diff --git a/modules/core/04-channel/keeper/upgrade.go b/modules/core/04-channel/keeper/upgrade.go index 546d0414f74..5ed55f79914 100644 --- a/modules/core/04-channel/keeper/upgrade.go +++ b/modules/core/04-channel/keeper/upgrade.go @@ -288,6 +288,30 @@ func (k Keeper) ChanUpgradeAck( return types.NewUpgradeError(channel.UpgradeSequence, err) } + // verify the counterparty channel state containing the upgrade sequence + if err := k.connectionKeeper.VerifyChannelState( + ctx, + connection, + proofHeight, proofChannel, + channel.Counterparty.PortId, + channel.Counterparty.ChannelId, + counterpartyChannel, + ); err != nil { + return errorsmod.Wrap(err, "failed to verify counterparty channel state") + } + + // verifies the proof that a particular proposed upgrade has been stored in the upgrade path of the counterparty + if err := k.connectionKeeper.VerifyChannelUpgrade( + ctx, + channel.Counterparty.PortId, + channel.Counterparty.ChannelId, + connection, + counterpartyUpgrade, + proofUpgrade, proofHeight, + ); err != nil { + return errorsmod.Wrap(err, "failed to verify counterparty upgrade") + } + if err := k.startFlushUpgradeHandshake(ctx, portID, channelID, upgrade.Fields, counterpartyChannel, counterpartyUpgrade, proofChannel, proofUpgrade, proofHeight); err != nil { return err diff --git a/modules/core/04-channel/keeper/upgrade_test.go b/modules/core/04-channel/keeper/upgrade_test.go index d01515c4a8e..305278f4496 100644 --- a/modules/core/04-channel/keeper/upgrade_test.go +++ b/modules/core/04-channel/keeper/upgrade_test.go @@ -525,12 +525,29 @@ func (suite *KeeperTestSuite) TestChanUpgradeAck() { types.ErrUpgradeNotFound, }, { - "fails due to proof verification failure, counterparty upgrade connection hops are tampered with", + "fails due to upgrade incompatibility", func() { counterpartyUpgrade.Fields.ConnectionHops = []string{ibctesting.InvalidID} }, types.NewUpgradeError(1, types.ErrIncompatibleCounterpartyUpgrade), }, + { + "fails due to proof verification failure, counterparty channel ordering does not match expected ordering", + func() { + channel := path.EndpointA.GetChannel() + channel.Ordering = types.ORDERED + path.EndpointA.SetChannel(channel) + }, + commitmenttypes.ErrInvalidProof, + }, + { + "fails due to proof verification failure, counterparty update has unexpected sequence", + func() { + // Decrementing LatestSequenceSend is sufficient to cause the proof to fail. + counterpartyUpgrade.LatestSequenceSend-- + }, + commitmenttypes.ErrInvalidProof, + }, { "startFlushUpgradeHandshake fails due to mismatch in upgrade ordering", func() {