feat: Prepare v7.4.0

.github/actions/setup-private-go/action.yml

@@ -0,0 +1,37 @@
+name: "Setup private Go modules"
+description: >-
+  Grants the runner read access to KiiChain's private Go module dependencies
+  (currently the github.com/KiiChain/evm-private fork used by the cosmos/evm
+  replace directive) so that go commands can resolve them.
+
+inputs:
+  token:
+    description: >-
+      Read-only token for the private KiiChain module repositories. The built-in
+      GITHUB_TOKEN is not sufficient: it is scoped to this repository only.
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Configure git credentials and GOPRIVATE
+      shell: bash
+      env:
+        TOKEN: ${{ inputs.token }}
+      run: |
+        set -euo pipefail
+
+        if [ -z "${TOKEN}" ]; then
+          echo "::error::EVM_PRIVATE_TOKEN is not set. The cosmos/evm replace" \
+               "directive points at the private KiiChain/evm-private fork, which" \
+               "cannot be resolved without it."
+          exit 1
+        fi
+
+        git config --global \
+          url."https://x-access-token:${TOKEN}@github.com/KiiChain/".insteadOf \
+          "https://github.com/KiiChain/"
+
+        # Independently of authentication, the public module proxy and checksum
+        # database cannot serve a private repository, so bypass both.
+        echo "GOPRIVATE=github.com/KiiChain/*" >> "$GITHUB_ENV"

.github/workflows/codeql.yaml

@@ -27,6 +27,11 @@ jobs:
         go-version: "1.24"
         check-latest: true
 
+    - name: Setup private Go modules
+      uses: ./.github/actions/setup-private-go
+      with:
+        token: ${{ secrets.EVM_PRIVATE_TOKEN }}
+
    # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v3

.github/workflows/e2e.yaml

@@ -21,6 +21,11 @@ jobs:
           go-version: 1.24.x
       - uses: actions/checkout@v4
 
+      - name: Setup private Go modules
+        uses: ./.github/actions/setup-private-go
+        with:
+          token: ${{ secrets.EVM_PRIVATE_TOKEN }}
+
       - uses: technote-space/get-diff-action@v6.1.2
         id: git_diff
         with:
@@ -44,6 +49,10 @@ jobs:
 
       - name: Build Docker and download packages in parallel
         if: env.GIT_DIFF
+        env:
+          # Forwarded into the image build as a BuildKit secret so that
+          # `go mod download` inside the container can reach the private fork.
+          EVM_PRIVATE_TOKEN: ${{ secrets.EVM_PRIVATE_TOKEN }}
         run: |
           set -e
           echo "Starting docker build and go mod download in parallel..."

.github/workflows/lint.yml

@@ -24,6 +24,11 @@ jobs:
           go-version: "1.24"
           check-latest: true
 
+      - name: Setup private Go modules
+        uses: ./.github/actions/setup-private-go
+        with:
+          token: ${{ secrets.EVM_PRIVATE_TOKEN }}
+
       - uses: technote-space/get-diff-action@v6.1.2
         id: git_diff
         with:

.github/workflows/liveness.yaml

@@ -19,6 +19,11 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version: 1.24.x
+      - name: Setup private Go modules
+        uses: ./.github/actions/setup-private-go
+        with:
+          token: ${{ secrets.EVM_PRIVATE_TOKEN }}
+
       - uses: technote-space/get-diff-action@v6.1.2
         id: git_diff
         with:

