fix: fix reentrancy

icon-project · Aug 5, 2024 · ff682a3 · ff682a3
1 parent c277c32
commit ff682a3
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 6 deletions.
diff --git a/contracts/cosmwasm-vm/cw-ibc-core/src/ics04_channel/packet/timeout_on_close.rs b/contracts/cosmwasm-vm/cw-ibc-core/src/ics04_channel/packet/timeout_on_close.rs
@@ -51,6 +51,7 @@ impl<'a> CwIbcCoreContext<'a> {
         let next_sequence_recv = Sequence::from(msg.next_sequence_recv);
 
         let mut channel_end = self.get_channel_end(deps.storage, &src_port, &src_channel)?;
+
         let counterparty = Counterparty::new(dst_port.clone(), Some(dst_channel.clone()));
         if !channel_end.counterparty_matches(&counterparty) {
             return Err(ContractError::IbcPacketError {
@@ -186,6 +187,12 @@ impl<'a> CwIbcCoreContext<'a> {
         let timeoutblock = to_ibc_timeout_block(&packet_timeout_height);
         let timeout = CwTimeout::with_block(timeoutblock);
         let ibc_packet = CwPacket::new(data, src, dest, packet.sequence, timeout);
+        self.delete_packet_commitment(
+            deps.storage,
+            &src_port,
+            &src_channel,
+            packet.sequence.into(),
+        )?;
 
         let address = to_checked_address(deps.as_ref(), &msg.signer);
         let cosm_msg = cw_common::xcall_connection_msg::ExecuteMsg::IbcPacketTimeout {

diff --git a/contracts/javascore/ibc/src/main/java/ibc/ics25/handler/IBCHandlerPacket.java b/contracts/javascore/ibc/src/main/java/ibc/ics25/handler/IBCHandlerPacket.java
@@ -55,8 +55,9 @@ public void recvPacket(MsgPacketRecv msg) {
         IIBCModule module = lookupModuleByChannel(packet.getDestinationPort(),
                 packet.getDestinationChannel());
 
-        byte[] acknowledgement = module.onRecvPacket(msg.getPacket(), Context.getCaller());
+
         _recvPacket(packet, msg.getProof(), msg.getProofHeight());
+        byte[] acknowledgement = module.onRecvPacket(msg.getPacket(), Context.getCaller());
 
         if (acknowledgement != null && acknowledgement.length > 0) {
             _writeAcknowledgement(
@@ -93,10 +94,9 @@ public void writeAcknowledgement(
     public void acknowledgePacket(MsgPacketAcknowledgement msg) {
         Packet packet = Packet.decode(msg.getPacket());
         IIBCModule module = lookupModuleByChannel(packet.getSourcePort(), packet.getSourceChannel());
-
-        module.onAcknowledgementPacket(msg.getPacket(), msg.getAcknowledgement(),
-                Context.getCaller());
         _acknowledgePacket(packet, msg.getAcknowledgement(), msg.getProof(), msg.getProofHeight());
+        module.onAcknowledgementPacket(msg.getPacket(), msg.getAcknowledgement(),
+        Context.getCaller());
 
         AcknowledgePacket(msg.getPacket(), msg.getAcknowledgement());
     }
@@ -112,9 +112,8 @@ public void requestTimeout(MsgRequestTimeoutPacket msg) {
     public void timeoutPacket(MsgPacketTimeout msg) {
         Packet packet = Packet.decode(msg.getPacket());
         IIBCModule module = lookupModuleByChannel(packet.getSourcePort(), packet.getSourceChannel());
-        module.onTimeoutPacket(msg.getPacket(), Context.getCaller());
         _timeoutPacket(packet, msg.getProofHeight(), msg.getProof(), msg.getNextSequenceRecv());
-
+        module.onTimeoutPacket(msg.getPacket(), Context.getCaller());
         PacketTimeout(msg.getPacket());
     }
 }