From c7d798b170fe2b8378e0fca4517e7b0872ab795a Mon Sep 17 00:00:00 2001
From: Damian Nolan <damiannolan@gmail.com>
Date: Wed, 8 Feb 2023 11:07:36 +0100
Subject: [PATCH] disallow localhost client creation in 02-client (#3114)

* disallow localhost client creation, adapt tests

* adapting logic to accomodate usage of allowed clients in InitGenesis

* move localhost check to separate conditional
---
 go.mod                                       |  2 +-
 modules/core/02-client/keeper/client.go      |  4 +++
 modules/core/02-client/keeper/client_test.go | 31 +++++++++++++++-----
 3 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/go.mod b/go.mod
index 24c60c0705c..692c949614c 100644
--- a/go.mod
+++ b/go.mod
@@ -22,7 +22,6 @@ require (
 	github.com/stretchr/testify v1.8.1
 	github.com/tendermint/tendermint v0.37.0-rc2
 	github.com/tendermint/tm-db v0.6.7
-	golang.org/x/exp v0.0.0-20221019170559-20944726eadf
 	google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef
 	google.golang.org/grpc v1.52.3
 	google.golang.org/protobuf v1.28.1
@@ -147,6 +146,7 @@ require (
 	go.etcd.io/bbolt v1.3.6 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	golang.org/x/crypto v0.4.0 // indirect
+	golang.org/x/exp v0.0.0-20221019170559-20944726eadf // indirect
 	golang.org/x/net v0.4.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 // indirect
 	golang.org/x/sys v0.3.0 // indirect
diff --git a/modules/core/02-client/keeper/client.go b/modules/core/02-client/keeper/client.go
index fd260d65d98..2b5e65a1cf7 100644
--- a/modules/core/02-client/keeper/client.go
+++ b/modules/core/02-client/keeper/client.go
@@ -16,6 +16,10 @@ import (
 func (k Keeper) CreateClient(
 	ctx sdk.Context, clientState exported.ClientState, consensusState exported.ConsensusState,
 ) (string, error) {
+	if clientState.ClientType() == exported.Localhost {
+		return "", sdkerrors.Wrapf(types.ErrInvalidClientType, "cannot create client of type: %s", clientState.ClientType())
+	}
+
 	params := k.GetParams(ctx)
 	if !params.IsAllowedClient(clientState.ClientType()) {
 		return "", sdkerrors.Wrapf(
diff --git a/modules/core/02-client/keeper/client_test.go b/modules/core/02-client/keeper/client_test.go
index 94b5fed855a..ce338d25853 100644
--- a/modules/core/02-client/keeper/client_test.go
+++ b/modules/core/02-client/keeper/client_test.go
@@ -13,22 +13,39 @@ import (
 	"github.com/cosmos/ibc-go/v7/modules/core/exported"
 	solomachine "github.com/cosmos/ibc-go/v7/modules/light-clients/06-solomachine"
 	ibctm "github.com/cosmos/ibc-go/v7/modules/light-clients/07-tendermint"
+	localhost "github.com/cosmos/ibc-go/v7/modules/light-clients/09-localhost"
 	ibctesting "github.com/cosmos/ibc-go/v7/testing"
 )
 
 func (suite *KeeperTestSuite) TestCreateClient() {
 	cases := []struct {
-		msg         string
-		clientState exported.ClientState
-		expPass     bool
+		msg            string
+		clientState    exported.ClientState
+		consensusState exported.ConsensusState
+		expPass        bool
 	}{
-		{"success", ibctm.NewClientState(testChainID, ibctm.DefaultTrustLevel, trustingPeriod, ubdPeriod, maxClockDrift, testClientHeight, commitmenttypes.GetSDKSpecs(), ibctesting.UpgradePath), true},
-		{"client type not supported", solomachine.NewClientState(0, &solomachine.ConsensusState{PublicKey: suite.solomachine.ConsensusState().PublicKey, Diversifier: suite.solomachine.Diversifier, Timestamp: suite.solomachine.Time}), false},
+		{
+			"success: 07-tendermint client type supported",
+			ibctm.NewClientState(testChainID, ibctm.DefaultTrustLevel, trustingPeriod, ubdPeriod, maxClockDrift, testClientHeight, commitmenttypes.GetSDKSpecs(), ibctesting.UpgradePath),
+			suite.consensusState,
+			true,
+		},
+		{
+			"success: 06-solomachine client type supported",
+			solomachine.NewClientState(0, &solomachine.ConsensusState{PublicKey: suite.solomachine.ConsensusState().PublicKey, Diversifier: suite.solomachine.Diversifier, Timestamp: suite.solomachine.Time}),
+			&solomachine.ConsensusState{PublicKey: suite.solomachine.ConsensusState().PublicKey, Diversifier: suite.solomachine.Diversifier, Timestamp: suite.solomachine.Time},
+			true,
+		},
+		{
+			"failure: 09-localhost client type not supported",
+			localhost.NewClientState(clienttypes.GetSelfHeight(suite.ctx)),
+			nil,
+			false,
+		},
 	}
 
 	for i, tc := range cases {
-
-		clientID, err := suite.keeper.CreateClient(suite.ctx, tc.clientState, suite.consensusState)
+		clientID, err := suite.keeper.CreateClient(suite.ctx, tc.clientState, tc.consensusState)
 		if tc.expPass {
 			suite.Require().NoError(err, "valid test case %d failed: %s", i, tc.msg)
 			suite.Require().NotNil(clientID, "valid test case %d failed: %s", i, tc.msg)