Merge remote-tracking branch 'origin/v11' into stepit/v11-orbiter-rc1

Author: 0xstepit

.changelog/v10.1.2/dependencies/600-bump-comet.md

@@ -0,0 +1 @@
+- Bump CometBFT to [`v0.38.19`](https://github.com/cometbft/cometbft/releases/tag/v0.38.19) to resolve [ASA-2025-003](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch) security advisory. ([#600](https://github.com/noble-assets/noble/pull/600))

.changelog/v10.1.2/dependencies/600-bump-forwarding.md

@@ -0,0 +1 @@
+- Bump Forwarding to [`v2.0.3`](https://github.com/noble-assets/forwarding/releases/tag/v2.0.3) to remove `x/bank` `GetAllBalances` usage. ([#600](https://github.com/noble-assets/noble/pull/600))

.changelog/v10.1.2/summary.md

@@ -0,0 +1,3 @@
+*Oct 14, 2025*
+
+This is a consensus breaking patch to the v10.1 Ember release line.

CHANGELOG.md

@@ -1,5 +1,16 @@
 # CHANGELOG
 
+## v10.1.2
+
+*Oct 14, 2025*
+
+This is a consensus breaking patch to the v10.1 Ember release line.
+
+### DEPENDENCIES
+
+- Bump Forwarding to [`v2.0.3`](https://github.com/noble-assets/forwarding/releases/tag/v2.0.3) to remove `x/bank` `GetAllBalances` usage. ([#600](https://github.com/noble-assets/noble/pull/600))
+- Bump CometBFT to [`v0.38.19`](https://github.com/cometbft/cometbft/releases/tag/v0.38.19) to resolve [ASA-2025-003](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch) security advisory. ([#600](https://github.com/noble-assets/noble/pull/600))
+
 ## v10.1.1
 
 *Aug 25, 2025*

ante.go

@@ -30,6 +30,7 @@ import (
 	ibcante "github.com/cosmos/ibc-go/v8/modules/core/ante"
 	ibckeeper "github.com/cosmos/ibc-go/v8/modules/core/keeper"
 	"github.com/noble-assets/forwarding/v2"
+	forwardingkeeper "github.com/noble-assets/forwarding/v2/keeper"
 	forwardingtypes "github.com/noble-assets/forwarding/v2/types"
 )
 
@@ -42,11 +43,12 @@ type BankKeeper interface {
 // AnteHandler for our custom ante decorators.
 type HandlerOptions struct {
 	ante.HandlerOptions
-	cdc          codec.Codec
-	BankKeeper   BankKeeper
-	DollarKeeper DollarKeeper
-	FTFKeeper    *ftfkeeper.Keeper
-	IBCKeeper    *ibckeeper.Keeper
+	cdc              codec.Codec
+	BankKeeper       BankKeeper
+	DollarKeeper     DollarKeeper
+	ForwardingKeeper *forwardingkeeper.Keeper
+	FTFKeeper        *ftfkeeper.Keeper
+	IBCKeeper        *ibckeeper.Keeper
 }
 
 // NewAnteHandler extends the default Cosmos SDK AnteHandler with custom ante decorators.
@@ -63,6 +65,10 @@ func NewAnteHandler(options HandlerOptions) (sdk.AnteHandler, error) {
 		return nil, errorsmod.Wrap(sdkerrors.ErrLogic, "dollar keeper is required for ante builder")
 	}
 
+	if options.ForwardingKeeper == nil {
+		return nil, errorsmod.Wrap(sdkerrors.ErrLogic, "forwarding keeper is required for ante builder")
+	}
+
 	if options.FTFKeeper == nil {
 		return nil, errorsmod.Wrap(sdkerrors.ErrLogic, "fiattokenfactory keeper is required for ante builder")
 	}
@@ -106,7 +112,7 @@ func NewAnteHandler(options HandlerOptions) (sdk.AnteHandler, error) {
 
 func NewSigVerificationDecorator(options HandlerOptions) sdk.AnteDecorator {
 	defaultAnte := ante.NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler)
-	return forwarding.NewSigVerificationDecorator(options.BankKeeper, defaultAnte)
+	return forwarding.NewSigVerificationDecorator(options.BankKeeper, options.ForwardingKeeper, defaultAnte)
 }
 
 // SigVerificationGasConsumer is a custom implementation of the signature verification gas

ante_permissioned_liquidity.go

@@ -21,6 +21,7 @@ import (
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	"github.com/cosmos/cosmos-sdk/x/authz"
+	swaptypes "swap.noble.xyz/types"
 	stableswaptypes "swap.noble.xyz/types/stableswap"
 
