Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore (api)!: remove capabilities from SendPacket #7213

Merged
merged 2 commits into from
Aug 29, 2024

Conversation

bznein
Copy link
Contributor

@bznein bznein commented Aug 28, 2024

Description

closes: #XXXX


Before we can merge this PR, please make sure that all the following items have been
checked off. If any of the checklist items are not applicable, please leave them but
write a little note why.

  • Targeted PR against the correct branch (see CONTRIBUTING.md).
  • Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work.
  • Code follows the module structure standards and Go style guide.
  • Wrote unit and integration tests.
  • Updated relevant documentation (docs/).
  • Added relevant godoc comments.
  • Provide a conventional commit message to follow the repository standards.
  • Include a descriptive changelog entry when appropriate. This may be left to the discretion of the PR reviewers. (e.g. chores should be omitted from changelog)
  • Re-reviewed Files changed in the GitHub PR explorer.
  • Review SonarCloud Report in the comment section below once CI passes.

@bznein bznein marked this pull request as ready for review August 28, 2024 10:45
@bznein bznein added the priority PRs that need prompt reviews label Aug 28, 2024
@colin-axner colin-axner self-assigned this Aug 28, 2024
Copy link
Contributor

@colin-axner colin-axner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Woo! Great work! 🎉

For reference to other viewers. While we have not adjusted the SendPacket to go through an rpc on core IBC, this is still safe to remove as we rely on the security principles guarded by the bank keeper. Modules which can access the go api must not be malicious (otherwise they can send coins from any account to any other account). The same principle is being applied by removing this code. It was always true that a malicious module could bypass the channel capability anyways (by embedding the scoped keeper of another module)

@colin-axner
Copy link
Contributor

We will need to add a changelog + migration docs, but happy to do that at the end. Maybe we can make a note on the remove capabilities issue

@colin-axner colin-axner removed their assignment Aug 28, 2024
@bznein
Copy link
Contributor Author

bznein commented Aug 28, 2024

It's probably better to have this one merged #7089 before we merge any removal of capabilities, to avoid merge conflicts on that PR

Copy link
Member

@damiannolan damiannolan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice 🔴 diffs!

Copy link
Contributor

@chatton chatton left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🪓 love the diff!

@DimitrisJim
Copy link
Contributor

It's probably better to have this one merged #7089 before we merge any removal of capabilities,

I'd say go for the merge and dont let other PR block you (currently reviewing it that and trying to find some issue with tests, I'll take care of merge conflicts there)

Copy link

sonarcloud bot commented Aug 29, 2024

@bznein bznein added this pull request to the merge queue Aug 29, 2024
Merged via the queue into main with commit 0613ec8 Aug 29, 2024
72 checks passed
@bznein bznein deleted the bznein/removeCapabilitiesSendPacket branch August 29, 2024 10:19
bznein added a commit that referenced this pull request Aug 29, 2024
* chore (api)\!: remove capabilities from SendPacket

* add changelog + note to add migration documentation

---------

Co-authored-by: Carlos Rodriguez <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority PRs that need prompt reviews
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants