fix bridge hook to check sender addr

app/app.go

@@ -369,7 +369,7 @@ func NewMinitiaApp(
 		runtime.NewKVStoreService(keys[opchildtypes.StoreKey]),
 		app.AccountKeeper,
 		app.BankKeeper,
-		apphook.NewWasmBridgeHook(app.WasmKeeper).Hook,
+		apphook.NewWasmBridgeHook(ac, app.WasmKeeper).Hook,
 		app.MsgServiceRouter(),
 		authorityAddr,
 		vc,

app/hook/wasm.go

@@ -5,19 +5,22 @@ import (
 	"encoding/json"
 	"strings"
 
+	"cosmossdk.io/core/address"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
 
 	wasmkeeper "github.com/CosmWasm/wasmd/x/wasm/keeper"
 	wasmtypes "github.com/CosmWasm/wasmd/x/wasm/types"
 )
 
 // bridge hook implementation for move
 type WasmBridgeHook struct {
+	ac         address.Codec
 	wasmKeeper *wasmkeeper.Keeper
 }
 
-func NewWasmBridgeHook(wasmKeeper *wasmkeeper.Keeper) WasmBridgeHook {
-	return WasmBridgeHook{wasmKeeper}
+func NewWasmBridgeHook(ac address.Codec, wasmKeeper *wasmkeeper.Keeper) WasmBridgeHook {
+	return WasmBridgeHook{ac, wasmKeeper}
 }
 
 func (mbh WasmBridgeHook) Hook(ctx context.Context, sender sdk.AccAddress, msgBytes []byte) error {
@@ -29,6 +32,13 @@ func (mbh WasmBridgeHook) Hook(ctx context.Context, sender sdk.AccAddress, msgBy
 		return err
 	}
 
+	senderAddr, err := mbh.ac.StringToBytes(msg.Sender)
+	if err != nil {
+		return err
+	} else if !sender.Equals(sdk.AccAddress(senderAddr)) {
+		return sdkerrors.ErrUnauthorized
+	}
+
 	ms := wasmkeeper.NewMsgServerImpl(mbh.wasmKeeper)
 	_, err = ms.ExecuteContract(ctx, &msg)