Skip to content

Nil wasmStack IBCModule registered in IBC router enables chain halt #1980

@RafilxTenfen

Description

@RafilxTenfen

Description

In app/keepers/keepers.go, the variable wasmStack is declared as var wasmStack porttypes.IBCModule (nil) on line 651. A proper IBC handler (wasmStackIBCHandler) is created on line 652 via wasm.NewIBCHandler(...), but it is never assigned to wasmStack. Instead, wasmStackIBCHandler is only used as a callback handler for the transfer and ICA stacks. The nil wasmStack is then registered in the IBC router on line 714: AddRoute(wasmtypes.ModuleName, wasmStack). Any IBC channel handshake targeting the wasm module port (e.g., a relayer submitting MsgChannelOpenTry for port wasm.*) will cause the IBC core to dispatch to the nil module handler, triggering a nil pointer dereference panic.

It doesn't halt the validator, as the base app recovery middleware catches the panic. It just fails the transaction

Metadata

Metadata

Assignees

Labels

consensus breakingchange modifies `appHash` of the application

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions