feat: allow banker originSend in ephemerals

gno.land/pkg/integration/testdata/maketx_call_send.txtar

@@ -0,0 +1,36 @@
+# load the package
+loadpkg gno.land/r/foo/call_realm $WORK/realm
+
+# start a new node
+gnoland start
+
+## user balance before realm send
+gnokey query auth/accounts/$test1_user_addr
+stdout '"coins": "9999998810000ugnot"'
+
+## realm balance before realm send
+gnokey query auth/accounts/g1x4ykzcqksj2hc5qpvr8kd9zaffkd82rvmzqup7
+stdout '"coins": ""'
+
+# call to realm with -send
+gnokey maketx call -send 42ugnot -pkgpath gno.land/r/foo/call_realm -func GimmeMoney -gas-fee 1000000ugnot -gas-wanted 3000000 -broadcast -chainid=tendermint_test test1
+stdout '("send: 42ugnot")'
+
+## user balance after realm send
+# reduced by -gas-fee AND -send
+gnokey query auth/accounts/$test1_user_addr
+stdout '"coins": "9999997809958ugnot"'
+
+## realm balance after realm send
+gnokey query auth/accounts/g1x4ykzcqksj2hc5qpvr8kd9zaffkd82rvmzqup7
+stdout '"coins": "42ugnot"'
+
+
+-- realm/realm.gno --
+package call_realm
+
+import "chain/banker"
+
+func GimmeMoney(cur realm) string {
+	return "send: " + banker.OriginSend().String()
+}

gno.land/pkg/integration/testdata/maketx_run_send.txtar

@@ -0,0 +1,76 @@
+## start a new node
+gnoland start
+
+## user balance before realm send
+gnokey query auth/accounts/$test1_user_addr
+stdout '"coins": "10000000000000ugnot"'
+
+## run script/print_originsend.gno with send flag
+gnokey maketx run -send 42ugnot -gas-fee 1000000ugnot -gas-wanted 20000000 -broadcast -chainid=tendermint_test test1 $WORK/script/print_originsend.gno
+stdout 'send: 42ugnot'
+
+## user balance after realm send
+# only reduced by -gas-fee, -send does not affect balance since no transfer
+# occurred and the run script shares the same address as the user.
+gnokey query auth/accounts/$test1_user_addr
+stdout '"coins": "9999999000000ugnot"'
+
+## run script/newbanker_realmissue.gno with send flag
+# must fail because this banker type is not allowed in ephemerals.
+! gnokey maketx run -send 42ugnot -gas-fee 1000000ugnot -gas-wanted 20000000 -broadcast -chainid=tendermint_test test1 $WORK/script/newbanker_realmissue.gno
+stderr 'invalid banker type 3 for ephemeral'
+
+## run script/newbanker_realmsend.gno with send flag
+# must fail because this banker type is not allowed in ephemerals.
+! gnokey maketx run -send 42ugnot -gas-fee 1000000ugnot -gas-wanted 20000000 -broadcast -chainid=tendermint_test test1 $WORK/script/newbanker_realmsend.gno
+stderr 'invalid banker type 2 for ephemeral'
+
+## run script/newbanker_originsend.gno with send flag
+gnokey maketx run -send 42ugnot -gas-fee 1000000ugnot -gas-wanted 20000000 -broadcast -chainid=tendermint_test test1 $WORK/script/newbanker_originsend.gno
+stdout 'OK!'
+
+## user balance after coin transfer in newbanker_originsend
+# reduced by -gas-fee and -send 
+gnokey query auth/accounts/$test1_user_addr
+stdout '"coins": "9999997999958ugnot"'
+
+-- script/print_originsend.gno --
+package main
+
+import "chain/banker"
+
+func main() {
+	println("send:", banker.OriginSend())
+}
+-- script/newbanker_realmissue.gno --
+package main
+
+import "chain/banker"
+
+func main() {
+	banker.NewBanker(banker.BankerTypeRealmIssue)
+}
+-- script/newbanker_realmsend.gno --
+package main
+
+import "chain/banker"
+
+func main() {
+	banker.NewBanker(banker.BankerTypeRealmSend)
+}
+-- script/newbanker_originsend.gno --
+package main
+
+import (
+	"chain"
+	"chain/banker"
+	"chain/runtime"
+)
+
+func main() {
+	to := chain.PackageAddress("gno.land/r/gimmemoney")
+	banker.NewBanker(banker.BankerTypeOriginSend).SendCoins(
+		runtime.CurrentRealm().Address(), to,
+		chain.Coins{{"ugnot", 42}},
+	)
+}

gno.land/pkg/keyscli/run.go

@@ -20,6 +20,7 @@ import (
 
 type MakeRunCfg struct {
 	RootCfg    *client.MakeTxCfg
+	Send       string
 	MaxDeposit string
 }
 
