[v1.8.4] EVM Upgrade (with precompiles security fix)

.github/workflows/build.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
       - uses: technote-space/get-diff-action@v5
         id: git_diff
         with:

.github/workflows/dry-run-release.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
           check-latest: true
       - name: Pull LFS files
         run: git lfs pull

.github/workflows/goreleaser.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
           check-latest: true
       - name: Pull LFS files
         run: git lfs pull

.github/workflows/lint.yml

@@ -15,15 +15,15 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
       - uses: actions/checkout@v4
       - uses: technote-space/get-diff-action@v5
         with:
           SUFFIX_FILTER: |
             .go
             .mod
             .sum
-      - uses: golangci/golangci-lint-action@v3
+      - uses: golangci/golangci-lint-action@v8
         with:
           # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
           version: latest

.github/workflows/proto-registry.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: bufbuild/buf-setup-action@v1.28.1
+      - uses: bufbuild/buf-setup-action@v1.50.0
       - uses: bufbuild/buf-push-action@v1
         with:
           input: "proto"

.github/workflows/proto.yml

@@ -33,7 +33,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
-      - uses: bufbuild/buf-setup-action@v1.28.1
+      - uses: bufbuild/buf-setup-action@v1.50.0
       - uses: bufbuild/buf-lint-action@v1
         with:
           input: "proto"
@@ -44,7 +44,7 @@ jobs:
   #   runs-on: ubuntu-latest
   #   steps:
   #     - uses: actions/checkout@v4
-  #     - uses: bufbuild/buf-setup-action@v1.28.1
+  #     - uses: bufbuild/buf-setup-action@v1.50.0
   #     - uses: bufbuild/buf-breaking-action@v1
   #       with:
   #         input: "proto"

.github/workflows/snyk.yml

@@ -11,7 +11,7 @@ jobs:
       - uses: snyk/actions/setup@master
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
       - name: Snyk monitor
         run: snyk code test
         env:

.github/workflows/test.yml

@@ -20,13 +20,13 @@ jobs:
     steps:
       - uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
       - name: Display Go Version
         run: go version
       - name: Install tparse
         run: |
           export GO111MODULE="on" && go install github.com/mfridman/tparse@latest
-      - uses: actions/cache@v2.1.7
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-tparse-binary
@@ -37,13 +37,13 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.22'
+          go-version: '1.23.10'
       - name: Checkout source
         uses: actions/checkout@v4
       - name: Generate LFS file list
         run: git lfs ls-files -l | cut -d' ' -f1 | sort > .lfs-assets-id
       - name: Restore LFS cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         id: lfs-cache
         with:
           path: .git/lfs

.golangci.yml

@@ -1,66 +1,74 @@
+version: "2"
 run:
-  tests: true
-  timeout: 5m
   concurrency: 4
-
+  go: "1.23"
+  tests: true
+issues:
+  max-issues-per-linter: 100
+  max-same-issues: 10
 linters:
   enable:
+    - asciicheck
     - dogsled
-    # - dupl TODO: enable
-    - errcheck
+    - dupl
     - goconst
     - gocritic
-    - gofumpt
-    # - revive
-    # - gosec
-    - gosimple
-    # - govet TODO: enable later (too many false positives)
-    - ineffassign
-    # - lll TODO: enable
+    - gomodguard
+    - gosec
     - misspell
     - nakedret
+    - nolintlint
     - prealloc
-    - exportloopref
+    - revive
     - staticcheck
-    - stylecheck
-    - typecheck
     - unconvert
     - unparam
-    - unused
-    # - nolintlint TODO: enable
-    - asciicheck
-    - exportloopref
+  settings:
+    dogsled:
+      max-blank-identifiers: 3
+    dupl:
+      threshold: 150
+    gomodguard:
+      blocked:
+        versions:
+          - https://github.com/etcd-io/etcd:
+              version: '>= 3.4.10 || ~3.3.23'
+              reason: CVE-2020-15114; CVE-2020-15136; CVE-2020-15115
+          - https://github.com/dgrijalva/jwt-go:
+              version: '>= 4.0.0-preview1'
+              reason: CVE-2020-26160
+    misspell:
+      locale: US
+    nolintlint:
+      require-explanation: false
+      require-specific: false
+      allow-unused: false
+    staticcheck:
+      checks:
+        - -SA1019
+        - All
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+      - x/evm/core
+    rules:
+      - path: _test\.go
+        linters:
+          - dupl
+formatters:
+  enable:
     - gofumpt
-    - gomodguard
-  disable:
-    - govet
-
-linters-settings:
-  dogsled:
-    max-blank-identifiers: 3
-  dupl:
-    threshold: 150
-  golint:
-    min-confidence: 0
-  maligned:
-    suggest-new: true
-  misspell:
-    locale: US
-  nolintlint:
-    allow-unused: false
-    allow-leading-space: true
-    require-explanation: false
-    require-specific: false
-  staticcheck:
-    checks: ["All", "-SA1019"]
-  gofumpt:
-    lang-version: "1.21"
-  gomodguard:
-    blocked:
-      versions:                                                         # List of blocked module version constraints
-        - https://github.com/etcd-io/etcd:                              # Blocked module with version constraint
-            version: ">= 3.4.10 || ~3.3.23"                             # Version constraint, see https://github.com/Masterminds/semver#basic-comparisons
-            reason: "CVE-2020-15114; CVE-2020-15136; CVE-2020-15115"    # Reason why the version constraint exists. (Optional)
-        - https://github.com/dgrijalva/jwt-go:                          # Blocked module with version constraint
-            version: ">= 4.0.0-preview1"                                # Version constraint, see https://github.com/Masterminds/semver#basic-comparisons
-            reason: "CVE-2020-26160"                                    # Reason why the version constraint exists. (Optional)
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Makefile

