From 4e4e388a27aa3a1290e620d28bf022c60badc724 Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 14:48:59 +0200 Subject: [PATCH 01/11] Remove challange after it was used --- seed-service/src/main.rs | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/seed-service/src/main.rs b/seed-service/src/main.rs index 351625c75..4a3e9777e 100644 --- a/seed-service/src/main.rs +++ b/seed-service/src/main.rs @@ -229,11 +229,12 @@ fn validate_attestation_report(cert: String) -> Result { return Err("Got response when no challenge sent".to_string()); } @@ -243,6 +244,8 @@ fn validate_attestation_report(cert: String) -> Result Date: Wed, 18 Jan 2023 15:00:05 +0200 Subject: [PATCH 02/11] Update secretjs --- deployment/ci/query-load-test/package.json | 2 +- integration-tests/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deployment/ci/query-load-test/package.json b/deployment/ci/query-load-test/package.json index 87bd7dd9e..f657ac930 100644 --- a/deployment/ci/query-load-test/package.json +++ b/deployment/ci/query-load-test/package.json @@ -3,7 +3,7 @@ "devDependencies": { "@types/node": "^17.0.23", "axios": "^0.26.1", - "secretjs": "1.5.0-beta.1", + "secretjs": "1.7.0-beta.0", "typescript": "^4.6.3" }, "dependencies": { diff --git a/integration-tests/package.json b/integration-tests/package.json index d74249352..327313ffa 100644 --- a/integration-tests/package.json +++ b/integration-tests/package.json @@ -11,7 +11,7 @@ "@types/node": "18.7.9", "jest": "28.1.3", "prettier": "2.7.1", - "secretjs": "^1.6.8", + "secretjs": "1.7.0.beta.0", "ts-jest": "28.0.8", "ts-node": "10.9.1", "typescript": "4.7.4" From 395d8b336812bdf590cc1b8fa7b2a8cf2f49aaa1 Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 15:00:14 +0200 Subject: [PATCH 03/11] Fix production --- .../enclaves/execute/src/registration/attestation.rs | 11 ++++++++--- cosmwasm/enclaves/execute/src/registration/cert.rs | 3 --- .../enclaves/execute/src/registration/offchain.rs | 2 +- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/cosmwasm/enclaves/execute/src/registration/attestation.rs b/cosmwasm/enclaves/execute/src/registration/attestation.rs index 8a231331d..efd6d173f 100644 --- a/cosmwasm/enclaves/execute/src/registration/attestation.rs +++ b/cosmwasm/enclaves/execute/src/registration/attestation.rs @@ -153,17 +153,22 @@ pub fn create_attestation_certificate( pub fn validate_report(cert: &[u8], _override_verify: Option) { let _ = verify_ra_cert(cert, None).map_err(|e| { info!("Error validating created certificate: {:?}", e); - let _ = SgxFsRemove(CONSENSUS_SEED_SEALING_PATH.as_str()); + let _ = SgxFsRemove(GENESIS_CONSENSUS_SEED_SEALING_PATH.as_str()); let _ = SgxFsRemove(CURRENT_CONSENSUS_SEED_SEALING_PATH.as_str()); let _ = SgxFsRemove(REGISTRATION_KEY_SEALING_PATH.as_str()); let _ = SgxFsRemove( std::path::Path::new(DEFAULT_SGX_SECRET_PATH) - .join(NODE_ENCRYPTED_SEED_KEY_FILE) + .join(NODE_ENCRYPTED_SEED_KEY_GENESIS_FILE) .as_path(), ); let _ = SgxFsRemove( std::path::Path::new(DEFAULT_SGX_SECRET_PATH) - .join() + .join(NODE_ENCRYPTED_SEED_KEY_CURRENT_FILE) + .as_path(), + ); + let _ = SgxFsRemove( + std::path::Path::new(DEFAULT_SGX_SECRET_PATH) + .join(NODE_EXCHANGE_KEY_FILE) .as_path(), ); }); diff --git a/cosmwasm/enclaves/execute/src/registration/cert.rs b/cosmwasm/enclaves/execute/src/registration/cert.rs index 5b1d0901e..e4e9ca5f2 100644 --- a/cosmwasm/enclaves/execute/src/registration/cert.rs +++ b/cosmwasm/enclaves/execute/src/registration/cert.rs @@ -12,9 +12,6 @@ use sgx_types::{ sgx_update_info_bit_t, SgxResult, }; -#[cfg(feature = "SGX_MODE_HW")] -use log::*; - use std::io::BufReader; use std::str; use std::time::{SystemTime, UNIX_EPOCH}; diff --git a/cosmwasm/enclaves/execute/src/registration/offchain.rs b/cosmwasm/enclaves/execute/src/registration/offchain.rs index 67fddb97b..64f105daf 100644 --- a/cosmwasm/enclaves/execute/src/registration/offchain.rs +++ b/cosmwasm/enclaves/execute/src/registration/offchain.rs @@ -4,7 +4,7 @@ /// use log::*; use sgx_types::sgx_status_t; -#[cfg(feature = "SGX_MODE_HW")] +#[cfg(all(feature = "SGX_MODE_HW", not(feature = "production")))] use sgx_types::{sgx_platform_info_t, sgx_update_info_bit_t}; use std::slice; From fdb9f21974a04fe2438bcf7a98f5b481096408df Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 15:04:01 +0200 Subject: [PATCH 04/11] update --- docs/test-v1.7-upgrade-handler.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/docs/test-v1.7-upgrade-handler.md b/docs/test-v1.7-upgrade-handler.md index 1995872df..b8036093b 100644 --- a/docs/test-v1.7-upgrade-handler.md +++ b/docs/test-v1.7-upgrade-handler.md @@ -191,9 +191,3 @@ secretd query compute query secret18vd8fpwxzck93qlwghaj6arh4p7c5n8978vsyg '{"get Expected result should be: {"get":{"count":23}} - -## Step 7 - -Test that now cw20-ics20 is working: - -TODO From 985427e026c1cbec8eab3e2139e9febb14dda859 Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 15:18:08 +0200 Subject: [PATCH 05/11] Fix --- cosmwasm/enclaves/execute/src/registration/offchain.rs | 2 -- deployment/dockerfiles/Dockerfile | 2 +- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/cosmwasm/enclaves/execute/src/registration/offchain.rs b/cosmwasm/enclaves/execute/src/registration/offchain.rs index 64f105daf..a60acee96 100644 --- a/cosmwasm/enclaves/execute/src/registration/offchain.rs +++ b/cosmwasm/enclaves/execute/src/registration/offchain.rs @@ -4,8 +4,6 @@ /// use log::*; use sgx_types::sgx_status_t; -#[cfg(all(feature = "SGX_MODE_HW", not(feature = "production")))] -use sgx_types::{sgx_platform_info_t, sgx_update_info_bit_t}; use std::slice; use enclave_crypto::consts::{ diff --git a/deployment/dockerfiles/Dockerfile b/deployment/dockerfiles/Dockerfile index 376330fa2..7a7f8c52e 100644 --- a/deployment/dockerfiles/Dockerfile +++ b/deployment/dockerfiles/Dockerfile @@ -141,7 +141,7 @@ RUN . /opt/sgxsdk/environment && env && VERSION=${VERSION} FEATURES=${FEATURES} FROM $SCRT_RELEASE_BASE_IMAGE as release-image # wasmi-sgx-test script requirements -RUN apt-get update && \ck fixes available +RUN apt-get update && \ apt-get install -y --no-install-recommends \ #### Base utilities #### jq \ From 7d5043592e7a4f80a62c49e5c10a5f63d3ddfa29 Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 16:34:02 +0200 Subject: [PATCH 06/11] Fix secretjs --- deployment/ci/query-load-test/package.json | 2 +- integration-tests/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deployment/ci/query-load-test/package.json b/deployment/ci/query-load-test/package.json index f657ac930..4161543cd 100644 --- a/deployment/ci/query-load-test/package.json +++ b/deployment/ci/query-load-test/package.json @@ -3,7 +3,7 @@ "devDependencies": { "@types/node": "^17.0.23", "axios": "^0.26.1", - "secretjs": "1.7.0-beta.0", + "secretjs": "1.7.1-beta.0", "typescript": "^4.6.3" }, "dependencies": { diff --git a/integration-tests/package.json b/integration-tests/package.json index 327313ffa..3e29c3df3 100644 --- a/integration-tests/package.json +++ b/integration-tests/package.json @@ -11,7 +11,7 @@ "@types/node": "18.7.9", "jest": "28.1.3", "prettier": "2.7.1", - "secretjs": "1.7.0.beta.0", + "secretjs": "1.7.1-beta.0", "ts-jest": "28.0.8", "ts-node": "10.9.1", "typescript": "4.7.4" From d78c43aef3c3cc6555043b145080c8f4dc467e6e Mon Sep 17 00:00:00 2001 From: Lior Bondarevski