP")
mh.isGMP = true
gmpMessage, err := gmp.ParseMemo(*ctx, mh.received, mh.memo, mh.receiver)
if err != nil {
logger.Debug("Can't parse the gmp memo", "err", err)
return events, errMemoValidation{err}
}
memoPayload = gmpMessage.Payload
} else {

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions