fix: vesting loophole

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2.0.4
+
+### Security
+
+* (IRISHub) [\#2860](https://github.com/irisnet/irishub/pull/2860) Disable the vesting account creation to prevent contract address front-running.
+
 ## 2.0.3
 
 ### Improvements

ante/handler_options.go

@@ -72,6 +72,7 @@ func newCosmosAnteHandler(options HandlerOptions) sdk.AnteHandler {
 		NewValidateServiceDecorator(),
 		ante.NewIncrementSequenceDecorator(options.AccountKeeper),
 		ibcante.NewRedundantRelayDecorator(options.IBCKeeper),
+		NewRejectVestingDecorator(),
 	)
 }
 

ante/vesting.go

@@ -0,0 +1,27 @@
+package ante
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+
+	vestingtypes "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
+)
+
+// RejectVestingDecorator is responsible for rejecting the vesting msg
+type RejectVestingDecorator struct{}
+
+// NewRejectVestingDecorator returns an instance of ValidateVestingDecorator
+func NewRejectVestingDecorator() RejectVestingDecorator {
+	return RejectVestingDecorator{}
+}
+
+// AnteHandle checks the transaction
+func (vvd RejectVestingDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
+	for _, msg := range tx.GetMsgs() {
+		switch msg.(type) {
+		case *vestingtypes.MsgCreateVestingAccount, *vestingtypes.MsgCreatePermanentLockedAccount, *vestingtypes.MsgCreatePeriodicVestingAccount:
+			return ctx, sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "currently doesn't support creating vesting account")
+		}
+	}
+	return next(ctx, tx, simulate)
+}