.github/workflows/test.yml

@@ -24,6 +24,12 @@ jobs:
           check-latest: true
           cache: true
           cache-dependency-path: go.sum
+
+      - name: Setup private Go modules
+        uses: ./.github/actions/setup-private-go
+        with:
+          token: ${{ secrets.EVM_PRIVATE_TOKEN }}
+
       - uses: technote-space/get-diff-action@v6.1.2
         id: git_diff
         with:
@@ -45,10 +51,16 @@ jobs:
             ${{ runner.os }}-go-
       - name: test & coverage report creation
         if: env.GIT_DIFF
+        # Required, not cosmetic. The implicit default shell is `bash -e {0}`
+        # with NO pipefail, so the `| grep` below swallows a non-zero exit from
+        # `go test` and the job reports green on failing tests. Setting
+        # `shell: bash` gets `bash --noprofile --norc -eo pipefail {0}`.
+        shell: bash
         run: |
-          go test -v -coverprofile=profile.txt -covermode=atomic -coverpkg=./... $(go list ./... | grep -v -e '/tests/e2e' | grep -v -e '/tests/interchain') | grep -v "store.go:" | grep -v "mutable_tree.go:"
+          go test -tags=test -v -coverprofile=profile.txt -covermode=atomic -coverpkg=./... $(go list -tags=test ./... | grep -v -e '/tests/e2e' | grep -v -e '/tests/interchain') | grep -v "store.go:" | grep -v "mutable_tree.go:"
       - name: wasmbinding coverage (test build tag)
         if: env.GIT_DIFF
+        shell: bash
         run: |
           go test -tags=test -coverprofile=profile-wasmbinding.txt -covermode=atomic ./wasmbinding/...
       - uses: actions/upload-artifact@v4

CHANGELOG.md

@@ -2,11 +2,49 @@
 
 ## Unreleased
 
+### Fixed
+
+- Reject `MsgCreateVestingAccount`, `MsgCreatePeriodicVestingAccount`, and `MsgCreatePermanentLockedAccount` in the Cosmos ante (top-level and nested in `authz.MsgExec`) so new vesting / locked accounts cannot be opened after the v7.3.2 upgrade
+- Enable a bank `SendRestriction` for the 22 Aug 2026 incident addresses in the `v7.4.0` upgrade (after fund recovery) so Cosmos, precompile, and EVM native transfers cannot send from or to them after the upgrade height
+
+
+
+### Dependencies
+
+- Bump EVM fork to `v0.6.2-fork.1`, applied via the coordinated `v7.3.2` upgrade (private Cosmos EVM security hotfix; cannot build from public source until 2026-08-28)
+- Bump EVM fork to `v0.6.2-fork.2`
+
+## v7.3.1 - 2026-08-06
+
+### Fixed
+
+- Keep the gov module account on the bank blocked list so EVM BalanceHandler does not mirror gov deposits into StateDB (fixes Safe → gov precompile `deposit` failing on commit with `unauthorized`) ([#368](https://github.com/KiiChain/kiichain/pull/368))
+
+## v7.3.0 - 2026-07-28
+
 ### Dependencies
 
 - [EVM](https://github.com/KiiChain/evm) fork from v0.6.0-fork.1 to [v0.6.0-fork.2](https://github.com/KiiChain/evm/releases/tag/v0.6.0-fork.2): bounded internal EVM call gas limit, EVM fee refunds, distribution precompile 32-byte withdraw fix, and CosmWasm EVM query undercharge fix
 - [EVM](https://github.com/KiiChain/evm) fork bump from `v0.6.0-fork.2` to [v0.6.1-fork.1](https://github.com/KiiChain/evm/releases/tag/v0.6.1-fork.1), applied via the coordinated `v7.3.0` upgrade: the July 2026 Cosmos EVM hotfix (precompile gas accounting alignment and StateDB locked-balance snapshotting), published upstream as [cosmos/evm v0.6.1](https://github.com/cosmos/evm/releases/tag/v0.6.1)
 