 	"github.com/noble-assets/noble/v11/upgrade"
@@ -61,6 +62,10 @@ func (d PermissionedLiquidityDecorator) CheckMessage(msg sdk.Msg) error {
 		if m.Signer != PermissionedAccount {
 			return fmt.Errorf("%s is currently a permissioned action", sdk.MsgTypeURL(msg))
 		}
+	case *swaptypes.MsgWithdrawRewards:
+		if m.Signer != PermissionedAccount {
+			return fmt.Errorf("%s is currently a permissioned action", sdk.MsgTypeURL(msg))
+		}
 	case *authz.MsgExec:
 		execMsgs, err := m.GetMessages()
 		if err != nil {

api/generate.sh

@@ -12,7 +12,7 @@ buf export buf.build/noble-assets/cctp:4285c94ec19438ad1e05ba3e5106a5e7980cfffd
 buf export buf.build/noble-assets/dollar:v2.2.0-rc.0 --output api/proto
 buf export buf.build/noble-assets/fiattokenfactory:5f9bd9dd2c5b5336b94bae4a47195bdf035f04af --output api/proto
 buf export buf.build/noble-assets/florin:v2.0.0 --output api/proto
-buf export buf.build/noble-assets/forwarding:v2.0.2 --output api/proto
+buf export buf.build/noble-assets/forwarding:v2.0.3 --output api/proto
 buf export buf.build/noble-assets/globalfee:v1.0.1 --output api/proto
 buf export buf.build/noble-assets/halo:v2.0.1 --output api/proto
 buf export buf.build/noble-assets/orbiter:v1.0.0-rc.1 --output api/proto

app.go

@@ -28,6 +28,7 @@ import (
 	"cosmossdk.io/log"
 	"cosmossdk.io/math"
 	storetypes "cosmossdk.io/store/types"
+	abci "github.com/cometbft/cometbft/abci/types"
 	"github.com/cometbft/cometbft/crypto"
 	"github.com/cometbft/cometbft/libs/bytes"
 	cmtos "github.com/cometbft/cometbft/libs/os"
@@ -45,6 +46,8 @@ import (
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	"github.com/cosmos/cosmos-sdk/types/module"
 	"github.com/cosmos/cosmos-sdk/x/auth/ante"
+	authoritytypes "github.com/noble-assets/authority/types"
+	forwardingtypes "github.com/noble-assets/forwarding/v2/types"
 	"github.com/noble-assets/noble/v11/api"
 	"github.com/noble-assets/noble/v11/jester"
 	"github.com/noble-assets/noble/v11/upgrade"
@@ -298,11 +301,12 @@ func NewApp(
 			TxFeeChecker:    globalfee.TxFeeChecker(app.GlobalFeeKeeper),
 			SigGasConsumer:  SigVerificationGasConsumer,
 		},
-		cdc:          app.appCodec,
-		BankKeeper:   app.BankKeeper,
-		DollarKeeper: app.DollarKeeper,
-		FTFKeeper:    app.FTFKeeper,
-		IBCKeeper:    app.IBCKeeper,
+		cdc:              app.appCodec,
+		BankKeeper:       app.BankKeeper,
+		DollarKeeper:     app.DollarKeeper,
+		ForwardingKeeper: app.ForwardingKeeper,
+		FTFKeeper:        app.FTFKeeper,
+		IBCKeeper:        app.IBCKeeper,
 	})
 	if err != nil {
 		return nil, err
@@ -316,7 +320,26 @@ func NewApp(
 	)
 
 	app.SetPrepareProposal(proposalHandler.PrepareProposal())
-	app.SetPreBlocker(proposalHandler.PreBlocker())
+	app.SetPreBlocker(func(ctx sdk.Context, req *abci.RequestFinalizeBlock) (*sdk.ResponsePreBlock, error) {
+		// On Noble mainnet, the v10.1.2 upgrade is applied at block #36,887,000.
+		// This upgrade removes support for the wildcard in the x/forwarding
+		// module allowed denoms configuration, which we set explicitly to USDC.
+		if ctx.ChainID() == upgrade.MainnetChainID && req.Height == 36887000 {
+			_, err := app.ForwardingKeeper.SetAllowedDenoms(ctx, &forwardingtypes.MsgSetAllowedDenoms{
+				Signer: authoritytypes.ModuleAddress.String(),
+				Denoms: []string{
+					app.FTFKeeper.GetMintingDenom(ctx).Denom, // USDC
+					app.DollarKeeper.GetDenom(),              // USDN
+				},
+			})
+
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		return proposalHandler.PreBlocker()(ctx, req)
+	})
 
 	if err := app.RegisterUpgradeHandler(); err != nil {
 		return nil, err

e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/noble-assets/noble/e2e
 
-go 1.24
+go 1.24.0
 
 require (
 	cosmossdk.io/math v1.5.1
@@ -17,19 +17,19 @@ require (
 	github.com/noble-assets/halo/v2 v2.0.1
 	github.com/ondoprotocol/usdy-noble/v2 v2.0.0
 	github.com/strangelove-ventures/interchaintest/v8 v8.8.0
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/zap v1.27.0
 )
 
