IRIS Network security record

Files: - `nft-transfer/keeper/relay.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) The function `Transfer()` is used to transfer the NFT, which it accepts the classID and tokenID to uniquely identify the NFT. Additionally, it specifies the `tokenData` that is an app specific data of the NFT if it is available. ```go Transfer(ctx sdk.Context, classID string, tokenID string, tokenData string, receiver sdk.AccAddress) error ``` However, when invoking the `Transfer()`, the functions, `createOutgoingPacket()` and `refundPacketToken()` provide empty `tokenData` instead of the `tokenData` associated with the NFT.

Files: - `ibc_module.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) When handling acknowledgement packet in function `OnAcknowledgementPacket()`, event is triggered with type of `EventTypePacket`. An attribute with key of `AttributeKeyAckSuccess` is emitted first along with other attributes in the new event. After that, a new event is emitted that depends on the acknowledgement response type: ```go=243 switch resp := ack.Response.(type) { case *channeltypes.Acknowledgement_Result: ctx.EventManager().EmitEvent( sdk.NewEvent( types.EventTypePacket, sdk.NewAttribute(types.AttributeKeyAckSuccess, string(resp.Result)), ), ) ``` The same `AttributeKeyAckSuccess` is set but with different values. Hence, there will cause confusion in the following event tracking.

Files: - `nft-transfer/types/trace.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) The function `ParseHexHash()` is used to parse the hex hash in string format to bytes and validates its correctness. ```go=18 func ParseHexHash(hexHash string) (tmbytes.HexBytes, error) { hash, err := hex.DecodeString(hexHash) if err != nil { return nil, err } if err := tmtypes.ValidateHash(hash); err != nil { return nil, err } return hash, nil } ``` However, an empty string could by converted to empty bytes, which may result in errors or unexpected behavior.

Files: - `go.mod` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) The callback of `OnRecvPacket` is implemented in the upper module for the `RecvPacket` message, which is in the ibc core modules. This is imported by the go module file as a dependency, i.e. > github.com/cosmos/ibc-go/v6 v6.1.0 > github.com/cosmos/ibc-go/v5 v5.0.1 However, as published in the security advisory, the ibc-go with version `v6.1.0` and `v5.0.1` contain thee huckleberry vulnerability and the fix was reflected in the commit [`4973957900d70969d99371e6ed24c47400f5abe6`](https://github.com/cosmos/ibc-go/commit/4973957900d70969d99371e6ed24c47400f5abe6?ref=jumpcrypto.com) and patch was released in the following versions: - v7.0.1 - v6.1.1 - v5.3.1 - v5.2.1 It breaks the core assumptions of off-chain components that rely on the events listening, and can lead to a wide range of unexpected security vulnerabilities in various products. Moreover, the cosmos-sdk versions used in the following commits should be updated according to the barberry security advisory: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) **Reference** - https://forum.cosmos.network/t/ibc-security-advisory-huckleberry/10731 - https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825

Files: - `keeper/grpc_query.go` - `types/trace.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) The function `ParseHexHash()` is intended to parse a hex hash in string format to bytes and validate its correctness. **types/trace.go** ```go=18 func ParseHexHash(hexHash string) (tmbytes.HexBytes, error) { hash, err := hex.DecodeString(hexHash) if err != nil { return nil, err } if err := tmtypes.ValidateHash(hash); err != nil { return nil, err } return hash, nil } ``` If any error occurs, the returned variable `hash` is nil, which will be used in the error message of function `ClassTrace()`. **keeper/grpc_query.go** ```go=28 hash, err := types.ParseHexHash(strings.TrimPrefix(req.Hash, "ibc/")) if err != nil { return nil, status.Error(codes.InvalidArgument, fmt.Sprintf("invalid denom trace hash: %s, error: %s", hash.String(), err)) } ``` As a result, an empty string will be passed in the error message.

Files: - `nft-transfer/types/codec.go` Commits: - [`cfc058309adcf73478d3828a524ecf8e546420ed`](https://github.com/bianjieai/nft-transfer/tree/cfc058309adcf73478d3828a524ecf8e546420ed) - [`87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba`](https://github.com/bianjieai/nft-transfer/tree/87cdf3b7dd969237c9ffc8e056bfc24cab5e2bba) - [`fa7bd3f3cb1ebe24f781953a781add96509b4c2a`](https://github.com/bianjieai/nft-transfer/tree/fa7bd3f3cb1ebe24f781953a781add96509b4c2a) In file `codec.go`, the `MsgUpdateParams` has not been registered as a concrete implementation of the interface `sdk.Msg`, which could lead to an error when being marshalled or unmarshalled.