Fix/authz

[2xburnt]

This pull request introduces a new security mechanism to prevent dangerous contract-related messages from being executed via the Cosmos SDK authz module, addressing a critical vulnerability. The main addition is the AuthzLimiterDecorator, which blocks specific message types (such as contract execution and management) from being nested inside authz.MsgExec transactions. Comprehensive unit and integration tests are included to ensure the decorator works as intended and does not interfere with legitimate authz operations.

Security hardening:

• Added AuthzLimiterDecorator in app/authz_ante.go to prevent execution of dangerous message types (e.g., contract execution, instantiation, migration, admin updates) via authz.MsgExec, mitigating a known bypass vulnerability.
• Integrated AuthzLimiterDecorator into the ante handler chain in app/ante.go to enforce these restrictions during transaction processing.

Testing and verification:

• Added unit tests in app/authz_ante_test.go to verify that restricted message types are blocked and legitimate messages are allowed by the decorator.
• Added integration tests in app/authz_integration_test.go to demonstrate that the decorator prevents the reported vulnerability and blocks all dangerous contract-related message types, while allowing safe authz operations.

[Copilot]

Pull Request Overview

This pull request implements a critical security fix by introducing the AuthzLimiterDecorator to prevent dangerous contract-related messages from being executed via the Cosmos SDK authz module, addressing a vulnerability where malicious actors could bypass ante handlers.

• Added AuthzLimiterDecorator that blocks specific dangerous message types from being nested inside authz.MsgExec transactions
• Integrated the decorator into the ante handler chain to enforce restrictions during transaction processing
• Implemented comprehensive testing to verify the security fix works correctly

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
app/authz_ante.go	Core implementation of AuthzLimiterDecorator with message validation logic
app/ante.go	Integration of the new decorator into the ante handler chain with restricted message types
app/authz_ante_test.go	Unit tests verifying decorator functionality for both allowed and restricted messages
app/authz_integration_test.go	Integration tests demonstrating vulnerability prevention and comprehensive message type blocking

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[edjroz]

🤘

[2xburnt]

Converting to Draft to avoid accidental merge