@@ -6,7 +6,7 @@ DIFF_TAG=$(shell git rev-list --tags="v*" --max-count=1 --not $(shell git rev-li
 DEFAULT_TAG=$(shell git rev-list --tags="v*" --max-count=1)
 # VERSION ?= $(shell echo $(shell git describe --tags $(or $(DIFF_TAG), $(DEFAULT_TAG))) | sed 's/^v//')
 
-VERSION := "1.8.3"
+VERSION := "1.8.4"
 CBFTVERSION := $(shell go list -m github.com/cometbft/cometbft | sed 's:.* ::')
 COMMIT := $(shell git log -1 --format='%H')
 LEDGER_ENABLED ?= true

app/ante/cosmos.go

@@ -0,0 +1,66 @@
+package ante
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/cosmos/cosmos-sdk/x/auth/ante"
+	sdkvesting "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
+	ibcante "github.com/cosmos/ibc-go/v7/modules/core/ante"
+
+	cosmosante "github.com/haqq-network/haqq/app/ante/cosmos"
+	evmante "github.com/haqq-network/haqq/app/ante/evm"
+	evmtypes "github.com/haqq-network/haqq/x/evm/types"
+)
+
+// newCosmosAnteHandler creates the default ante handler for Cosmos transactions
+func newCosmosAnteHandler(options HandlerOptions) sdk.AnteHandler {
+	return sdk.ChainAnteDecorators(
+		cosmosante.RejectMessagesDecorator{}, // reject MsgEthereumTxs
+		cosmosante.NewAuthzLimiterDecorator( // disable the Msg types that cannot be included on an authz.MsgExec msgs field
+			sdk.MsgTypeURL(&evmtypes.MsgEthereumTx{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}),
+		),
+		ante.NewSetUpContextDecorator(),
+		ante.NewExtensionOptionsDecorator(options.ExtensionOptionChecker),
+		ante.NewValidateBasicDecorator(),
+		ante.NewTxTimeoutHeightDecorator(),
+		ante.NewValidateMemoDecorator(options.AccountKeeper),
+		cosmosante.NewMinGasPriceDecorator(options.FeeMarketKeeper, options.EvmKeeper),
+		ante.NewConsumeGasForTxSizeDecorator(options.AccountKeeper),
+		cosmosante.NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.DistributionKeeper, options.FeegrantKeeper, options.StakingKeeper, options.TxFeeChecker),
+		// SetPubKeyDecorator must be called before all signature verification decorators
+		ante.NewSetPubKeyDecorator(options.AccountKeeper),
+		ante.NewValidateSigCountDecorator(options.AccountKeeper),
+		ante.NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),
+		ante.NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),
+		ante.NewIncrementSequenceDecorator(options.AccountKeeper),
+		ibcante.NewRedundantRelayDecorator(options.IBCKeeper),
+		evmante.NewGasWantedDecorator(options.EvmKeeper, options.FeeMarketKeeper),
+	)
+}
+
+// newLegacyCosmosAnteHandlerEip712 creates the ante handler for transactions signed with EIP712
+func newLegacyCosmosAnteHandlerEip712(options HandlerOptions) sdk.AnteHandler {
+	return sdk.ChainAnteDecorators(
+		cosmosante.RejectMessagesDecorator{}, // reject MsgEthereumTxs
+		cosmosante.NewAuthzLimiterDecorator( // disable the Msg types that cannot be included on an authz.MsgExec msgs field
+			sdk.MsgTypeURL(&evmtypes.MsgEthereumTx{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}),
+		),
+		ante.NewSetUpContextDecorator(),
+		ante.NewValidateBasicDecorator(),
+		ante.NewTxTimeoutHeightDecorator(),
+		cosmosante.NewMinGasPriceDecorator(options.FeeMarketKeeper, options.EvmKeeper),
+		ante.NewValidateMemoDecorator(options.AccountKeeper),
+		ante.NewConsumeGasForTxSizeDecorator(options.AccountKeeper),
+		cosmosante.NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.DistributionKeeper, options.FeegrantKeeper, options.StakingKeeper, options.TxFeeChecker),
+		// SetPubKeyDecorator must be called before all signature verification decorators
+		ante.NewSetPubKeyDecorator(options.AccountKeeper),
+		ante.NewValidateSigCountDecorator(options.AccountKeeper),
+		ante.NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),
+		// Note: signature verification uses EIP instead of the cosmos signature validator
+		cosmosante.NewLegacyEip712SigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),
+		ante.NewIncrementSequenceDecorator(options.AccountKeeper),
+		ibcante.NewRedundantRelayDecorator(options.IBCKeeper),
+		evmante.NewGasWantedDecorator(options.EvmKeeper, options.FeeMarketKeeper),
+	)
+}