Date: Wed, 18 Jan 2023 17:15:22 +0200 Subject: [PATCH 07/11] Remove unneeded test --- .github/workflows/ci.yaml | 12 ------------ 1 file changed, 12 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 84be7bac6..9c9dc65bd 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -348,15 +348,3 @@ jobs: run: | chmod +x ./scripts/install-wasm-tools.sh ./scripts/install-wasm-tools.sh - - name: Run cw20-ics20 tests - run: | - git clone --depth 1 --branch secret https://github.com/scrtlabs/cw-plus - cd cw-plus/contracts/cw20-ics20 - # Use the docker images that we built just a few steps above - perl -i -pe 's/localsecret:.+?"/localsecret:v0.0.0"/' ./test/docker-compose.yml - docker compose -f ./test/docker-compose.yml up -d - rustup target add wasm32-unknown-unknown - wget -O - 'https://github.com/WebAssembly/binaryen/releases/download/version_110/binaryen-version_110-x86_64-linux.tar.gz' | tar -xzf - - sudo cp binaryen-version_110/bin/wasm-opt /bin/wasm-opt - sudo chmod +x /bin/wasm-opt - make test From 69d21872f39b7f3572264f5bd64c972fae9f49fd Mon Sep 17 00:00:00 2001 From: Ilya Raykker Date: Wed, 21 Aug 2024 19:30:45 +0400 Subject: [PATCH 08/11] Apply wasmd patch --- x/compute/internal/keeper/handler_plugin.go | 15 ++++++++++++++ x/compute/internal/keeper/keeper.go | 22 +++++++++++++++++++++ x/compute/internal/types/context.go | 16 +++++++++++++++ x/compute/internal/types/errors.go | 3 +++ x/compute/internal/types/types.go | 1 + 5 files changed, 57 insertions(+) create mode 100644 x/compute/internal/types/context.go diff --git a/x/compute/internal/keeper/handler_plugin.go b/x/compute/internal/keeper/handler_plugin.go index 1464f9950..1f1e06694 100644 --- a/x/compute/internal/keeper/handler_plugin.go +++ b/x/compute/internal/keeper/handler_plugin.go @@ -634,6 +634,21 @@ func (h SDKMessageHandler) handleSdkMessage(ctx sdk.Context, contractAddr sdk.Ad return nil, sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, "can't route message %+v", msg) } +// callDepthMessageHandler is a wrapper around a Messenger that checks the call depth before dispatching a message. +type callDepthMessageHandler struct { + Messenger + MaxCallDepth uint32 +} + +func (h callDepthMessageHandler) DispatchMsg(ctx sdk.Context, contractAddr sdk.AccAddress, contractIBCPortID string, msg v1wasmTypes.CosmosMsg) (events []sdk.Event, data [][]byte, err error) { + ctx, err = checkAndIncreaseCallDepth(ctx, h.MaxCallDepth) + if err != nil { + return nil, nil, err + } + + return h.Messenger.DispatchMsg(ctx, contractAddr, contractIBCPortID, msg) +} + // convertWasmIBCTimeoutHeightToCosmosHeight converts a wasm type ibc timeout height to ibc module type height func convertWasmIBCTimeoutHeightToCosmosHeight(ibcTimeoutBlock *v1wasmTypes.IBCTimeoutBlock) ibcclienttypes.Height { if ibcTimeoutBlock == nil { diff --git a/x/compute/internal/keeper/keeper.go b/x/compute/internal/keeper/keeper.go index 41dc451c3..812b223b0 100644 --- a/x/compute/internal/keeper/keeper.go +++ b/x/compute/internal/keeper/keeper.go @@ -79,6 +79,7 @@ type Keeper struct { messenger Messenger // queryGasLimit is the max wasm gas that can be spent on executing a query with a contract queryGasLimit uint64 + maxCallDepth uint32 HomeDir string // authZPolicy AuthorizationPolicy // paramSpace subspace.Subspace @@ -144,9 +145,12 @@ func NewKeeper( cdc, ), queryGasLimit: wasmConfig.SmartQueryGasLimit, + maxCallDepth: types.DefaultMaxCallDepth, HomeDir: homeDir, LastMsgManager: lastMsgManager, } + // always wrap the messenger, even if it was replaced by an option + keeper.messenger = callDepthMessageHandler{keeper.messenger, keeper.maxCallDepth} keeper.queryPlugins = DefaultQueryPlugins(govKeeper, distKeeper, mintKeeper, bankKeeper, stakingKeeper, queryRouter, &keeper, channelKeeper).Merge(customPlugins) return keeper @@ -754,6 +758,24 @@ func (k Keeper) querySmartImpl(ctx sdk.Context, contractAddress sdk.AccAddress, return queryResult, nil } +func checkAndIncreaseCallDepth(ctx sdk.Context, maxCallDepth uint32) (sdk.Context, error) { + var callDepth uint32 + if size, ok := types.CallDepth(ctx); ok { + callDepth = size + } + + // increase + callDepth++ + + // did we go too far? + if callDepth > maxCallDepth { + return sdk.Context{}, types.ErrExceedMaxCallDepth + } + + // set updated stack size + return types.WithCallDepth(ctx, callDepth), nil +} + // We don't use this function since we have an encrypted state. It's here for upstream compatibility // QueryRaw returns the contract's state for give key. For a `nil` key a empty slice result is returned. func (k Keeper) QueryRaw(ctx sdk.Context, contractAddress sdk.AccAddress, key []byte) []types.Model { diff --git a/x/compute/internal/types/context.go b/x/compute/internal/types/context.go new file mode 100644 index 000000000..5443610aa --- /dev/null +++ b/x/compute/internal/types/context.go @@ -0,0 +1,16 @@ +package types + +import ( + sdk "github.com/cosmos/cosmos-sdk/types" +) + +const contextKeyCallDepth contextKey = iota + +func WithCallDepth(ctx sdk.Context, counter uint32) sdk.Context { + return ctx.WithValue(contextKeyCallDepth, counter) +} + +func CallDepth(ctx sdk.Context) (uint32, bool) { + val, ok := ctx.Value(contextKeyCallDepth).(uint32) + return val, ok +} diff --git a/x/compute/internal/types/errors.go b/x/compute/internal/types/errors.go index f3a41735b..66f3ce843 100644 --- a/x/compute/internal/types/errors.go +++ b/x/compute/internal/types/errors.go @@ -72,6 +72,9 @@ var ( // ErrMaxIBCChannels error for maximum number of ibc channels reached ErrMaxIBCChannels = sdkErrors.Register(DefaultCodespace, 22, "max transfer channels") + + // ErrExceedMaxCallDepth error if max message stack size is exceeded + ErrExceedMaxCallDepth = sdkErrors.Register(DefaultCodespace, 30, "max call depth exceeded") ) func IsEncryptedErrorCode(code uint32) bool { diff --git a/x/compute/internal/types/types.go b/x/compute/internal/types/types.go index 94d169577..298455fa3 100644 --- a/x/compute/internal/types/types.go +++ b/x/compute/internal/types/types.go @@ -17,6 +17,7 @@ import ( ) const ( + DefaultMaxCallDepth = uint32(500) defaultLRUCacheSize = uint64(0) defaultEnclaveLRUCacheSize = uint16(100) defaultQueryGasLimit = uint64(10_000_000) From 418feb960aef76bae4d1940dcdee74bf3c570ef3 Mon Sep 17 00:00:00 2001 From: Ilya Raykker Date: Mon, 26 Aug 2024 13:14:27 +0400 Subject: [PATCH 09/11] Update CHANGELOG for v1.14 --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5a60b4264..2fa15b1e7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,10 @@ # CHANGELOG +# 1.14.0 + +- Fix CWA-2024-005 +- Bump ledger-cosmos-go from v0.12.2 to v0.12.4 + # 1.13.0 - Support DCAP attestation From 13cd4c2d2aca20dba664daec90c873709e17b193 Mon Sep 17 00:00:00 2001 From: Ilya Raykker Date: Mon, 26 Aug 2024 13:16:01 +0400 Subject: [PATCH 10/11] Add v1.14 upgrade handler --- app/app.go | 2 ++ app/upgrades/v1.14/upgrade.go | 36 +++++++++++++++++++++++++++++++++++ 2 files changed, 38 insertions(+) create mode 100644 app/upgrades/v1.14/upgrade.go diff --git a/app/app.go b/app/app.go index e4cc36d9b..294abcfed 100644 --- a/app/app.go +++ b/app/app.go @@ -36,6 +36,7 @@ import ( v1_11 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.11" v1_12 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.12" v1_13 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.13" + v1_14 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.14" v1_3 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.3" v1_4 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.4" v1_5 "github.com/scrtlabs/SecretNetwork/app/upgrades/v1.5" @@ -109,6 +110,7 @@ var ( v1_11.Upgrade, v1_12.Upgrade, v1_13.Upgrade, + v1_14.Upgrade, } ) diff --git a/app/upgrades/v1.14/upgrade.go b/app/upgrades/v1.14/upgrade.go new file mode 100644 index 000000000..9c6847123 --- /dev/null +++ b/app/upgrades/v1.14/upgrade.go @@ -0,0 +1,36 @@ +package v1_14 + +import ( + "fmt" + + store "github.com/cosmos/cosmos-sdk/store/types" + sdk "github.com/cosmos/cosmos-sdk/types" + "github.com/cosmos/cosmos-sdk/types/module" + upgradetypes "github.com/cosmos/cosmos-sdk/x/upgrade/types" + "github.com/scrtlabs/SecretNetwork/app/keepers" + "github.com/scrtlabs/SecretNetwork/app/upgrades" +) + +const upgradeName = "v1.14" + +var Upgrade = upgrades.Upgrade{ + UpgradeName: upgradeName, + CreateUpgradeHandler: createUpgradeHandler, + StoreUpgrades: store.StoreUpgrades{}, +} + +func createUpgradeHandler(mm *module.Manager, _ *keepers.SecretAppKeepers, configurator module.Configurator, +) upgradetypes.UpgradeHandler { + return func(ctx sdk.Context, _ upgradetypes.Plan, vm module.VersionMap) (module.VersionMap, error) { + ctx.Logger().Info(` _ _ _____ _____ _____ _____ ______ `) + ctx.Logger().Info(`| | | | __ \ / ____| __ \ /\ | __ \| ____|`) + ctx.Logger().Info(`| | | | |__) | | __| |__) | / \ | | | | |__ `) + ctx.Logger().Info(`| | | | ___/| | |_ | _ / / /\ \ | | | | __| `) + ctx.Logger().Info(`| |__| | | | |__| | | \ \ / ____ \| |__| | |____ `) + ctx.Logger().Info(` \____/|_| \_____|_| \_\/_/ \_\_____/|______|`) + + ctx.Logger().Info(fmt.Sprintf("Running module migrations for %s...", upgradeName)) + + return mm.RunMigrations(ctx, configurator, vm) + } +} From 823c07ffbbeb9347691f138a4f154705e6b6f082 Mon Sep 17 00:00:00 2001 From: Ilya Raykker Date: Mon, 26 Aug 2024 13:18:06 +0400 Subject: [PATCH 11/11] Update swagger and openapi docs --- client/docs/config.json | 2 +- client/docs/static/openapi/index.html | 4 ++-- client/docs/static/openapi/openapi.yaml | 2 +- client/docs/static/swagger/swagger.yaml | 2 +- client/docs/statik/statik.go | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/client/docs/config.json b/client/docs/config.json index 13701dd8f..2353ad9a3 100644 --- a/client/docs/config.json +++ b/client/docs/config.json @@ -3,7 +3,7 @@ "info": { "title": "Secret Network", "description": "A REST interface for queries and transactions", - "version": "v1.12" + "version": "v1.14" }, "apis": [ { diff --git a/client/docs/static/openapi/index.html b/client/docs/static/openapi/index.html index a17f966de..37f6d72a2 100644 --- a/client/docs/static/openapi/index.html +++ b/client/docs/static/openapi/index.html @@ -2146,7 +2146,7 @@ 55.627 l 55.6165,55.627 -231.245496,231.24803 c -127.185,127.1864 -231.5279,231.248 -231.873,231.248 -0.3451,0 -104.688, -104.0616 -231.873,-231.248 z - " fill="currentColor">

Secret Network (v1.12)

Download OpenAPI specification:Download

A REST interface for queries and transactions

+ " fill="currentColor">

Secret Network (v1.14)

Download OpenAPI specification:Download

A REST interface for queries and transactions

Authentication

kms

Security Scheme Type HTTP
HTTP Authorization Scheme basic

gRPC Gateway API

Accounts returns all the existing accounts

Since: cosmos-sdk 0.43

query Parameters
pagination.key
string <byte>

key is a value returned in PageResponse.next_key to begin querying the next page most efficiently. Only one of offset or key @@ -3510,7 +3510,7 @@