+### Fixed
+
+- Close an expedited-governance whitelist bypass in `GovExpeditedProposalsDecorator` where the check only inspected top-level messages: a non-whitelisted `MsgSubmitProposal` wrapped in `authz.MsgExec` could enter the expedited voting path. The decorator now recurses into `authz.MsgExec` (including nested execs) and applies the expedited whitelist validation to wrapped proposals ([#353](https://github.com/KiiChain/kiichain/pull/353))
+- Compute the oracle ballot `StandardDeviation` as a stake-weighted variance (weight each squared deviation by the vote's power and divide by total voting power) instead of an unweighted average divided by the vote count, aligning the reward-band width with the stake-weighted median and preventing a group of low-stake validators from inflating the deviation to widen the accepted vote window ([#354](https://github.com/KiiChain/kiichain/pull/354))
+- Close an oracle slashing bypass in the `EndBlocker` where validators were scored against the post-filtered `voteTargets` map: a denom that received votes but was pushed below the vote threshold (e.g. by a coordinated group abstaining) was dropped from the scoring denominator, letting the abstainers avoid miss penalties. Participation is now scored against the configured targets that received votes (passing targets plus below-threshold targets), crediting validators that voted on a below-threshold target while counting abstention on it as a miss; targets that received no votes at all are still excluded so a legitimately unpriceable denom cannot mass-slash the validator set ([#352](https://github.com/KiiChain/kiichain/pull/352))
+- Allow EIP-7702 delegated EOAs to send direct EVM transactions by exempting delegation-designator code from the externally-owned-account-only check in `VerifyIfAccountExists`, so accounts that delegate via `SetCodeTx` can still manage (and revoke) their own delegation without a sponsored transaction ([#350](https://github.com/KiiChain/kiichain/pull/350))
+- Remove the forced minimum 1-unit-per-block reward release in `CalculateReward` and skip (instead of deactivating) sub-unit blocks in the rewards `BeginBlocker`, so the proportional share accumulates and the pool follows the configured schedule independent of block time ([#347](https://github.com/KiiChain/kiichain/pull/347))
+- Reject `MsgEthereumTx` from being dispatched through the authz keeper (including when nested inside `authz.MsgExec`), closing an EVM ante bypass on message-router execution paths that skip the ante handler ([#342](https://github.com/KiiChain/kiichain/pull/342))
+- Fix feegrant denomination bypass in the cosmos fee ante handler by converting the fee before consuming the grant, so `UseGrantedFees` is checked against the same coins later deducted ([#343](https://github.com/KiiChain/kiichain/pull/343))
+- Bound tokenfactory denom metadata size (`MaxDenomMetadataSize`) in `MsgSetDenomMetadata.ValidateBasic` and `msgServer.SetDenomMetadata` to prevent oversized metadata rewrites from forcing unbounded native store writes ([#341](https://github.com/KiiChain/kiichain/pull/341))
+- Fix native token supply inflation from the stateful precompiles by wrapping the account address codec (`evmAddressCodec`) to reject non-20-byte accounts at decode time ([#340](https://github.com/KiiChain/kiichain/pull/340))
+- Close governance vote minimum-stake bypass in `GovVoteDecorator` by enforcing the stake check on `MsgVoteWeighted` and recursing into nested `authz.MsgExec` messages ([#344](https://github.com/KiiChain/kiichain/pull/344))
+- Prevent a chain halt in the rewards `BeginBlocker` by routing `SendCoinsFromModuleToModule` failures through `haltSchedule` instead of returning a fatal error ([#346](https://github.com/KiiChain/kiichain/pull/346))
+- Add a `ValidateModuleAccounting` check (rewards module bank balance must cover the `CommunityPool`) and run it at genesis
+- Fix CosmWasm EVM query path repeatable undercharged EVM execution ([#345](https://github.com/KiiChain/kiichain/pull/345))
+
+## v7.2.0 - 2026-04-16
+
 ### Added
 
 - Emit `update_params`, `fund_pool`, `change_schedule`, and `reward_distributed` events from x/rewards
@@ -16,16 +54,9 @@
 
