fix: add 08-22-2026 fixes

CHANGELOG.md

@@ -2,11 +2,49 @@
 
 ## Unreleased
 
+### Fixed
+
+- Reject `MsgCreateVestingAccount`, `MsgCreatePeriodicVestingAccount`, and `MsgCreatePermanentLockedAccount` in the Cosmos ante (top-level and nested in `authz.MsgExec`) so new vesting / locked accounts cannot be opened after the v7.3.2 upgrade
+- Enable a bank `SendRestriction` for the 22 Aug 2026 incident addresses in the `v7.4.0` upgrade (after fund recovery) so Cosmos, precompile, and EVM native transfers cannot send from or to them after the upgrade height
+
+
+
+### Dependencies
+
+- Bump EVM fork to `v0.6.2-fork.1`, applied via the coordinated `v7.3.2` upgrade (private Cosmos EVM security hotfix; cannot build from public source until 2026-08-28)
+- Bump EVM fork to `v0.6.2-fork.2`
+
+## v7.3.1 - 2026-08-06
+
+### Fixed
+
+- Keep the gov module account on the bank blocked list so EVM BalanceHandler does not mirror gov deposits into StateDB (fixes Safe → gov precompile `deposit` failing on commit with `unauthorized`) ([#368](https://github.com/KiiChain/kiichain/pull/368))
+
+## v7.3.0 - 2026-07-28
+
 ### Dependencies
 
 - [EVM](https://github.com/KiiChain/evm) fork from v0.6.0-fork.1 to [v0.6.0-fork.2](https://github.com/KiiChain/evm/releases/tag/v0.6.0-fork.2): bounded internal EVM call gas limit, EVM fee refunds, distribution precompile 32-byte withdraw fix, and CosmWasm EVM query undercharge fix
 - [EVM](https://github.com/KiiChain/evm) fork bump from `v0.6.0-fork.2` to [v0.6.1-fork.1](https://github.com/KiiChain/evm/releases/tag/v0.6.1-fork.1), applied via the coordinated `v7.3.0` upgrade: the July 2026 Cosmos EVM hotfix (precompile gas accounting alignment and StateDB locked-balance snapshotting), published upstream as [cosmos/evm v0.6.1](https://github.com/cosmos/evm/releases/tag/v0.6.1)
 
+### Fixed
+
+- Close an expedited-governance whitelist bypass in `GovExpeditedProposalsDecorator` where the check only inspected top-level messages: a non-whitelisted `MsgSubmitProposal` wrapped in `authz.MsgExec` could enter the expedited voting path. The decorator now recurses into `authz.MsgExec` (including nested execs) and applies the expedited whitelist validation to wrapped proposals ([#353](https://github.com/KiiChain/kiichain/pull/353))
+- Compute the oracle ballot `StandardDeviation` as a stake-weighted variance (weight each squared deviation by the vote's power and divide by total voting power) instead of an unweighted average divided by the vote count, aligning the reward-band width with the stake-weighted median and preventing a group of low-stake validators from inflating the deviation to widen the accepted vote window ([#354](https://github.com/KiiChain/kiichain/pull/354))
+- Close an oracle slashing bypass in the `EndBlocker` where validators were scored against the post-filtered `voteTargets` map: a denom that received votes but was pushed below the vote threshold (e.g. by a coordinated group abstaining) was dropped from the scoring denominator, letting the abstainers avoid miss penalties. Participation is now scored against the configured targets that received votes (passing targets plus below-threshold targets), crediting validators that voted on a below-threshold target while counting abstention on it as a miss; targets that received no votes at all are still excluded so a legitimately unpriceable denom cannot mass-slash the validator set ([#352](https://github.com/KiiChain/kiichain/pull/352))
+- Allow EIP-7702 delegated EOAs to send direct EVM transactions by exempting delegation-designator code from the externally-owned-account-only check in `VerifyIfAccountExists`, so accounts that delegate via `SetCodeTx` can still manage (and revoke) their own delegation without a sponsored transaction ([#350](https://github.com/KiiChain/kiichain/pull/350))
+- Remove the forced minimum 1-unit-per-block reward release in `CalculateReward` and skip (instead of deactivating) sub-unit blocks in the rewards `BeginBlocker`, so the proportional share accumulates and the pool follows the configured schedule independent of block time ([#347](https://github.com/KiiChain/kiichain/pull/347))
+- Reject `MsgEthereumTx` from being dispatched through the authz keeper (including when nested inside `authz.MsgExec`), closing an EVM ante bypass on message-router execution paths that skip the ante handler ([#342](https://github.com/KiiChain/kiichain/pull/342))
+- Fix feegrant denomination bypass in the cosmos fee ante handler by converting the fee before consuming the grant, so `UseGrantedFees` is checked against the same coins later deducted ([#343](https://github.com/KiiChain/kiichain/pull/343))
+- Bound tokenfactory denom metadata size (`MaxDenomMetadataSize`) in `MsgSetDenomMetadata.ValidateBasic` and `msgServer.SetDenomMetadata` to prevent oversized metadata rewrites from forcing unbounded native store writes ([#341](https://github.com/KiiChain/kiichain/pull/341))
+- Fix native token supply inflation from the stateful precompiles by wrapping the account address codec (`evmAddressCodec`) to reject non-20-byte accounts at decode time ([#340](https://github.com/KiiChain/kiichain/pull/340))
+- Close governance vote minimum-stake bypass in `GovVoteDecorator` by enforcing the stake check on `MsgVoteWeighted` and recursing into nested `authz.MsgExec` messages ([#344](https://github.com/KiiChain/kiichain/pull/344))
+- Prevent a chain halt in the rewards `BeginBlocker` by routing `SendCoinsFromModuleToModule` failures through `haltSchedule` instead of returning a fatal error ([#346](https://github.com/KiiChain/kiichain/pull/346))
+- Add a `ValidateModuleAccounting` check (rewards module bank balance must cover the `CommunityPool`) and run it at genesis
+- Fix CosmWasm EVM query path repeatable undercharged EVM execution ([#345](https://github.com/KiiChain/kiichain/pull/345))
+
+## v7.2.0 - 2026-04-16
+
 ### Added
 
 - Emit `update_params`, `fund_pool`, `change_schedule`, and `reward_distributed` events from x/rewards
@@ -16,16 +54,9 @@
 
