From f6af83feeabd298731f7c71715a340e13572d8e3 Mon Sep 17 00:00:00 2001
From: beer-1 <147697694+beer-1@users.noreply.github.com>
Date: Wed, 6 Mar 2024 21:58:07 +0900
Subject: [PATCH] fix bridge hook to check sender addr

---
 app/app.go      |  2 +-
 app/hook/evm.go | 16 +++++++++++++---
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/app/app.go b/app/app.go
index be99bc0..cc4dd70 100644
--- a/app/app.go
+++ b/app/app.go
@@ -360,7 +360,7 @@ func NewMinitiaApp(
 		runtime.NewKVStoreService(keys[opchildtypes.StoreKey]),
 		app.AccountKeeper,
 		app.BankKeeper,
-		apphook.NewEVMBridgeHook(app.EVMKeeper).Hook,
+		apphook.NewEVMBridgeHook(ac, app.EVMKeeper).Hook,
 		app.MsgServiceRouter(),
 		authorityAddr,
 		vc,
diff --git a/app/hook/evm.go b/app/hook/evm.go
index aacfd14..072fe94 100644
--- a/app/hook/evm.go
+++ b/app/hook/evm.go
@@ -5,7 +5,9 @@ import (
 	"encoding/json"
 	"strings"
 
+	"cosmossdk.io/core/address"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
 
 	evmkeeper "github.com/initia-labs/minievm/x/evm/keeper"
 	evmtypes "github.com/initia-labs/minievm/x/evm/types"
@@ -13,15 +15,16 @@ import (
 
 // bridge hook implementation for evm
 type EVMBridgeHook struct {
+	ac        address.Codec
 	evmKeeper *evmkeeper.Keeper
 }
 
-func NewEVMBridgeHook(evmKeeper *evmkeeper.Keeper) EVMBridgeHook {
-	return EVMBridgeHook{evmKeeper}
+func NewEVMBridgeHook(ac address.Codec, evmKeeper *evmkeeper.Keeper) EVMBridgeHook {
+	return EVMBridgeHook{ac, evmKeeper}
 }
 
 func (mbh EVMBridgeHook) Hook(ctx context.Context, sender sdk.AccAddress, msgBytes []byte) error {
-	msg := evmtypes.MsgCall{}
+	var msg evmtypes.MsgCall
 	decoder := json.NewDecoder(strings.NewReader(string(msgBytes)))
 	decoder.DisallowUnknownFields()
 	err := decoder.Decode(&msg)
@@ -29,6 +32,13 @@ func (mbh EVMBridgeHook) Hook(ctx context.Context, sender sdk.AccAddress, msgByt
 		return err
 	}
 
+	senderAddr, err := mbh.ac.StringToBytes(msg.Sender)
+	if err != nil {
+		return err
+	} else if !sender.Equals(sdk.AccAddress(senderAddr)) {
+		return sdkerrors.ErrUnauthorized
+	}
+
 	ms := evmkeeper.NewMsgServerImpl(mbh.evmKeeper)
 	_, err = ms.Call(ctx, &msg)