Update ibc-rs

[yito88]

Describe your changes

• Closes Update ibc-rs to v0.52.0 #3011
• Closes IBC client gets suddenly frozen despite of being constantly updated #2985
• Closes Update tendermin-rs dependency to 0.35 #2935

Requires tendermint-rs v0.35

Indicate on which release or other PRs this topic is based on

v0.34.0

Checklist before merging to draft

• I have added a changelog
• Git history is in acceptable state

[codecov]

Codecov Report

Attention: Patch coverage is 59.39086% with 80 lines in your changes are missing coverage. Please review.

Project coverage is 59.39%. Comparing base (9d4de02) to head (3e4e57b).
Report is 2 commits behind head on main.

Files	Patch %	Lines
crates/ibc/src/context/client.rs	17.10%	63 Missing ⚠️
crates/ibc/src/context/common.rs	78.37%	8 Missing ⚠️
crates/ibc/src/context/validation.rs	82.75%	5 Missing ⚠️
crates/ibc/src/context/execution.rs	81.81%	2 Missing ⚠️
crates/apps/src/lib/bench_utils.rs	0.00%	1 Missing ⚠️
...tes/apps/src/lib/node/ledger/shell/testing/node.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3030      +/-   ##
==========================================
- Coverage   59.40%   59.39%   -0.02%     
==========================================
  Files         298      298              
  Lines       92326    92347      +21     
==========================================
+ Hits        54849    54852       +3     
- Misses      37477    37495      +18     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[brentstone]

@yito88 what's the status of this PR?

[yito88]

@brentstone this is waiting for ibc-rs v0.52.0.

[McDaan]

Hey guys @yito88 @brentstone, please don't forget that this also closes #2985

As this is a high severe security vulnerability I have reported in the mentioned issue.

"A way to lock/freeze assets by freezing an IBC client - which makes them unusable until the related code is fixed (i.e. ibc-rs) and chain upgraded in order to be able to avoid freeze behaviour (0.51 ibc-rs) as well as updating frozen/expired IBC clients for new ones (0.52 ibc-rs) to finally unlock/unfreeze those assets"

[sug0]

lgtm

[McDaan]

Hey guys @yito88 @brentstone, please don't forget that this also closes #2985

As this is a high severe security vulnerability I have reported in the mentioned issue.

"A way to lock/freeze assets by freezing an IBC client - which makes them unusable until the related code is fixed (i.e. ibc-rs) and chain upgraded in order to be able to avoid freeze behaviour (0.51 ibc-rs) as well as updating frozen/expired IBC clients for new ones (0.52 ibc-rs) to finally unlock/unfreeze those assets"

Adding more relevant information to this context after seeing that it has been correctly considered as a valid security issue by the team. @cwgoes @brentstone @Fraccaman

It's curious, right? I had even reported this behaviour internally before than the original issue in the original ibc-rs repo.

Feb 9 informalsystems/ibc-rs#1080

Feb 5 (internal group in which this behaviour has been reported before than the original issue was open - many people and devs, including Brent and Gian, have access to it, chat history doesn't lie)
https://discord.com/channels/@me/1203005508206862447/1204121706931945534