fix(upgrade): v1.3.0 restore validator delegate grant only (release/1.3.x)

Mirror of the #263 review fix on release/1.3.x: drop the SP deposit grant
restoration (re-granting it generically broadened authority vs the scoped
DepositAuthorization, and was a no-op for the real incident) and narrow
the handler to the one grant the state machine requires —
validator SelfDelAddress -> gov : MsgDelegate (Generic), enforced by
CheckStakeAuthorization on MsgCreateValidator.

Renamed V1_3_0RestoreGovGrants -> V1_3_0RestoreValidatorDelegateGrant;
SpKeeper dependency removed. Module path evmos/evmos/v12 (release/1.3.x).

Author: puneet2019

CHANGELOG.md

@@ -41,7 +41,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 - (proto) [#67](https://github.com/mocachain/moca/pull/67) Publish protos to BSR under moca org
 - (cli) [#243](https://github.com/mocachain/moca/pull/243) Add `mocad snapshots` command tree (list/delete/dump/export/load/restore) for managing local state-sync snapshots
-- (upgrade) [#266](https://github.com/mocachain/moca/pull/266) `v1.3.0` upgrade re-grants the validator→gov (`MsgDelegate`) and SP→gov (`MsgDeposit`) authz grants the moca-iavl commit-time bug dropped from the merkle tree, keyed off the canonical staking/sp stores so it is deterministic on every node
+- (upgrade) [#266](https://github.com/mocachain/moca/pull/266) `v1.3.0` upgrade re-grants the validator self-del → gov (`MsgDelegate`, Generic) authz grant required by `MsgCreateValidator` that the moca-iavl commit-time bug dropped from the merkle tree, keyed off the canonical staking store so it is deterministic on every node. Scope is intentionally minimal (only this required grant); other dropped grants are not reconstructable from on-chain state and owners re-create them
 
 ### Improvements
 

app/app.go

@@ -1559,17 +1559,18 @@ func (app *Evmos) setupUpgradeHandlers() {
 		return app.mm.RunMigrations(ctx, app.configurator, fromVM)
 	})
 
-	// v1.3.0: re-grant the authz grants moca's custom handlers require but that
-	// the moca-iavl commit-time bug dropped from the merkle tree — each
-	// validator's SelfDelAddress -> gov (MsgDelegate) and each SP's funding
-	// address -> gov (MsgDeposit) — keyed off the canonical staking/sp stores so
-	// the result is deterministic on every node regardless of per-node fastnode
-	// drift. (The fastnode drift itself is fixed by an IAVL rebuild — state-sync
-	// or a fastStorageVersionValue bump — not from a consensus handler.) The
-	// v1.3.0 binary also carries the cosmos/iavl#1009 GetNode reformatted-root fix.
+	// v1.3.0: re-grant the validator SelfDelAddress -> gov (MsgDelegate) authz
+	// grant that moca's MsgCreateValidator handler requires but that the
+	// moca-iavl commit-time bug dropped from the merkle tree. Keyed off the
+	// canonical staking store so it is deterministic on every node regardless of
+	// per-node fastnode drift; restored as Generic to match the standard
+	// create-validator flow. Other dropped grants are not reconstructable from
+	// on-chain state and owners re-create them; the residual fastnode drift is
+	// fixed by an IAVL rebuild (state-sync / fastStorageVersionValue bump), not
+	// from a consensus handler. The v1.3.0 binary also carries cosmos/iavl#1009.
 	app.UpgradeKeeper.SetUpgradeHandler(
 		upgrades.V1_3_0UpgradeName,
-		upgrades.V1_3_0RestoreGovGrants(app.AuthzKeeper, app.StakingKeeper, app.SpKeeper, app.mm, app.configurator),
+		upgrades.V1_3_0RestoreValidatorDelegateGrant(app.AuthzKeeper, app.StakingKeeper, app.mm, app.configurator),
 	)
 
 	// testnet only upgrade Handlers

app/upgrades/v1_3_0_authz_recovery.go

@@ -13,66 +13,59 @@ import (
 	govtypes "github.com/cosmos/cosmos-sdk/x/gov/types"
 	stakingkeeper "github.com/cosmos/cosmos-sdk/x/staking/keeper"
 	stakingtypes "github.com/cosmos/cosmos-sdk/x/staking/types"
-
-	spkeeper "github.com/evmos/evmos/v12/x/sp/keeper"
-	sptypes "github.com/evmos/evmos/v12/x/sp/types"
 )
 
