From 52b583aad2de7b3aae25f4e0b3453fb340e04a53 Mon Sep 17 00:00:00 2001 From: Christoph Otter Date: Thu, 8 Feb 2024 11:17:55 +0100 Subject: [PATCH] Fix address validation --- x/wasm/keeper/api.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/x/wasm/keeper/api.go b/x/wasm/keeper/api.go index 9d3ef49183..f774b042e8 100644 --- a/x/wasm/keeper/api.go +++ b/x/wasm/keeper/api.go @@ -1,6 +1,8 @@ package keeper import ( + "errors" + wasmvm "github.com/CosmWasm/wasmvm/v2" wasmvmtypes "github.com/CosmWasm/wasmvm/v2/types" @@ -15,7 +17,7 @@ const ( // DefaultGasCostCanonicalAddress is how much SDK gas we charge to convert to a canonical address format DefaultGasCostCanonicalAddress = 4 // DefaultGasCostValidateAddress is how much SDK gas we charge to validate an address - DefaultGasCostValidateAddress = 4 + DefaultGasCostValidateAddress = 9 // DefaultDeserializationCostPerByte The formula should be `len(data) * deserializationCostPerByte` DefaultDeserializationCostPerByte = 1 @@ -44,7 +46,14 @@ func canonicalizeAddress(human string) ([]byte, uint64, error) { } func validateAddress(human string) (uint64, error) { - _, err := sdk.AccAddressFromBech32(human) + canonicalized, err := sdk.AccAddressFromBech32(human) + if err != nil { + return costValidate, err + } + // AccAddressFromBech32 already calls VerifyAddressFormat, so we can just humanize and compare + if sdk.AccAddress(canonicalized).String() != human { + return costValidate, errors.New("address not normalized") + } return costValidate, err }