fix: security report fix

client/utils.go

@@ -35,6 +35,11 @@ func Paginate(numObjs, page, limit, defLimit int) (start, end int) {
 	start = (page - 1) * limit
 	end = limit + start
 
+	if end < start {
+		// check if this produces negative numbers, resulting in end < start
+		return -1, -1
+	}
+
 	if end >= numObjs {
 		end = numObjs
 	}

types/cross_chain.go

@@ -94,6 +94,9 @@ func EncodePackageHeader(header PackageHeader) []byte {
 	copy(packageHeader[PackageTypeLength:PackageTypeLength+TimestampLength], timestampBytes)
 
 	relayerFeeLength := len(header.RelayerFee.Bytes())
+	if relayerFeeLength > 32 {
+		panic(fmt.Sprintf("relayer fee length %d is greater than 32", relayerFeeLength))
+	}
 	copy(packageHeader[AckPackageHeaderLength-relayerFeeLength:AckPackageHeaderLength], header.RelayerFee.Bytes())
 
 	// add ack relayer fee to header for syn package

x/authz/migrations/v2/keys.go

@@ -61,12 +61,13 @@ func ParseGrantKey(key []byte) (granterAddr, granteeAddr sdk.AccAddress, msgType
 	// key is of format:
 	// <granterAddressLen (1 Byte)><granterAddress_Bytes><granteeAddressLen (1 Byte)><granteeAddress_Bytes><msgType_Bytes>
 	kv.AssertKeyAtLeastLength(key, 2)
-	granterAddrLen := key[0]
+	// prevent granterAddrLen overflow
+	granterAddrLen := int(key[0])
 	kv.AssertKeyAtLeastLength(key, int(2+granterAddrLen))
 	granterAddr = sdk.AccAddress(key[1 : 1+granterAddrLen])
 	granteeAddrLen := int(key[1+granterAddrLen])
-	kv.AssertKeyAtLeastLength(key, 3+int(granterAddrLen+byte(granteeAddrLen)))
-	granteeAddr = sdk.AccAddress(key[2+granterAddrLen : 2+granterAddrLen+byte(granteeAddrLen)])
+	kv.AssertKeyAtLeastLength(key, 3+granterAddrLen+granteeAddrLen)
+	granteeAddr = sdk.AccAddress(key[2+granterAddrLen : 2+granterAddrLen+granteeAddrLen])
 
-	return granterAddr, granteeAddr, conv.UnsafeBytesToStr(key[2+granterAddrLen+byte(granteeAddrLen):])
+	return granterAddr, granteeAddr, conv.UnsafeBytesToStr(key[2+granterAddrLen+granteeAddrLen:])
 }

x/authz/simulation/genesis.go

@@ -15,6 +15,10 @@ import (
 
 // genGrant returns a slice of authorization grants.
 func genGrant(r *rand.Rand, accounts []simtypes.Account, genT time.Time) []authz.GrantAuthorization {
+	// prevent errors if len < 1
+	if len(accounts) < 1 {
+		return make([]authz.GrantAuthorization, 0)
+	}
 	authorizations := make([]authz.GrantAuthorization, len(accounts)-1)
 	for i := 0; i < len(accounts)-1; i++ {
 		granter := accounts[i]

x/feegrant/simulation/genesis.go

@@ -12,6 +12,10 @@ import (
 
 // genFeeGrants returns a slice of randomly generated allowances.
 func genFeeGrants(r *rand.Rand, accounts []simtypes.Account) []feegrant.Grant {
+	// prevent errors if len < 1
+	if len(accounts) < 1 {
+		return make([]feegrant.Grant, 0)
+	}
 	allowances := make([]feegrant.Grant, len(accounts)-1)
 	for i := 0; i < len(accounts)-1; i++ {
 		granter := accounts[i].Address

x/group/internal/orm/key_codec.go

@@ -82,6 +82,9 @@ func stripRowID(indexKey []byte, secondaryIndexKey interface{}) (RowID, error) {
 	switch v := secondaryIndexKey.(type) {
 	case []byte:
 		searchableKeyLen := indexKey[0]
+		if 1+int(searchableKeyLen) > len(indexKey) {
+			return nil, fmt.Errorf("searchableKeyLen is out of bounds")
+		}
 		return indexKey[1+searchableKeyLen:], nil
 	case string:
 		searchableKeyLen := 0
@@ -91,8 +94,14 @@ func stripRowID(indexKey []byte, secondaryIndexKey interface{}) (RowID, error) {
 				break
 			}
 		}
+		if 1+searchableKeyLen > len(indexKey) {
+			return nil, fmt.Errorf("searchableKeyLen is out of bounds")
+		}
 		return indexKey[1+searchableKeyLen:], nil
 	case uint64:
+		if EncodedSeqLength > len(indexKey) {
+			return nil, fmt.Errorf("EncodedSeqLength is out of bounds")
+		}
 		return indexKey[EncodedSeqLength:], nil
 	default:
 		return nil, fmt.Errorf("type %T not allowed as index key", v)

x/nft/simulation/genesis.go

@@ -10,6 +10,9 @@ import (
 
 // genClasses returns a slice of nft class.
 func genClasses(r *rand.Rand, accounts []simtypes.Account) []*nft.Class {
+	if len(accounts) < 1 {
+		return make([]*nft.Class, 0)
+	}
 	classes := make([]*nft.Class, len(accounts)-1)
 	for i := 0; i < len(accounts)-1; i++ {
 		classes[i] = &nft.Class{

x/staking/migrations/v1/types.go

@@ -219,12 +219,22 @@ func ParseValidatorQueueKey(bz []byte) (time.Time, int64, error) {
 		return time.Time{}, 0, fmt.Errorf("invalid prefix; expected: %X, got: %X", ValidatorQueueKey, prefix)
 	}
 
+	if prefixL+8 > len(bz) {
+		return time.Time{}, 0, fmt.Errorf("timeBzl is out of bounds")
+	}
 	timeBzL := sdk.BigEndianToUint64(bz[prefixL : prefixL+8])
+
+	if prefixL+8+int(timeBzL) > len(bz) {
+		return time.Time{}, 0, fmt.Errorf("ts is out of bounds")
+	}
 	ts, err := sdk.ParseTimeBytes(bz[prefixL+8 : prefixL+8+int(timeBzL)])
 	if err != nil {
 		return time.Time{}, 0, err
 	}
 
+	if prefixL+8+int(timeBzL) >= len(bz) {
+		return time.Time{}, 0, fmt.Errorf("height is out of bounds")
+	}
 	height := sdk.BigEndianToUint64(bz[prefixL+8+int(timeBzL):])
 
 	return ts, int64(height), nil

x/staking/types/keys.go

@@ -221,11 +221,18 @@ func ParseValidatorQueueKey(bz []byte) (time.Time, int64, error) {
 	}
 
 	timeBzL := sdk.BigEndianToUint64(bz[prefixL : prefixL+8])
+	if prefixL+8+int(timeBzL) > len(bz) {
+		return time.Time{}, 0, fmt.Errorf("ts is out of bounds")
+	}
+
 	ts, err := sdk.ParseTimeBytes(bz[prefixL+8 : prefixL+8+int(timeBzL)])
 	if err != nil {
 		return time.Time{}, 0, err
 	}
 
+	if prefixL+8+int(timeBzL) >= len(bz) {
+		return time.Time{}, 0, fmt.Errorf("height is out of bounds")
+	}
 	height := sdk.BigEndianToUint64(bz[prefixL+8+int(timeBzL):])
 
 	return ts, int64(height), nil