 ### Fixed
 
-- Close an expedited-governance whitelist bypass in `GovExpeditedProposalsDecorator` where the check only inspected top-level messages: a non-whitelisted `MsgSubmitProposal` wrapped in `authz.MsgExec` could enter the expedited voting path. The decorator now recurses into `authz.MsgExec` (including nested execs) and applies the expedited whitelist validation to wrapped proposals
-- Compute the oracle ballot `StandardDeviation` as a stake-weighted variance (weight each squared deviation by the vote's power and divide by total voting power) instead of an unweighted average divided by the vote count, aligning the reward-band width with the stake-weighted median and preventing a group of low-stake validators from inflating the deviation to widen the accepted vote window
-- Close an oracle slashing bypass in the `EndBlocker` where validators were scored against the post-filtered `voteTargets` map: a denom that received votes but was pushed below the vote threshold (e.g. by a coordinated group abstaining) was dropped from the scoring denominator, letting the abstainers avoid miss penalties. Participation is now scored against the configured targets that received votes (passing targets plus below-threshold targets), crediting validators that voted on a below-threshold target while counting abstention on it as a miss; targets that received no votes at all are still excluded so a legitimately unpriceable denom cannot mass-slash the validator set
-- Allow EIP-7702 delegated EOAs to send direct EVM transactions by exempting delegation-designator code from the externally-owned-account-only check in `VerifyIfAccountExists`, so accounts that delegate via `SetCodeTx` can still manage (and revoke) their own delegation without a sponsored transaction
-- Remove the forced minimum 1-unit-per-block reward release in `CalculateReward` and skip (instead of deactivating) sub-unit blocks in the rewards `BeginBlocker`, so the proportional share accumulates and the pool follows the configured schedule independent of block time (previously a 10-year, 1M-unit schedule drained in ~12 days at the 1s target block time and ~28 days at the current ~2.4s rate, regardless of the configured duration)
-- Reject `MsgEthereumTx` from being dispatched through the authz keeper (including when nested inside `authz.MsgExec`), closing an EVM ante bypass on message-router execution paths that skip the ante handler
-- Fix feegrant denomination bypass in the cosmos fee ante handler by converting the fee before consuming the grant, so `UseGrantedFees` is checked against the same coins later deducted (prevents a grantee from forcing the granter to pay in a non-granted fee-abstraction denom)
-- Refactor `PerformSetMetadata` in wasmbinding to delegate to `msgServer.SetDenomMetadata`, ensuring the `EnableSetMetadata` capability check is enforced
-- Ensure that `UpdateTokenMetadata.Decimals` matches the ERC20 or bank records
-- Fixed odd validation on tokenfactory change admin that blocked removing admin from the token
+- Refactor `PerformSetMetadata` in wasmbinding to delegate to `msgServer.SetDenomMetadata`, ensuring the `EnableSetMetadata` capability check is enforced ([#329](https://github.com/KiiChain/kiichain/pull/329))
+- Ensure that `UpdateTokenMetadata.Decimals` matches the ERC20 or bank records ([#325](https://github.com/KiiChain/kiichain/pull/325))
+- Fixed odd validation on tokenfactory change admin that blocked removing admin from the token ([#324](https://github.com/KiiChain/kiichain/pull/324))
 - Fix division-by-zero chain halt in `CalculateReward` caused by sub-second schedule durations; replace `Seconds()` truncation with `Nanoseconds()` precision and release full remaining reward when `EndTime <= LastReleaseTime` ([#267](https://github.com/KiiChain/kiichain/issues/267))
 - Add denom string length validation (max 128 bytes) to oracle precompile and query server to prevent memory exhaustion via oversized inputs
 - Add result limits to oracle list queries (ExchangeRates, Actives, VoteTargets capped at 1000; PriceSnapshotHistory capped at 500) to prevent unbounded iteration
@@ -37,26 +68,15 @@
 - Validate rewards baseDenom using sdk.ValidateDenom to enforce proper denom format (min 3 chars, valid characters, no leading digits)
 - Ensure feeTokens is not nil at genesis
 - Ensure feeTokenMetadata initial prices after updateFeeTokenMetadata is picked up from oracle
-- Use `DecCoins.Validate()` on `RewardPool.ValidateGenesis` to catch malformed denom formats, duplicate denoms, bad ordering
+- Use `DecCoins.Validate()` on `RewardPool.ValidateGenesis` to catch malformed denom formats, duplicate denoms, bad ordering ([#323](https://github.com/KiiChain/kiichain/pull/323))
 - Enforce denom consistency in `GenesisState.Validate` with `Params.TokenDenom`
-- Bound tokenfactory denom metadata size (`MaxDenomMetadataSize`) in `MsgSetDenomMetadata.ValidateBasic` and `msgServer.SetDenomMetadata` to prevent oversized metadata rewrites (including via the CosmWasm binding) from forcing unbounded native store writes that overrun the transaction's declared gas
-- Limited tokenfactory queries, removing denial of service possibility
-- Indexed admins to reduce query space on tokenfactory denom queries
-- Fix native token supply inflation from the stateful precompiles by wrapping the account address codec (`evmAddressCodec`) to reject non-20-byte accounts (e.g. a 32-byte bech32 withdraw, module, or CosmWasm contract address) at decode time, preventing such addresses from being truncated and minted a duplicate balance when mirrored into the EVM StateDB
-- Close governance vote minimum-stake bypass in `GovVoteDecorator` by enforcing the stake check on `MsgVoteWeighted` (`govv1` and `govv1beta1`) and recursing into nested `authz.MsgExec` messages so wrapped votes can no longer skip the requirement
-- Prevent a chain halt in the rewards `BeginBlocker` by routing `SendCoinsFromModuleToModule` failures through `haltSchedule` (graceful schedule deactivation) instead of returning a fatal error, matching the other reward release error paths
-- Add a `ValidateModuleAccounting` check (rewards module bank balance must cover the `CommunityPool`) and run it at genesis to surface accounting/bank divergences early
+- Limited tokenfactory queries, removing denial of service possibility ([#328](https://github.com/KiiChain/kiichain/pull/328))
+- Indexed admins to reduce query space on tokenfactory denom queries ([#328](https://github.com/KiiChain/kiichain/pull/328))
 