 require (
-	cel.dev/expr v0.23.0 // indirect
-	cloud.google.com/go v0.121.2 // indirect
-	cloud.google.com/go/auth v0.16.2 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	cloud.google.com/go v0.121.6 // indirect
+	cloud.google.com/go/auth v0.16.5 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.7.0 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/monitoring v1.24.2 // indirect
-	cloud.google.com/go/storage v1.53.0 // indirect
+	cloud.google.com/go/storage v1.56.0 // indirect
 	cosmossdk.io/api v0.9.2 // indirect
 	cosmossdk.io/client/v2 v2.0.0-beta.8 // indirect
 	cosmossdk.io/collections v1.2.1 // indirect
@@ -53,9 +53,9 @@ require (
 	github.com/DataDog/zstd v1.5.5 // indirect
 	github.com/FactomProject/basen v0.0.0-20150613233007-fe3947df716e // indirect
 	github.com/FactomProject/btcutilecc v0.0.0-20130527213604-d3a63a5752ec // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.27.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0 // indirect
-	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.54.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.54.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/StackExchange/wmi v1.2.1 // indirect
 	github.com/StirlingMarketingGroup/go-namecase v1.0.0 // indirect
@@ -68,15 +68,15 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chzyer/readline v1.5.1 // indirect
-	github.com/cncf/xds/go v0.0.0-20250326154945-ae57f3c0d45f // indirect
+	github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
 	github.com/cockroachdb/apd/v3 v3.2.1 // indirect
 	github.com/cockroachdb/errors v1.12.0 // indirect
 	github.com/cockroachdb/fifo v0.0.0-20240606204812-0bbfbd93a7ce // indirect
 	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
 	github.com/cockroachdb/pebble v1.1.5 // indirect
 	github.com/cockroachdb/redact v1.1.6 // indirect
 	github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
-	github.com/cometbft/cometbft v0.38.17 // indirect
+	github.com/cometbft/cometbft v0.38.19 // indirect
 	github.com/cometbft/cometbft-db v0.14.1 // indirect
 	github.com/consensys/gnark-crypto v0.18.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
@@ -97,9 +97,9 @@ require (
 	github.com/deckarep/golang-set v1.8.0 // indirect
 	github.com/deckarep/golang-set/v2 v2.6.0 // indirect
 	github.com/decred/base58 v1.0.4 // indirect
-	github.com/decred/dcrd/crypto/blake256 v1.0.1 // indirect
+	github.com/decred/dcrd/crypto/blake256 v1.1.0 // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v2 v2.0.1 // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
 	github.com/dgraph-io/badger/v4 v4.2.0 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
@@ -118,7 +118,7 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/getsentry/sentry-go v0.32.0 // indirect
 	github.com/gin-gonic/gin v1.8.1 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.1 // indirect
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
@@ -132,7 +132,7 @@ require (
 	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
 	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.3 // indirect
-	github.com/golang/glog v1.2.4 // indirect
+	github.com/golang/glog v1.2.5 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/mock v1.7.0-rc.1 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -145,7 +145,7 @@ require (
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.3 // indirect
@@ -220,7 +220,7 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_golang v1.21.0 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.62.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
@@ -259,35 +259,35 @@ require (
 	github.com/zondax/ledger-go v0.14.3 // indirect
 	go.etcd.io/bbolt v1.4.0-alpha.0.0.20240404170359-43604f3112c5 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.63.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
-	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
-	go.opentelemetry.io/otel/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.36.0 // indirect
-	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/mock v0.4.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/exp v0.0.0-20240909161429-701f63a606c0 // indirect
-	golang.org/x/mod v0.25.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
-	golang.org/x/oauth2 v0.30.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.34.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
-	golang.org/x/time v0.12.0 // indirect
-	golang.org/x/tools v0.33.0 // indirect
-	google.golang.org/api v0.237.0 // indirect
-	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/grpc v1.73.0 // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
+	golang.org/x/crypto v0.42.0 // indirect
+	golang.org/x/exp v0.0.0-20241009180824-f66d83c29e7c // indirect
+	golang.org/x/mod v0.27.0 // indirect
+	golang.org/x/net v0.44.0 // indirect
+	golang.org/x/oauth2 v0.31.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.36.0 // indirect
+	golang.org/x/term v0.35.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
+	golang.org/x/time v0.13.0 // indirect
+	golang.org/x/tools v0.36.0 // indirect
+	google.golang.org/api v0.249.0 // indirect
+	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250922171735-9219d122eba9 // indirect
+	google.golang.org/grpc v1.75.1 // indirect
+	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/npipe.v2 v2.0.0-20160621034901-c1b8fa8bdcce // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect