From 1960ea69fcdabf0ab65145d2c421f3cc9eb65fdf Mon Sep 17 00:00:00 2001
From: HuangYi <huang@crypto.com>
Date: Tue, 4 Jan 2022 20:56:42 +0800
Subject: [PATCH 1/2] Validate code hash in GenesisAccount

Closes: #872
---
 x/evm/genesis.go      | 11 +++++++++--
 x/evm/genesis_test.go | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/x/evm/genesis.go b/x/evm/genesis.go
index ff023e707c..a54fd794f2 100644
--- a/x/evm/genesis.go
+++ b/x/evm/genesis.go
@@ -1,11 +1,13 @@
 package evm
 
 import (
+	"bytes"
 	"fmt"
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	authtypes "github.com/cosmos/cosmos-sdk/x/auth/types"
 	"github.com/ethereum/go-ethereum/common"
+	"github.com/ethereum/go-ethereum/crypto"
 	abci "github.com/tendermint/tendermint/abci/types"
 
 	ethermint "github.com/tharsis/ethermint/types"
@@ -39,7 +41,7 @@ func InitGenesis(
 			panic(fmt.Errorf("account not found for address %s", account.Address))
 		}
 
-		_, ok := acc.(*ethermint.EthAccount)
+		ethAcct, ok := acc.(*ethermint.EthAccount)
 		if !ok {
 			panic(
 				fmt.Errorf("account %s must be an %T type, got %T",
@@ -48,7 +50,12 @@ func InitGenesis(
 			)
 		}
 
-		k.SetCode(address, common.Hex2Bytes(account.Code))
+		code := common.Hex2Bytes(account.Code)
+		codeHash := crypto.Keccak256Hash(code)
+		if !bytes.Equal(common.HexToHash(ethAcct.CodeHash).Bytes(), codeHash.Bytes()) {
+			panic("code don't match codeHash")
+		}
+		k.SetCode(address, code)
 
 		for _, storage := range account.Storage {
 			k.SetState(address, common.HexToHash(storage.Key), common.HexToHash(storage.Value))
diff --git a/x/evm/genesis_test.go b/x/evm/genesis_test.go
index 12dfbdc15c..e4506552d9 100644
--- a/x/evm/genesis_test.go
+++ b/x/evm/genesis_test.go
@@ -80,6 +80,23 @@ func (suite *EvmTestSuite) TestInitGenesis() {
 			},
 			true,
 		},
+		{
+			"invalid code hash",
+			func() {
+				acc := suite.app.AccountKeeper.NewAccountWithAddress(suite.ctx, address.Bytes())
+				suite.app.AccountKeeper.SetAccount(suite.ctx, acc)
+			},
+			&types.GenesisState{
+				Params: types.DefaultParams(),
+				Accounts: []types.GenesisAccount{
+					{
+						Address: address.String(),
+						Code:    "ffffffff",
+					},
+				},
+			},
+			true,
+		},
 	}
 
 	for _, tc := range testCases {

From 225430b9902b21eec0b1d995f8726faae3e0d574 Mon Sep 17 00:00:00 2001
From: HuangYi <huang@crypto.com>
Date: Tue, 4 Jan 2022 21:15:11 +0800
Subject: [PATCH 2/2] changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 80b6adc4d5..68a2e2611e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -59,6 +59,7 @@ Ref: https://keepachangelog.com/en/1.0.0/
 * (evm) [tharsis#826](https://github.com/tharsis/ethermint/issues/826) Improve allocation of bytes of `tx.To` address.
 * (evm) [tharsis#827](https://github.com/tharsis/ethermint/issues/827) Speed up creation of event logs by using the slice insertion idiom with indices.
 * (ante) [tharsis#819](https://github.com/tharsis/ethermint/pull/819) remove redundant ante handlers
+* (app) [tharsis#873](https://github.com/tharsis/ethermint/pull/873) Validate code hash in GenesisAccount
 
 ### Bug Fixes