Implement cap on uncompleted corks per validator to prevent storage D…

…oS (#218)

* Implement cap on uncompleted corks per validator to prevent storage DoS

* Fix proto binding merge error

* Run gofmt

* manually call Validate on the genesis states

* point to gravity v4.0.0 release

* fix casing for some cellars, add Turbo EETH

* update slices sizes with new cellar added

* log the ICA host param update

* actually validate the minimum USD value parameter

* normalize cellars with eth mainnet chain ID prefix

* add arbitrum test cellar to pubsub

* Add test arbitrum cellar to axelarcork

* some comments

* loosen ProofURL validation

* fix auction params test

* set LastUpdatedBlock for token prices in v7 upgrade

* ledger support for cork

* GetSignBytes for cork

* appease linter

---------

Co-authored-by: Eric Bolten <[email protected]>

integration_tests/setup_test.go

@@ -456,6 +456,7 @@ func (s *IntegrationTestSuite) initGenesis() {
 	// we add the first validator address as a cellar so that it will trigger the cellarfees hook
 	// when we send test fees
 	corkGenState.CellarIds = corktypes.CellarIDSet{Ids: []string{unusedGenesisContract.String(), s.chain.validators[0].ethereumKey.address}}
+	corkGenState.Params = corktypes.DefaultParams()
 	corkGenState.Params.VoteThreshold = corkVoteThreshold
 	bz, err = cdc.MarshalJSON(&corkGenState)
 	s.Require().NoError(err)

proto/cork/v2/genesis.proto

@@ -29,4 +29,5 @@ message Params {
         (gogoproto.customtype) = "github.com/cosmos/cosmos-sdk/types.Dec",
         (gogoproto.nullable)   = false
     ];
+    uint64 max_corks_per_validator = 2;
 }

x/auction/keeper/sdk_module_mocks_test.go

@@ -25,4 +25,4 @@ func (suite *KeeperTestSuite) mockSendCoinsFromAccountToModule(ctx sdk.Context,
 
 func (suite *KeeperTestSuite) mockSendCoinsFromModuleToAccount(ctx sdk.Context, senderModule string, receiverAcct sdk.AccAddress, amt sdk.Coins) {
 	suite.bankKeeper.EXPECT().SendCoinsFromModuleToAccount(ctx, senderModule, receiverAcct, amt).Return(nil)
-}
+}

x/cork/keeper/keeper.go

@@ -2,6 +2,7 @@ package keeper
 
 import (
 	"bytes"
+	"encoding/binary"
 
 	"github.com/cosmos/cosmos-sdk/codec"
 	storetypes "github.com/cosmos/cosmos-sdk/store/types"
@@ -297,6 +298,7 @@ func (k Keeper) GetApprovedScheduledCorks(ctx sdk.Context) (approvedCorks []type
 		}
 
 		k.DeleteScheduledCork(ctx, currentBlockHeight, id, val, addr)
+		k.DecrementValidatorCorkCount(ctx, val)
 
 		return false
 	})
@@ -358,3 +360,35 @@ func (k Keeper) HasCellarID(ctx sdk.Context, address common.Address) (found bool
 
 	return found
 }
+
+///////////////////////////
+// Validator Cork counts //
+///////////////////////////
+
+func (k Keeper) GetValidatorCorkCount(ctx sdk.Context, val sdk.ValAddress) (count uint64) {
+	store := ctx.KVStore(k.storeKey)
+	bz := store.Get(types.GetValidatorCorkCountKey(val))
+	if len(bz) == 0 {
+		return 0
+	}
+
+	return binary.BigEndian.Uint64(bz)
+}
+
+func (k Keeper) SetValidatorCorkCount(ctx sdk.Context, val sdk.ValAddress, count uint64) {
+	bz := make([]byte, 8)
+	binary.BigEndian.PutUint64(bz, count)
+	ctx.KVStore(k.storeKey).Set(types.GetValidatorCorkCountKey(val), bz)
+}
+
+func (k Keeper) IncrementValidatorCorkCount(ctx sdk.Context, val sdk.ValAddress) {
+	count := k.GetValidatorCorkCount(ctx, val)
+	k.SetValidatorCorkCount(ctx, val, count+1)
+}
+
+func (k Keeper) DecrementValidatorCorkCount(ctx sdk.Context, val sdk.ValAddress) {
+	count := k.GetValidatorCorkCount(ctx, val)
+	if count > 0 {
+		k.SetValidatorCorkCount(ctx, val, count-1)
+	}
+}

x/cork/keeper/msg_server.go

@@ -34,6 +34,7 @@ func (k Keeper) ScheduleCork(c context.Context, msg *types.MsgScheduleCorkReques
 	}
 
