!feat(evm): Reject not replay-protected tx to prevent replay attack (#1124)

* Reject not replay-protected tx to prevent replay attack Closes: #1122 - reject such txs in ante handler * add reject unprotected parameter * Update CHANGELOG.md * Apply suggestions from code review Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com> * pr suggestions * add unit test case * Reject not replay-protected tx to prevent replay attack Closes: #1122 - reject such txs in ante handler add reject unprotected parameter Update CHANGELOG.md Apply suggestions from code review Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com> pr suggestions add unit test case use var * add migrations * Apply suggestions from code review Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com> * rename * update comments Co-authored-by: Federico Kunze Küllmer <31522760+fedekunze@users.noreply.github.com>
2022-06-13 09:41:53 +00:00
parent 82835307c7
commit 8f932ddc6a
19 changed files with 4371 additions and 119 deletions
@@ -0,0 +1,19 @@
+package v2
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	paramtypes "github.com/cosmos/cosmos-sdk/x/params/types"
+	"github.com/tharsis/ethermint/x/evm/types"
+)
+
+// MigrateStore add the default RejectUnprotected parameter.
+func MigrateStore(ctx sdk.Context, paramstore *paramtypes.Subspace) error {
+	if !paramstore.HasKeyTable() {
+		ps := paramstore.WithKeyTable(types.ParamKeyTable())
+		paramstore = &ps
+	}
+
+	// add RejectUnprotected
+	paramstore.Set(ctx, types.ParamStoreKeyRejectUnprotectedTx, types.DefaultParams().RejectUnprotectedTx)
+	return nil
+}
@@ -0,0 +1,47 @@
+package v2_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/cosmos/cosmos-sdk/testutil"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	paramtypes "github.com/cosmos/cosmos-sdk/x/params/types"
+
+	"github.com/tharsis/ethermint/encoding"
+
+	"github.com/tharsis/ethermint/app"
+	v2 "github.com/tharsis/ethermint/x/evm/migrations/v2"
+	v2types "github.com/tharsis/ethermint/x/evm/migrations/v2/types"
+	"github.com/tharsis/ethermint/x/evm/types"
+)
+
+func TestMigrateStore(t *testing.T) {
+	encCfg := encoding.MakeConfig(app.ModuleBasics)
+	feemarketKey := sdk.NewKVStoreKey(types.StoreKey)
+	tFeeMarketKey := sdk.NewTransientStoreKey(fmt.Sprintf("%s_test", types.StoreKey))
+	ctx := testutil.DefaultContext(feemarketKey, tFeeMarketKey)
+	paramstore := paramtypes.NewSubspace(
+		encCfg.Marshaler, encCfg.Amino, feemarketKey, tFeeMarketKey, "evm",
+	).WithKeyTable(v2types.ParamKeyTable())
+
+	params := v2types.DefaultParams()
+	paramstore.SetParamSet(ctx, &params)
+
+	require.Panics(t, func() {
+		var result bool
+		paramstore.Get(ctx, types.ParamStoreKeyRejectUnprotectedTx, &result)
+	})
+
+	paramstore = paramtypes.NewSubspace(
+		encCfg.Marshaler, encCfg.Amino, feemarketKey, tFeeMarketKey, "evm",
+	).WithKeyTable(types.ParamKeyTable())
+	err := v2.MigrateStore(ctx, &paramstore)
+	require.NoError(t, err)
+
+	var result bool
+	paramstore.Get(ctx, types.ParamStoreKeyRejectUnprotectedTx, &result)
+	require.Equal(t, types.DefaultRejectUnprotectedTx, result)
+}
@@ -0,0 +1,165 @@
+package types
+
+import (
+	"math/big"
+	"strings"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+
+	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/params"
+
+	"github.com/tharsis/ethermint/x/evm/types"
+)
+
+// EthereumConfig returns an Ethereum ChainConfig for EVM state transitions.
