Skip to content

Cosmos SDK / fork security v0.2.18 #1821

Open @tcharchian opened 2026-09-22 02:35 UTC 1 comment Updated 2026-10-27 19:26 UTC
Priority: High release-candidate

Cosmos SDK fork security for v0.2.18. Nothing huge: targeted fork patches first, full rebase only if it stays in scope.

Chain-halt fixes can ship on the current v0.53.3-ps19 fork without waiting for v0.53.8. The rebase is a second, state-breaking step and needs its own test pass.

Needs thorough testing before merge.

Sub-issues

  • 1708 chain-halt: ValidatorByConsAddr returns ErrNoValidatorFound (gonka-ai/cosmos-sdk#19)

  • 1205 chain-halt: markValidatorForDeletion jailed-delete race (gonka-ai/cosmos-sdk#16)

  • 1719 ECIES: restore curve validation, reject short ciphertexts (gonka-ai/cosmos-sdk#20)

  • 1671 rebase fork onto upstream v0.53.8

  • gonka-ai/cosmos-sdk#14 stale consensus-key conflicts
  • gonka-ai/cosmos-sdk#17 skip tombstoned validators in epoch recompute
  • gonka-ai/cosmos-sdk#10 snapshot chunk deletion during state sync (see also #632)

💬 Comments (1)

@redstartechno commented 2026-09-24 21:50 UTC

Local test pass over the fork PRs listed here, since the fork's own CI doesn't run them (every job on outside PRs sits action_required/cancelled, and most jobs were cancelled on #18 too). Environment: WSL, go1.24.2, gonka-ai/cosmos-sdk release/v0.53.x @ c8229ef61 (= v0.53.3-ps19-observability, the tag inference-chain pins). Details are in each PR:

  • gonka-ai/cosmos-sdk#19 (ValidatorByConsAddr → (nil, nil)): its tests fail on the base and pass on the PR. The evidence path is fixed. The slashing path still returns ErrNoValidatorFound one call earlier, via IsValidatorJailed in HandleValidatorSignature (integration test in the PR comment).
  • gonka-ai/cosmos-sdk#16 (markValidatorForDeletion): both tests fail on the base and pass on the PR. A multi-block run shows the removed validator stays resolvable for at least 5 EndBlocks, so there's no early deletion inside CometBFT's update lag.
  • gonka-ai/cosmos-sdk#14 (stale consensus keys): all 9 added tests pass. Per the simulation sweep in that thread, it should land with or after #19.
  • gonka-ai/cosmos-sdk#17 (tombstoned validators): its test passes. It's inert until the SetTombstoneChecker(app.SlashingKeeper.IsTombstoned) wiring lands in inference-chain/app.
  • gonka-ai/cosmos-sdk#10 (snapshot pruning): it protects a single in-flight chunk read, but not the gap between two chunk requests of one transfer, which is the #632 failure (probe test in the comment). It also needs a new store/v1.1.2-psN tag to reach inference-chain.

The chain-halt set composes: #14, #16, #17 and #19 merge cleanly together. On the combined branch, all of their own tests pass. The full root module (x/..., baseapp, types) plus tests/integration/... fails exactly the same tests as release/v0.53.x alone. The one extra failure in the first run, x/distribution/simulation TestSimulateMsgWithdrawValidatorCommission, flakes 2/5 on the base as well.

One thing that limits "thorough testing" of anything in the fork: release/v0.53.x itself fails 69 top-level tests (72 subtests) across 18 packages: - x/{bank,distribution,gov,slashing,staking} (keeper and simulation), types, types/bech32/legacybech32 - tests/integration/{distribution,evidence,gov,slashing,staking}

The failures I traced are stock-SDK expectations of paths the fork disabled on purpose: MsgDelegate/MsgUndelegate/MsgBeginRedelegate/MsgCancelUnbondingDelegation return "is disabled", RemoveValidatorTokensAndShares is disabled after genesis in Proof of Compute mode, and the no-op bank keeper leaves balances untouched. I haven't classified all 69, and types/legacybech32 in particular I didn't look into. In this state the unit suites can't flag a regression, because every package that matters is already red.

If it's useful, I can open a test-only PR against release/v0.53.x that marks the by-design divergences with t.Skip and a one-line reason each, and lists anything that doesn't fit that pattern for someone to look at. That would make a green baseline to test fork patches against. Happy to take a different approach if you'd rather delete those tests or keep them as they are.

🔄 Auto-synced from Issue #1821 every hour.