 ### Fixed
 
-- Close an expedited-governance whitelist bypass in `GovExpeditedProposalsDecorator` where the check only inspected top-level messages: a non-whitelisted `MsgSubmitProposal` wrapped in `authz.MsgExec` could enter the expedited voting path. The decorator now recurses into `authz.MsgExec` (including nested execs) and applies the expedited whitelist validation to wrapped proposals
-- Compute the oracle ballot `StandardDeviation` as a stake-weighted variance (weight each squared deviation by the vote's power and divide by total voting power) instead of an unweighted average divided by the vote count, aligning the reward-band width with the stake-weighted median and preventing a group of low-stake validators from inflating the deviation to widen the accepted vote window
-- Close an oracle slashing bypass in the `EndBlocker` where validators were scored against the post-filtered `voteTargets` map: a denom that received votes but was pushed below the vote threshold (e.g. by a coordinated group abstaining) was dropped from the scoring denominator, letting the abstainers avoid miss penalties. Participation is now scored against the configured targets that received votes (passing targets plus below-threshold targets), crediting validators that voted on a below-threshold target while counting abstention on it as a miss; targets that received no votes at all are still excluded so a legitimately unpriceable denom cannot mass-slash the validator set
-- Allow EIP-7702 delegated EOAs to send direct EVM transactions by exempting delegation-designator code from the externally-owned-account-only check in `VerifyIfAccountExists`, so accounts that delegate via `SetCodeTx` can still manage (and revoke) their own delegation without a sponsored transaction
-- Remove the forced minimum 1-unit-per-block reward release in `CalculateReward` and skip (instead of deactivating) sub-unit blocks in the rewards `BeginBlocker`, so the proportional share accumulates and the pool follows the configured schedule independent of block time (previously a 10-year, 1M-unit schedule drained in ~12 days at the 1s target block time and ~28 days at the current ~2.4s rate, regardless of the configured duration)
-- Reject `MsgEthereumTx` from being dispatched through the authz keeper (including when nested inside `authz.MsgExec`), closing an EVM ante bypass on message-router execution paths that skip the ante handler
-- Fix feegrant denomination bypass in the cosmos fee ante handler by converting the fee before consuming the grant, so `UseGrantedFees` is checked against the same coins later deducted (prevents a grantee from forcing the granter to pay in a non-granted fee-abstraction denom)
-- Refactor `PerformSetMetadata` in wasmbinding to delegate to `msgServer.SetDenomMetadata`, ensuring the `EnableSetMetadata` capability check is enforced
-- Ensure that `UpdateTokenMetadata.Decimals` matches the ERC20 or bank records
-- Fixed odd validation on tokenfactory change admin that blocked removing admin from the token
+- Refactor `PerformSetMetadata` in wasmbinding to delegate to `msgServer.SetDenomMetadata`, ensuring the `EnableSetMetadata` capability check is enforced ([#329](https://github.com/KiiChain/kiichain/pull/329))
+- Ensure that `UpdateTokenMetadata.Decimals` matches the ERC20 or bank records ([#325](https://github.com/KiiChain/kiichain/pull/325))
+- Fixed odd validation on tokenfactory change admin that blocked removing admin from the token ([#324](https://github.com/KiiChain/kiichain/pull/324))
 - Fix division-by-zero chain halt in `CalculateReward` caused by sub-second schedule durations; replace `Seconds()` truncation with `Nanoseconds()` precision and release full remaining reward when `EndTime <= LastReleaseTime` ([#267](https://github.com/KiiChain/kiichain/issues/267))
 - Add denom string length validation (max 128 bytes) to oracle precompile and query server to prevent memory exhaustion via oversized inputs
 - Add result limits to oracle list queries (ExchangeRates, Actives, VoteTargets capped at 1000; PriceSnapshotHistory capped at 500) to prevent unbounded iteration
@@ -37,26 +68,15 @@
 - Validate rewards baseDenom using sdk.ValidateDenom to enforce proper denom format (min 3 chars, valid characters, no leading digits)
 - Ensure feeTokens is not nil at genesis
 - Ensure feeTokenMetadata initial prices after updateFeeTokenMetadata is picked up from oracle
-- Use `DecCoins.Validate()` on `RewardPool.ValidateGenesis` to catch malformed denom formats, duplicate denoms, bad ordering
+- Use `DecCoins.Validate()` on `RewardPool.ValidateGenesis` to catch malformed denom formats, duplicate denoms, bad ordering ([#323](https://github.com/KiiChain/kiichain/pull/323))
 - Enforce denom consistency in `GenesisState.Validate` with `Params.TokenDenom`
-- Bound tokenfactory denom metadata size (`MaxDenomMetadataSize`) in `MsgSetDenomMetadata.ValidateBasic` and `msgServer.SetDenomMetadata` to prevent oversized metadata rewrites (including via the CosmWasm binding) from forcing unbounded native store writes that overrun the transaction's declared gas
-- Limited tokenfactory queries, removing denial of service possibility
-- Indexed admins to reduce query space on tokenfactory denom queries
-- Fix native token supply inflation from the stateful precompiles by wrapping the account address codec (`evmAddressCodec`) to reject non-20-byte accounts (e.g. a 32-byte bech32 withdraw, module, or CosmWasm contract address) at decode time, preventing such addresses from being truncated and minted a duplicate balance when mirrored into the EVM StateDB
-- Close governance vote minimum-stake bypass in `GovVoteDecorator` by enforcing the stake check on `MsgVoteWeighted` (`govv1` and `govv1beta1`) and recursing into nested `authz.MsgExec` messages so wrapped votes can no longer skip the requirement
-- Prevent a chain halt in the rewards `BeginBlocker` by routing `SendCoinsFromModuleToModule` failures through `haltSchedule` (graceful schedule deactivation) instead of returning a fatal error, matching the other reward release error paths
-- Add a `ValidateModuleAccounting` check (rewards module bank balance must cover the `CommunityPool`) and run it at genesis to surface accounting/bank divergences early
+- Limited tokenfactory queries, removing denial of service possibility ([#328](https://github.com/KiiChain/kiichain/pull/328))
+- Indexed admins to reduce query space on tokenfactory denom queries ([#328](https://github.com/KiiChain/kiichain/pull/328))
 
 ### Removed
 
 - Removed price field input in updateTokenMetadata request
 
-## v7.3.1 - 2026-08-06
-
-### Fixed
-
-- Keep the gov module account on the bank blocked list so EVM BalanceHandler does not mirror gov deposits into StateDB (fixes Safe → gov precompile `deposit` failing on commit with `unauthorized`) ([#368](https://github.com/KiiChain/kiichain/pull/368))
-
 ## v7.1.0-mainnet - 2026-03-13
 
 ### Fixed

ante/ante_cosmos.go

@@ -9,9 +9,9 @@
 
 	wasmkeeper "github.com/CosmWasm/wasmd/x/wasm/keeper"
 
 	evmcosmosante "github.com/cosmos/evm/ante/cosmos"
 	evmante "github.com/cosmos/evm/ante/evm"
 	evmtypes "github.com/cosmos/evm/x/vm/types"
 
 	cosmosante "github.com/kiichain/kiichain/v7/x/feeabstraction/ante/cosmos"
 	"github.com/kiichain/kiichain/v7/x/oracle"
@@ -29,7 +29,10 @@
 		evmcosmosante.NewAuthzLimiterDecorator( // disable the Msg types that cannot be included on an authz.MsgExec msgs field
 			sdk.MsgTypeURL(&evmtypes.MsgEthereumTx{}),
 			sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreatePeriodicVestingAccount{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreatePermanentLockedAccount{}),
 		),
+		NewVestingAccountCreationDecorator(options.Cdc), // reject vesting-create msgs at the top level and inside authz
 
 		ante.NewSetUpContextDecorator(),
 		oracle.NewVoteAloneDecorator(), // Since this only iterate TXs, it must be executed early

ante/vesting_ante.go

@@ -0,0 +1,71 @@
+package ante
+
+import (
+	errorsmod "cosmossdk.io/errors"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkvesting "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
+	"github.com/cosmos/cosmos-sdk/x/authz"
+
+	xerrors "github.com/kiichain/kiichain/v7/x/types/errors"
+)
+
+// blockedVestingCreateMsgs is the set of vesting-module messages that open a
+// new account with LockedCoins. Those accounts are the book the EVM locked-
+// balance snapshot must stay consistent with; new creates are rejected until
+// that path is safe.
+var blockedVestingCreateMsgs = map[string]struct{}{
+	sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}):         {},
+	sdk.MsgTypeURL(&sdkvesting.MsgCreatePeriodicVestingAccount{}): {},
+	sdk.MsgTypeURL(&sdkvesting.MsgCreatePermanentLockedAccount{}): {},
+}
+
+// VestingAccountCreationDecorator rejects messages that create vesting or
+// permanently locked accounts, including when nested in authz.MsgExec.
+type VestingAccountCreationDecorator struct {
+	cdc codec.BinaryCodec
+}
+
+// NewVestingAccountCreationDecorator returns a decorator that blocks new
+// vesting account creation.
+func NewVestingAccountCreationDecorator(cdc codec.BinaryCodec) VestingAccountCreationDecorator {
+	return VestingAccountCreationDecorator{cdc: cdc}
+}
+
+// AnteHandle rejects blocked vesting-create messages at any authz nesting depth.
+func (d VestingAccountCreationDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (sdk.Context, error) {
+	if err := d.validateMsgs(tx.GetMsgs()); err != nil {
+		return ctx, err
+	}
+	return next(ctx, tx, simulate)
+}
+
+func (d VestingAccountCreationDecorator) validateMsgs(msgs []sdk.Msg) error {
+	for _, msg := range msgs {
+		if execMsg, ok := msg.(*authz.MsgExec); ok {
+			if err := d.validateAuthzExec(execMsg); err != nil {
+				return err
+			}
+			continue
+		}
+
+		typeURL := sdk.MsgTypeURL(msg)
+		if _, blocked := blockedVestingCreateMsgs[typeURL]; blocked {
+			return errorsmod.Wrapf(xerrors.ErrUnauthorized, "vesting account creation is disabled: %s", typeURL)
+		}
+	}
+	return nil
+}
+
+func (d VestingAccountCreationDecorator) validateAuthzExec(execMsg *authz.MsgExec) error {
+	innerMsgs := make([]sdk.Msg, 0, len(execMsg.Msgs))
+	for _, v := range execMsg.Msgs {
+		var innerMsg sdk.Msg
+		if err := d.cdc.UnpackAny(v, &innerMsg); err != nil {
+			return errorsmod.Wrapf(xerrors.ErrUnauthorized, "cannot unmarshal authz exec msg (type %s): %v", v.TypeUrl, err)
+		}
+		innerMsgs = append(innerMsgs, innerMsg)
+	}
+	return d.validateMsgs(innerMsgs)
+}