 // V1_3_0UpgradeName is the on-chain name of the v1.3.0 software upgrade.
 const V1_3_0UpgradeName = "v1.3.0"
 
-// V1_3_0RestoreGovGrants re-grants the authz grants that moca's custom handlers
-// require but that the moca-iavl commit-time bug dropped from the merkle tree:
+// V1_3_0RestoreValidatorDelegateGrant re-grants the one authz grant that moca's
+// state machine requires for an existing validator to keep functioning but that
+// the moca-iavl commit-time bug dropped from the merkle tree:
+//
+//	each validator's SelfDelAddress -> gov : MsgDelegate (GenericAuthorization)
 //
-//   - each validator's SelfDelAddress -> gov : MsgDelegate (Generic), required
-//     by CheckStakeAuthorization on MsgCreateValidator
-//   - each storage provider's FundingAddress -> gov : MsgDeposit (Generic),
-//     required by CheckDepositAuthorization on MsgDeposit
+// moca's custom MsgCreateValidator handler enforces this grant via
+// CheckStakeAuthorization, and the standard create-validator flow grants it as a
+// GenericAuthorization (deployment/dockerup/create_validator_proposal.sh), so
+// restoring it as Generic matches the original — no behavior change.
 //
-// It is keyed off the canonical staking and sp stores (identical on every node
-// by consensus), so the set of SaveGrant writes is the SAME on every node
-// regardless of any per-node authz fastnode drift. SaveGrant's Set re-adds the
-// grant to the merkle tree (so a node that lost it from the tree gets it back)
-// and overwrites any stale fastnode entry for that exact key — healing the
-// drift for the keys that matter, deterministically.
+// Scope (deliberately minimal — this is NOT a full recovery of every dropped
+// authz entry): the handler reconstructs only what is derivable from the
+// canonical staking store, so the SaveGrant writes are identical on every node
+// regardless of per-node authz fastnode drift. SaveGrant's Set re-adds the
+// grant to the merkle tree and overwrites any stale fastnode entry for that key.
+// Grants whose granter is not a current validator self-delegation address — SP
+// deposit grants, user-to-user grants, grants from accounts that have since
+// unbonded — cannot be reconstructed from on-chain state and are NOT restored;
+// their owners re-create them with the correct authorization (e.g. SP operators
+// re-grant a scoped DepositAuthorization, not an unbounded generic one).
 //
-// Why this does NOT purge the authz store: a 2-node test proved that a handler
-// CANNOT safely clear the store. The only enumeration reachable from a handler
-// is the store iterator, which reads the IAVL fastnode index — not the tree. A
-// node whose fastnode is *missing* a tree-backed key (fastnode < tree) never
-// yields that key, so a purge keyed off the iterator skips it; the key survives
-// in that node's tree while other nodes delete it -> divergent apphash -> fork.
-// The fastnode drift itself is a node-local concern and is fixed the right way
-// by an IAVL fastnode rebuild (state-sync, or bumping fastStorageVersionValue),
-// which rebuilds the fastnode from the canonical tree and so covers both drift
-// directions without any consensus risk.
+// The residual fastnode drift on those non-restored keys is node-local and is
+// fixed by an IAVL fastnode rebuild (state-sync, or bumping fastStorageVersionValue),
+// which rebuilds the fastnode from the canonical tree and covers both drift
+// directions without consensus risk.
 //
-// Determinism notes: the restored grants are Generic with no expiration (the
-// standard moca setup grant — see deployment/dockerup/create_validator_proposal.sh),
-// so SaveGrant touches no grant-queue state and its result does not depend on
-// reading the drifted store. The handler runs at block level on the infinite
-// gas meter. MUST run on the v1.3.0 binary (carries cosmos/iavl#1009).
-func V1_3_0RestoreGovGrants(
+// Determinism notes: the restored grant is Generic with no expiration, so
+// SaveGrant touches no grant-queue state and does not depend on reading the
+// drifted store. The handler runs at block level on the infinite gas meter.
+// MUST run on the v1.3.0 binary (carries cosmos/iavl#1009).
+func V1_3_0RestoreValidatorDelegateGrant(
 	authzKeeper authzkeeper.Keeper,
 	stakingKeeper *stakingkeeper.Keeper,
-	spKeeper spkeeper.Keeper,
 	mm *module.Manager,
 	configurator module.Configurator,
 ) upgradetypes.UpgradeHandler {
 	return func(ctx context.Context, _ upgradetypes.Plan, fromVM module.VersionMap) (module.VersionMap, error) {
 		sdkCtx := sdk.UnwrapSDKContext(ctx)
 		logger := sdkCtx.Logger().With("upgrade", V1_3_0UpgradeName)
 		govAddr := authtypes.NewModuleAddress(govtypes.ModuleName)
-
 		delegateMsg := sdk.MsgTypeURL(&stakingtypes.MsgDelegate{})
-		depositMsg := sdk.MsgTypeURL(&sptypes.MsgDeposit{})
 