 ### Removed
 
 - Removed price field input in updateTokenMetadata request
 
-## v7.3.1 - 2026-08-06
-
-### Fixed
-
-- Keep the gov module account on the bank blocked list so EVM BalanceHandler does not mirror gov deposits into StateDB (fixes Safe → gov precompile `deposit` failing on commit with `unauthorized`) ([#368](https://github.com/KiiChain/kiichain/pull/368))
-
 ## v7.1.0-mainnet - 2026-03-13
 
 ### Fixed

Dockerfile

@@ -1,3 +1,4 @@
+# syntax=docker/dockerfile:1
 # Info on how to use this docker image can be found in DOCKER_README.md
 ARG IMG_TAG=latest
 
@@ -16,7 +17,16 @@ RUN sha256sum /lib/libwasmvm_muslc.x86_64.a | grep cefe73f0caa5a9eaba3733c639cdf
 RUN cp "/lib/libwasmvm_muslc.$(uname -m).a" /lib/libwasmvm_muslc.a
 
 COPY go.mod go.sum* ./
-RUN go mod download
+
+ENV GOPRIVATE=github.com/KiiChain/*
+RUN --mount=type=secret,id=gh_token \
+    set -e; \
+    if [ -s /run/secrets/gh_token ]; then \
+      export GIT_CONFIG_COUNT=1; \
+      export GIT_CONFIG_KEY_0="url.https://x-access-token:$(cat /run/secrets/gh_token)@github.com/KiiChain/.insteadOf"; \
+      export GIT_CONFIG_VALUE_0="https://github.com/KiiChain/"; \
+    fi; \
+    go mod download
 
 COPY . .
 RUN LEDGER_ENABLED=false LINK_STATICALLY=true BUILD_TAGS=muslc make build

Makefile

@@ -307,8 +307,12 @@ test-unit-cover-html: test-unit-cover
 	@echo "--> Generating HTML coverage report"
 	@go tool cover -html=coverage.txt -o coverage.html
 
+ifdef EVM_PRIVATE_TOKEN
+DOCKER_BUILD_SECRETS := --secret id=gh_token,env=EVM_PRIVATE_TOKEN
+endif
+
 docker-build-debug:
-	@docker build -t kiichain/kiichaind-e2e -f Dockerfile .
+	@DOCKER_BUILDKIT=1 docker build $(DOCKER_BUILD_SECRETS) -t kiichain/kiichaind-e2e -f Dockerfile .
 
 docker-build-hermes:
 	@cd tests/e2e/docker; docker build -t kiichain/hermes-e2e:1.0.0 -f hermes.Dockerfile .

ante/ante_cosmos.go

@@ -29,7 +29,10 @@ func NewCosmosAnteHandler(ctx sdk.Context, options HandlerOptions) sdk.AnteHandl
 		evmcosmosante.NewAuthzLimiterDecorator( // disable the Msg types that cannot be included on an authz.MsgExec msgs field
 			sdk.MsgTypeURL(&evmtypes.MsgEthereumTx{}),
 			sdk.MsgTypeURL(&sdkvesting.MsgCreateVestingAccount{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreatePeriodicVestingAccount{}),
+			sdk.MsgTypeURL(&sdkvesting.MsgCreatePermanentLockedAccount{}),
 		),
+		NewVestingAccountCreationDecorator(options.Cdc), // reject vesting-create msgs at the top level and inside authz
 
 		ante.NewSetUpContextDecorator(),
 		oracle.NewVoteAloneDecorator(), // Since this only iterate TXs, it must be executed early