+// All the negative or nil values are converted to nil
+func (cc ChainConfig) EthereumConfig(chainID *big.Int) *params.ChainConfig {
+	return &params.ChainConfig{
+		ChainID:                 chainID,
+		HomesteadBlock:          getBlockValue(cc.HomesteadBlock),
+		DAOForkBlock:            getBlockValue(cc.DAOForkBlock),
+		DAOForkSupport:          cc.DAOForkSupport,
+		EIP150Block:             getBlockValue(cc.EIP150Block),
+		EIP150Hash:              common.HexToHash(cc.EIP150Hash),
+		EIP155Block:             getBlockValue(cc.EIP155Block),
+		EIP158Block:             getBlockValue(cc.EIP158Block),
+		ByzantiumBlock:          getBlockValue(cc.ByzantiumBlock),
+		ConstantinopleBlock:     getBlockValue(cc.ConstantinopleBlock),
+		PetersburgBlock:         getBlockValue(cc.PetersburgBlock),
+		IstanbulBlock:           getBlockValue(cc.IstanbulBlock),
+		MuirGlacierBlock:        getBlockValue(cc.MuirGlacierBlock),
+		BerlinBlock:             getBlockValue(cc.BerlinBlock),
+		LondonBlock:             getBlockValue(cc.LondonBlock),
+		ArrowGlacierBlock:       getBlockValue(cc.ArrowGlacierBlock),
+		MergeForkBlock:          getBlockValue(cc.MergeForkBlock),
+		TerminalTotalDifficulty: nil,
+		Ethash:                  nil,
+		Clique:                  nil,
+	}
+}
+
+// DefaultChainConfig returns default evm parameters.
+func DefaultChainConfig() ChainConfig {
+	homesteadBlock := sdk.ZeroInt()
+	daoForkBlock := sdk.ZeroInt()
+	eip150Block := sdk.ZeroInt()
+	eip155Block := sdk.ZeroInt()
+	eip158Block := sdk.ZeroInt()
+	byzantiumBlock := sdk.ZeroInt()
+	constantinopleBlock := sdk.ZeroInt()
+	petersburgBlock := sdk.ZeroInt()
+	istanbulBlock := sdk.ZeroInt()
+	muirGlacierBlock := sdk.ZeroInt()
+	berlinBlock := sdk.ZeroInt()
+	londonBlock := sdk.ZeroInt()
+	arrowGlacierBlock := sdk.ZeroInt()
+	mergeForkBlock := sdk.ZeroInt()
+
+	return ChainConfig{
+		HomesteadBlock:      &homesteadBlock,
+		DAOForkBlock:        &daoForkBlock,
+		DAOForkSupport:      true,
+		EIP150Block:         &eip150Block,
+		EIP150Hash:          common.Hash{}.String(),
+		EIP155Block:         &eip155Block,
+		EIP158Block:         &eip158Block,
+		ByzantiumBlock:      &byzantiumBlock,
+		ConstantinopleBlock: &constantinopleBlock,
+		PetersburgBlock:     &petersburgBlock,
+		IstanbulBlock:       &istanbulBlock,
+		MuirGlacierBlock:    &muirGlacierBlock,
+		BerlinBlock:         &berlinBlock,
+		LondonBlock:         &londonBlock,
+		ArrowGlacierBlock:   &arrowGlacierBlock,
+		MergeForkBlock:      &mergeForkBlock,
+	}
+}
+
+func getBlockValue(block *sdk.Int) *big.Int {
+	if block == nil || block.IsNegative() {
+		return nil
+	}
+
+	return block.BigInt()
+}
+
+// Validate performs a basic validation of the ChainConfig params. The function will return an error
+// if any of the block values is uninitialized (i.e nil) or if the EIP150Hash is an invalid hash.