-		// validator self-delegation account -> gov : MsgDelegate
 		vals, err := stakingKeeper.GetAllValidators(ctx)
 		if err != nil {
 			return nil, fmt.Errorf("authz restore: list validators: %w", err)
 		}
-		valGrants := 0
+		granted := 0
 		for _, v := range vals {
 			granter, err := sdk.AccAddressFromHexUnsafe(v.SelfDelAddress)
 			if err != nil || granter.Empty() {
@@ -83,26 +76,10 @@ func V1_3_0RestoreGovGrants(
 			if err := authzKeeper.SaveGrant(ctx, govAddr, granter, authz.NewGenericAuthorization(delegateMsg), nil); err != nil {
 				return nil, fmt.Errorf("authz restore: grant MsgDelegate for %s: %w", v.SelfDelAddress, err)
 			}
-			valGrants++
-		}
-
-		// storage provider funding account -> gov : MsgDeposit
-		spGrants := 0
-		for _, sp := range spKeeper.GetAllStorageProviders(sdkCtx) {
-			granter, err := sdk.AccAddressFromHexUnsafe(sp.FundingAddress)
-			if err != nil || granter.Empty() {
-				logger.Error("authz restore: skip sp with bad funding addr",
-					"sp", sp.Id, "funding", sp.FundingAddress, "err", err)
-				continue
-			}
-			if err := authzKeeper.SaveGrant(ctx, govAddr, granter, authz.NewGenericAuthorization(depositMsg), nil); err != nil {
-				return nil, fmt.Errorf("authz restore: grant MsgDeposit for %s: %w", sp.FundingAddress, err)
-			}
-			spGrants++
+			granted++
 		}
 
-		logger.Info("authz restore: re-granted required gov grants",
-			"validator_delegate", valGrants, "sp_deposit", spGrants)
+		logger.Info("authz restore: re-granted validator delegate grants", "count", granted)
 		return mm.RunMigrations(ctx, configurator, fromVM)
 	}
 }

app/upgrades/v1_3_0_authz_recovery_test.go

@@ -27,7 +27,7 @@ func mustAcc(t *testing.T, hexAddr string) sdk.AccAddress {
 
 // The handler must re-grant each validator's SelfDelAddress -> gov : MsgDelegate
 // (Generic), and leave unrelated grants untouched.
-func TestV1_3_0RestoreGovGrants(t *testing.T) {
+func TestV1_3_0RestoreValidatorDelegateGrant(t *testing.T) {
 	const chainID = "moca_5151-1"
 	mocaApp := app.Setup(false, feemarkettypes.DefaultGenesisState(), chainID)
 	sdkCtx := mocaApp.BaseApp.NewContext(false).WithChainID(chainID)
@@ -57,8 +57,8 @@ func TestV1_3_0RestoreGovGrants(t *testing.T) {
 
 	mm := module.NewManager()
 	configurator := module.NewConfigurator(mocaApp.AppCodec(), mocaApp.MsgServiceRouter(), mocaApp.GRPCQueryRouter())
-	handler := upgrades.V1_3_0RestoreGovGrants(
-		mocaApp.AuthzKeeper, mocaApp.StakingKeeper, mocaApp.SpKeeper, mm, configurator)
+	handler := upgrades.V1_3_0RestoreValidatorDelegateGrant(
+		mocaApp.AuthzKeeper, mocaApp.StakingKeeper, mm, configurator)
 	_, err = handler(ctx, upgradetypes.Plan{Name: upgrades.V1_3_0UpgradeName}, module.VersionMap{})
 	require.NoError(t, err)