ante/vesting_ante_internal_test.go

@@ -0,0 +1,101 @@
+package ante
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"cosmossdk.io/math"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+	codectypes "github.com/cosmos/cosmos-sdk/codec/types"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkvesting "github.com/cosmos/cosmos-sdk/x/auth/vesting/types"
+	"github.com/cosmos/cosmos-sdk/x/authz"
+	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
+)
+
+func TestVestingAccountCreationDecorator(t *testing.T) {
+	registry := codectypes.NewInterfaceRegistry()
+	authz.RegisterInterfaces(registry)
+	sdkvesting.RegisterInterfaces(registry)
+	banktypes.RegisterInterfaces(registry)
+	decorator := NewVestingAccountCreationDecorator(codec.NewProtoCodec(registry))
+
+	from := sdk.AccAddress("from________________")
+	to := sdk.AccAddress("to__________________")
+	coins := sdk.NewCoins(sdk.NewCoin("akii", math.NewInt(1)))
+
+	exec := func(msgs ...sdk.Msg) sdk.Msg {
+		m := authz.NewMsgExec(from, msgs)
+		return &m
+	}
+
+	testCases := []struct {
+		name      string
+		msgs      []sdk.Msg
+		expectErr bool
+	}{
+		{
+			name: "allow bank send",
+			msgs: []sdk.Msg{&banktypes.MsgSend{
+				FromAddress: from.String(),
+				ToAddress:   to.String(),
+				Amount:      coins,
+			}},
+		},
+		{
+			name:      "block MsgCreateVestingAccount",
+			msgs:      []sdk.Msg{sdkvesting.NewMsgCreateVestingAccount(from, to, coins, 1, false)},
+			expectErr: true,
+		},
+		{
+			name:      "block delayed MsgCreateVestingAccount",
+			msgs:      []sdk.Msg{sdkvesting.NewMsgCreateVestingAccount(from, to, coins, 1, true)},
+			expectErr: true,
+		},
+		{
+			name: "block MsgCreatePeriodicVestingAccount",
+			msgs: []sdk.Msg{sdkvesting.NewMsgCreatePeriodicVestingAccount(from, to, 1, []sdkvesting.Period{{
+				Length: 1,
+				Amount: coins,
+			}})},
+			expectErr: true,
+		},
+		{
+			name:      "block MsgCreatePermanentLockedAccount",
+			msgs:      []sdk.Msg{sdkvesting.NewMsgCreatePermanentLockedAccount(from, to, coins)},
+			expectErr: true,
+		},
+		{
+			name:      "block MsgCreateVestingAccount inside authz.MsgExec",
+			msgs:      []sdk.Msg{exec(sdkvesting.NewMsgCreateVestingAccount(from, to, coins, 1, false))},
+			expectErr: true,
+		},
+		{
+			name: "block MsgCreatePeriodicVestingAccount inside nested authz.MsgExec",
+			msgs: []sdk.Msg{exec(exec(sdkvesting.NewMsgCreatePeriodicVestingAccount(from, to, 1, []sdkvesting.Period{{
+				Length: 1,
+				Amount: coins,
+			}})))},
+			expectErr: true,
+		},
+		{
+			name:      "block MsgCreatePermanentLockedAccount inside authz.MsgExec",
+			msgs:      []sdk.Msg{exec(sdkvesting.NewMsgCreatePermanentLockedAccount(from, to, coins))},
+			expectErr: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := decorator.validateMsgs(tc.msgs)
+			if tc.expectErr {
+				require.Error(t, err)
+				require.ErrorContains(t, err, "vesting account creation is disabled")
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}