+func (cc ChainConfig) Validate() error {
+	if err := validateBlock(cc.HomesteadBlock); err != nil {
+		return sdkerrors.Wrap(err, "homesteadBlock")
+	}
+	if err := validateBlock(cc.DAOForkBlock); err != nil {
+		return sdkerrors.Wrap(err, "daoForkBlock")
+	}
+	if err := validateBlock(cc.EIP150Block); err != nil {
+		return sdkerrors.Wrap(err, "eip150Block")
+	}
+	if err := validateHash(cc.EIP150Hash); err != nil {
+		return err
+	}
+	if err := validateBlock(cc.EIP155Block); err != nil {
+		return sdkerrors.Wrap(err, "eip155Block")
+	}
+	if err := validateBlock(cc.EIP158Block); err != nil {
+		return sdkerrors.Wrap(err, "eip158Block")
+	}
+	if err := validateBlock(cc.ByzantiumBlock); err != nil {
+		return sdkerrors.Wrap(err, "byzantiumBlock")
+	}
+	if err := validateBlock(cc.ConstantinopleBlock); err != nil {
+		return sdkerrors.Wrap(err, "constantinopleBlock")
+	}
+	if err := validateBlock(cc.PetersburgBlock); err != nil {
+		return sdkerrors.Wrap(err, "petersburgBlock")
+	}
+	if err := validateBlock(cc.IstanbulBlock); err != nil {
+		return sdkerrors.Wrap(err, "istanbulBlock")
+	}
+	if err := validateBlock(cc.MuirGlacierBlock); err != nil {
+		return sdkerrors.Wrap(err, "muirGlacierBlock")
+	}
+	if err := validateBlock(cc.BerlinBlock); err != nil {
+		return sdkerrors.Wrap(err, "berlinBlock")
+	}
+	if err := validateBlock(cc.LondonBlock); err != nil {
+		return sdkerrors.Wrap(err, "londonBlock")
+	}
+	if err := validateBlock(cc.ArrowGlacierBlock); err != nil {
+		return sdkerrors.Wrap(err, "arrowGlacierBlock")
+	}
+	if err := validateBlock(cc.MergeForkBlock); err != nil {
+		return sdkerrors.Wrap(err, "mergeForkBlock")
+	}
+
+	// NOTE: chain ID is not needed to check config order
+	if err := cc.EthereumConfig(nil).CheckConfigForkOrder(); err != nil {
+		return sdkerrors.Wrap(err, "invalid config fork order")
+	}
+	return nil
+}
+
+func validateHash(hex string) error {
+	if hex != "" && strings.TrimSpace(hex) == "" {
+		return sdkerrors.Wrap(types.ErrInvalidChainConfig, "hash cannot be blank")
+	}
+
+	return nil
+}
+
+func validateBlock(block *sdk.Int) error {
+	// nil value means that the fork has not yet been applied
+	if block == nil {
+		return nil
+	}
+
+	if block.IsNegative() {
+		return sdkerrors.Wrapf(
+			types.ErrInvalidChainConfig, "block value cannot be negative: %s", block,
+		)
+	}
+
+	return nil
+}
@@ -0,0 +1,145 @@
+package types
+
+import (
+	"fmt"
+	"math/big"
+
+	"github.com/ethereum/go-ethereum/params"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	paramtypes "github.com/cosmos/cosmos-sdk/x/params/types"
+	"github.com/ethereum/go-ethereum/core/vm"
+	"github.com/tharsis/ethermint/types"
+)
+
+var _ paramtypes.ParamSet = &Params{}
+
+const (
+	DefaultEVMDenom = types.AttoPhoton
+)
+
+// DefaultMinGasMultiplier is 0.5 or 50%
+var DefaultMinGasMultiplier = sdk.NewDecWithPrec(50, 2)
+
+// Parameter keys
+var (
+	ParamStoreKeyEVMDenom     = []byte("EVMDenom")
+	ParamStoreKeyEnableCreate = []byte("EnableCreate")
+	ParamStoreKeyEnableCall   = []byte("EnableCall")
+	ParamStoreKeyExtraEIPs    = []byte("EnableExtraEIPs")
+	ParamStoreKeyChainConfig  = []byte("ChainConfig")
+
+	// AvailableExtraEIPs define the list of all EIPs that can be enabled by the
+	// EVM interpreter. These EIPs are applied in order and can override the
+	// instruction sets from the latest hard fork enabled by the ChainConfig. For
+	// more info check:
+	// https://github.com/ethereum/go-ethereum/blob/master/core/vm/interpreter.go#L97
+	AvailableExtraEIPs = []int64{1344, 1884, 2200, 2929, 3198, 3529}
+)
+
+// ParamKeyTable returns the parameter key table.