@@ -42,6 +43,12 @@ func NewMakeRunCmd(rootCfg *client.MakeTxCfg, cmdio commands.IO) *commands.Comma
 }
 
 func (c *MakeRunCfg) RegisterFlags(fs *flag.FlagSet) {
+	fs.StringVar(
+		&c.Send,
+		"send",
+		"",
+		"send amount",
+	)
 	fs.StringVar(
 		&c.MaxDeposit,
 		"max-deposit",
@@ -75,7 +82,13 @@ func execMakeRun(cfg *MakeRunCfg, args []string, cmdio commands.IO) error {
 	}
 	caller := info.GetAddress()
 
-	// Parase deposit amount
+	// Parse send amount.
+	send, err := std.ParseCoins(cfg.Send)
+	if err != nil {
+		return errors.Wrap(err, "parsing send coins")
+	}
+
+	// Parse deposit amount
 	deposit, err := std.ParseCoins(cfg.MaxDeposit)
 	if err != nil {
 		return errors.Wrap(err, "parsing storage deposit coins")
@@ -133,6 +146,7 @@ func execMakeRun(cfg *MakeRunCfg, args []string, cmdio commands.IO) error {
 	msg := vm.MsgRun{
 		Caller:     caller,
 		Package:    memPkg,
+		Send:       send,
 		MaxDeposit: deposit,
 	}
 	tx := std.Tx{

gnovm/stdlibs/chain/banker/banker.gno

@@ -68,7 +68,7 @@ func (b BankerType) String() string {
 // NewBanker returns a new Banker, with its capabilities matching the given
 // [BankerType].
 func NewBanker(bt BankerType) Banker {
-	assertCallerIsRealm()
+	assertCallerIsRealmOrEphemeral(uint8(bt))
 	if bt >= maxBanker {
 		panic("invalid banker type")
 	}
@@ -179,7 +179,7 @@ func OriginSend() chain.Coins {
 	return coins
 }
 
-func assertCallerIsRealm()
+func assertCallerIsRealmOrEphemeral(bt uint8)
 func originSend() (denoms []string, amounts []int64)
 
 // expandNative expands coins for usage within natively bound functions.

gnovm/stdlibs/chain/banker/banker.go

@@ -24,7 +24,7 @@
 
 const (
 	// Can only read state.
 	btReadonly uint8 = iota //nolint
 	// Can only send from tx send.
 	btOriginSend
 	// Can send from all realm coins.
@@ -96,11 +96,30 @@
 	return coins
 }
 
-func X_assertCallerIsRealm(m *gno.Machine) {
+func X_assertCallerIsRealmOrEphemeral(m *gno.Machine, bt uint8) {
 	frame := m.Frames[m.NumFrames()-2]
-	if path := frame.LastPackage.PkgPath; !gno.IsRealmPath(path) {
-		m.PanicString("caller is not a realm")
+	path := frame.LastPackage.PkgPath
+	if gno.IsRealmPath(path) {
+		return
 	}
+	if gno.IsEphemeralPath(path) {
+		switch bt {
+		case btOriginSend, btReadonly:
+			return
+		default:
+			// Other bankType than OriginSend and ReadOnly are forbidden for an
+			// ephemeral.
+			// The reason is that a malicious script could easily drain users' funds
+			// if they didn't carefully check the code. Restricting the banker type
+			// to OriginSend ensures that the amount spent cannot exceed what the
+			// user put in the 'send' field.
+			// Some complex smart contracts require ephemeral script to be used, and
+			// we expect those scripts to be generated by Dapps and not by user,
+			// hence we need to put some safeguards.
+			panic(fmt.Sprintf("invalid banker type %d for ephemeral", bt))
+		}
+	}
+	m.PanicString("caller is not a realm or an ephemeral")
 }
 
 func X_originSend(m *gno.Machine) (denoms []string, amounts []int64) {