Merge pull request from GHSA-j496-crgh-34mx

go.mod

@@ -1,6 +1,7 @@
 go 1.19
 
 retract (
+	[v7.2.0, v7.3.2] // contains ASA-2024-007 vulnerability
 	v7.1.0 // contains ledger transaction signing bug
 	v7.0.1 // contains ledger transaction signing bug
 	v7.0.0 // contains huckleberry vulnerability

modules/core/keeper/msg_server.go

@@ -528,18 +528,18 @@ func (k Keeper) Timeout(goCtx context.Context, msg *channeltypes.MsgTimeout) (*c
 		return nil, sdkerrors.Wrap(err, "timeout packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	err = cbs.OnTimeoutPacket(ctx, msg.Packet, relayer)
 	if err != nil {
 		ctx.Logger().Error("timeout failed", "port-id", msg.Packet.SourcePort, "channel-id", msg.Packet.SourceChannel, "error", sdkerrors.Wrap(err, "timeout packet callback failed"))
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},
@@ -601,6 +601,11 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout on close packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	//
 	// NOTE: MsgTimeout and MsgTimeoutOnClose use the same "OnTimeoutPacket"
@@ -611,11 +616,6 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},