+func ParamKeyTable() paramtypes.KeyTable {
+	return paramtypes.NewKeyTable().RegisterParamSet(&Params{})
+}
+
+// NewParams creates a new Params instance
+func NewParams(evmDenom string, enableCreate, enableCall bool, config ChainConfig, extraEIPs ...int64) Params {
+	return Params{
+		EvmDenom:     evmDenom,
+		EnableCreate: enableCreate,
+		EnableCall:   enableCall,
+		ExtraEIPs:    extraEIPs,
+		ChainConfig:  config,
+	}
+}
+
+// DefaultParams returns default evm parameters
+// ExtraEIPs is empty to prevent overriding the latest hard fork instruction set
+func DefaultParams() Params {
+	return Params{
+		EvmDenom:     DefaultEVMDenom,
+		EnableCreate: true,
+		EnableCall:   true,
+		ChainConfig:  DefaultChainConfig(),
+		ExtraEIPs:    nil,
+	}
+}
+
+// ParamSetPairs returns the parameter set pairs.
+func (p *Params) ParamSetPairs() paramtypes.ParamSetPairs {
+	return paramtypes.ParamSetPairs{
+		paramtypes.NewParamSetPair(ParamStoreKeyEVMDenom, &p.EvmDenom, validateEVMDenom),
+		paramtypes.NewParamSetPair(ParamStoreKeyEnableCreate, &p.EnableCreate, validateBool),
+		paramtypes.NewParamSetPair(ParamStoreKeyEnableCall, &p.EnableCall, validateBool),
+		paramtypes.NewParamSetPair(ParamStoreKeyExtraEIPs, &p.ExtraEIPs, validateEIPs),
+		paramtypes.NewParamSetPair(ParamStoreKeyChainConfig, &p.ChainConfig, validateChainConfig),
+	}
+}
+
+// Validate performs basic validation on evm parameters.
+func (p Params) Validate() error {
+	if err := sdk.ValidateDenom(p.EvmDenom); err != nil {
+		return err
+	}
+
+	if err := validateEIPs(p.ExtraEIPs); err != nil {
+		return err
+	}
+
+	return p.ChainConfig.Validate()
+}
+
+// EIPs returns the ExtraEips as a int slice
+func (p Params) EIPs() []int {
+	eips := make([]int, len(p.ExtraEIPs))
+	for i, eip := range p.ExtraEIPs {
+		eips[i] = int(eip)
+	}
+	return eips
+}
+
+func validateEVMDenom(i interface{}) error {
+	denom, ok := i.(string)
+	if !ok {
+		return fmt.Errorf("invalid parameter EVM denom type: %T", i)
+	}
+
+	return sdk.ValidateDenom(denom)
+}
+
+func validateBool(i interface{}) error {
+	_, ok := i.(bool)
+	if !ok {
+		return fmt.Errorf("invalid parameter type: %T", i)
+	}
+	return nil
+}
+
+func validateEIPs(i interface{}) error {
+	eips, ok := i.([]int64)
+	if !ok {
+		return fmt.Errorf("invalid EIP slice type: %T", i)
+	}
+
+	for _, eip := range eips {
+		if !vm.ValidEip(int(eip)) {
+			return fmt.Errorf("EIP %d is not activateable, valid EIPS are: %s", eip, vm.ActivateableEips())
+		}
+	}
+
+	return nil
+}
+
+func validateChainConfig(i interface{}) error {
+	cfg, ok := i.(ChainConfig)
+	if !ok {
+		return fmt.Errorf("invalid chain config type: %T", i)
+	}
+
+	return cfg.Validate()
+}
+
+// IsLondon returns if london hardfork is enabled.
+func IsLondon(ethConfig *params.ChainConfig, height int64) bool {
+	return ethConfig.IsLondon(big.NewInt(height))
+}