app/ante/cosmos/authz.go

@@ -28,7 +28,7 @@ func NewAuthzLimiterDecorator(disabledMsgTypes ...string) AuthzLimiterDecorator
 
 func (ald AuthzLimiterDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (newCtx sdk.Context, err error) {
 	if err := ald.checkDisabledMsgs(tx.GetMsgs(), false, 1); err != nil {
-		return ctx, errorsmod.Wrapf(errortypes.ErrUnauthorized, err.Error())
+		return ctx, errorsmod.Wrap(errortypes.ErrUnauthorized, err.Error())
 	}
 	return next(ctx, tx, simulate)
 }

app/ante/cosmos/fees.go

@@ -27,7 +27,7 @@ type DeductFeeDecorator struct {
 	distributionKeeper anteutils.DistributionKeeper
 	feegrantKeeper     authante.FeegrantKeeper
 	stakingKeeper      anteutils.StakingKeeper
-	txFeeChecker       anteutils.TxFeeChecker
+	txFeeChecker       authante.TxFeeChecker
 }
 
 // NewDeductFeeDecorator returns a new DeductFeeDecorator.
@@ -37,7 +37,7 @@ func NewDeductFeeDecorator(
 	dk anteutils.DistributionKeeper,
 	fk authante.FeegrantKeeper,
 	sk anteutils.StakingKeeper,
-	tfc anteutils.TxFeeChecker,
+	tfc authante.TxFeeChecker,
 ) DeductFeeDecorator {
 	if tfc == nil {
 		tfc = checkTxFeeWithValidatorMinGasPrices
@@ -114,7 +114,7 @@ func (dfd DeductFeeDecorator) deductFee(ctx sdk.Context, sdkTx sdk.Tx, fees sdk.
 		if !feeGranter.Equals(feePayer) {
 			err := dfd.feegrantKeeper.UseGrantedFees(ctx, feeGranter, feePayer, fees, sdkTx.GetMsgs())
 			if err != nil {
-				return errorsmod.Wrapf(err, "%s does not not allow to pay fees for %s", feeGranter, feePayer)
+				return errorsmod.Wrapf(err, "%s does not allow to pay fees for %s", feeGranter, feePayer)
 			}
 		}
 
@@ -159,7 +159,12 @@ func deductFeesFromBalanceOrUnclaimedStakingRewards(
 
 // checkTxFeeWithValidatorMinGasPrices implements the default fee logic, where the minimum price per
 // unit of gas is fixed and set by each validator, and the tx priority is computed from the gas price.
-func checkTxFeeWithValidatorMinGasPrices(ctx sdk.Context, feeTx sdk.FeeTx) (sdk.Coins, int64, error) {
+func checkTxFeeWithValidatorMinGasPrices(ctx sdk.Context, tx sdk.Tx) (sdk.Coins, int64, error) {
+	feeTx, ok := tx.(sdk.FeeTx)
+	if !ok {
+		return sdk.Coins{}, 0, errorsmod.Wrap(errortypes.ErrTxDecode, "Tx must be a FeeTx")
+	}
+
 	feeCoins := feeTx.GetFee()
 	gas := feeTx.GetGas()
 
@@ -172,7 +177,7 @@ func checkTxFeeWithValidatorMinGasPrices(ctx sdk.Context, feeTx sdk.FeeTx) (sdk.
 		}
 	}
 
-	priority := getTxPriority(feeCoins, int64(gas)) //#nosec G701 -- gosec warning about integer overflow is not relevant here
+	priority := getTxPriority(feeCoins, int64(gas)) //nolint: gosec // G115 warning about integer overflow is not relevant here
 	return feeCoins, priority, nil
 }
 
@@ -188,7 +193,7 @@ func checkFeeCoinsAgainstMinGasPrices(ctx sdk.Context, feeCoins sdk.Coins, gas u
 
 	// Determine the required fees by multiplying each required minimum gas
 	// price by the gas limit, where fee = ceil(minGasPrice * gasLimit).
-	glDec := sdkmath.LegacyNewDec(int64(gas)) //#nosec G701 -- gosec warning about integer overflow is not relevant here
+	glDec := sdkmath.LegacyNewDec(int64(gas)) //nolint: gosec // G115 warning about integer overflow is not relevant here
 	for i, gp := range minGasPrices {
 		fee := gp.Amount.Mul(glDec)
 		requiredFees[i] = sdk.NewCoin(gp.Denom, fee.Ceil().RoundInt())