 	corkID := k.SetScheduledCork(ctx, msg.BlockHeight, validatorAddr, *msg.Cork)
+	k.IncrementValidatorCorkCount(ctx, validatorAddr)
 
 	ctx.EventManager().EmitEvents(
 		sdk.Events{

x/cork/types/errors.go

@@ -6,9 +6,10 @@ import (
 
 // x/cork module sentinel errors
 var (
-	ErrInvalidEthereumAddress = errorsmod.Register(ModuleName, 2, "invalid ethereum address")
-	ErrUnmanagedCellarAddress = errorsmod.Register(ModuleName, 3, "cork sent to address that has not passed governance")
-	ErrEmptyContractCall      = errorsmod.Register(ModuleName, 4, "cork has an empty contract call body")
-	ErrSchedulingInThePast    = errorsmod.Register(ModuleName, 5, "cork is trying to be scheduled for a block that has already passed")
-	ErrInvalidJSON            = errorsmod.Register(ModuleName, 6, "invalid json")
+	ErrInvalidEthereumAddress       = errorsmod.Register(ModuleName, 2, "invalid ethereum address")
+	ErrUnmanagedCellarAddress       = errorsmod.Register(ModuleName, 3, "cork sent to address that has not passed governance")
+	ErrEmptyContractCall            = errorsmod.Register(ModuleName, 4, "cork has an empty contract call body")
+	ErrSchedulingInThePast          = errorsmod.Register(ModuleName, 5, "cork is trying to be scheduled for a block that has already passed")
+	ErrInvalidJSON                  = errorsmod.Register(ModuleName, 6, "invalid json")
+	ErrValidatorCorkCapacityReached = errorsmod.Register(ModuleName, 7, "validator cork capacity reached")
 )

x/cork/types/keys.go

@@ -45,6 +45,9 @@ const (
 
 	// CorkResultPrefix - <prefix><id> -> CorkResult
 	CorkResultPrefix
+
+	// ValidatorCorkCountKey - <prefix><val_address> -> uint64(count)
+	ValidatorCorkCountKey
 )
 
 // GetCorkForValidatorAddressKey returns the key for a validators vote for a given address
@@ -81,3 +84,7 @@ func GetCorkResultPrefix() []byte {
 func GetCorkResultKey(id []byte) []byte {
 	return append(GetCorkResultPrefix(), id...)
 }
+
+func GetValidatorCorkCountKey(val sdk.ValAddress) []byte {
+	return append([]byte{ValidatorCorkCountKey}, val.Bytes()...)
+}

x/cork/types/params.go

@@ -10,8 +10,9 @@ import (
 
 // Parameter keys
 var (
-	KeyVotePeriod    = []byte("voteperiod")
-	KeyVoteThreshold = []byte("votethreshold")
+	KeyVotePeriod           = []byte("voteperiod")
+	KeyVoteThreshold        = []byte("votethreshold")
+	KeyMaxCorksPerValidator = []byte("maxcorkspervalidator")
 )
 
 var _ paramtypes.ParamSet = &Params{}
@@ -25,14 +26,16 @@ func ParamKeyTable() paramtypes.KeyTable {
 func DefaultParams() Params {
 	return Params{
 		// Deprecated
-		VoteThreshold: sdk.NewDecWithPrec(67, 2), // 67%
+		VoteThreshold:        sdk.NewDecWithPrec(67, 2), // 67%
+		MaxCorksPerValidator: 1000,
 	}
 }
 
 // ParamSetPairs returns the parameter set pairs.
 func (p *Params) ParamSetPairs() paramtypes.ParamSetPairs {
 	return paramtypes.ParamSetPairs{
 		paramtypes.NewParamSetPair(KeyVoteThreshold, &p.VoteThreshold, validateVoteThreshold),
+		paramtypes.NewParamSetPair(KeyMaxCorksPerValidator, &p.MaxCorksPerValidator, validateMaxCorksPerValidator),
 	}
 }
 
@@ -41,6 +44,9 @@ func (p *Params) ValidateBasic() error {
 	if err := validateVoteThreshold(p.VoteThreshold); err != nil {
 		return err
 	}
+	if err := validateMaxCorksPerValidator(p.MaxCorksPerValidator); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -60,3 +66,16 @@ func validateVoteThreshold(i interface{}) error {
 
 	return nil
 }
+
+func validateMaxCorksPerValidator(i interface{}) error {
+	maxCorksPerValidator, ok := i.(uint64)
+	if !ok {
+		return fmt.Errorf("invalid parameter type: %T", i)
+	}
+
+	if maxCorksPerValidator == 0 {
+		return errors.New("max corks per validator cannot be 0")
+	}
+
+	return nil
+}