From ecc2d188a95dccb3282e3391cb91f9e560733d9e Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Thu, 12 Dec 2024 21:33:00 -0500
Subject: [PATCH] fix(feetiers): Reject malformed address in query (backport
 #2653) (#2654)

Co-authored-by: Teddy Ding <teddy@dydx.exchange>
---
 protocol/x/feetiers/client/cli/query_test.go  | 6 +++++-
 protocol/x/feetiers/keeper/grpc_query.go      | 6 ++++++
 protocol/x/feetiers/keeper/grpc_query_test.go | 9 ++++++++-
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/protocol/x/feetiers/client/cli/query_test.go b/protocol/x/feetiers/client/cli/query_test.go
index 8e175be906..cfeb08fc4d 100644
--- a/protocol/x/feetiers/client/cli/query_test.go
+++ b/protocol/x/feetiers/client/cli/query_test.go
@@ -56,7 +56,11 @@ func TestQueryPerpetualFeeParams(t *testing.T) {
 func TestQueryUserFeeTier(t *testing.T) {
 	net, ctx := setupNetwork(t)
 
-	out, err := clitestutil.ExecTestCLICmd(ctx, cli.CmdQueryUserFeeTier(), []string{"alice"})
+	out, err := clitestutil.ExecTestCLICmd(
+		ctx,
+		cli.CmdQueryUserFeeTier(),
+		[]string{"dydx199tqg4wdlnu4qjlxchpd7seg454937hjrknju4"},
+	)
 
 	require.NoError(t, err)
 	var resp types.QueryUserFeeTierResponse
diff --git a/protocol/x/feetiers/keeper/grpc_query.go b/protocol/x/feetiers/keeper/grpc_query.go
index f0fde6e447..7d785c2f17 100644
--- a/protocol/x/feetiers/keeper/grpc_query.go
+++ b/protocol/x/feetiers/keeper/grpc_query.go
@@ -3,6 +3,8 @@ package keeper
 import (
 	"context"
 
+	sdk "github.com/cosmos/cosmos-sdk/types"
+
 	"github.com/dydxprotocol/v4-chain/protocol/lib"
 	"github.com/dydxprotocol/v4-chain/protocol/x/feetiers/types"
 	"google.golang.org/grpc/codes"
@@ -42,6 +44,10 @@ func (k Keeper) UserFeeTier(
 	}
 
 	ctx := lib.UnwrapSDKContext(c, types.ModuleName)
+
+	if _, err := sdk.AccAddressFromBech32(req.User); err != nil {
+		return nil, status.Error(codes.InvalidArgument, "invalid bech32 address")
+	}
 	index, tier := k.getUserFeeTier(ctx, req.User)
 	return &types.QueryUserFeeTierResponse{
 		Index: index,
diff --git a/protocol/x/feetiers/keeper/grpc_query_test.go b/protocol/x/feetiers/keeper/grpc_query_test.go
index ff14306de2..3ddcb9d250 100644
--- a/protocol/x/feetiers/keeper/grpc_query_test.go
+++ b/protocol/x/feetiers/keeper/grpc_query_test.go
@@ -58,7 +58,7 @@ func TestUserFeeTier(t *testing.T) {
 	}{
 		"Success": {
 			req: &types.QueryUserFeeTierRequest{
-				User: "alice",
+				User: "dydx199tqg4wdlnu4qjlxchpd7seg454937hjrknju4",
 			},
 			res: &types.QueryUserFeeTierResponse{
 				Index: 0,
@@ -78,6 +78,13 @@ func TestUserFeeTier(t *testing.T) {
 			res: nil,
 			err: status.Error(codes.InvalidArgument, "invalid request"),
 		},
+		"Malformed address": {
+			req: &types.QueryUserFeeTierRequest{
+				User: "alice",
+			},
+			res: nil,
+			err: status.Error(codes.InvalidArgument, "invalid bech32 address"),
+		},
 	} {
 		t.Run(name, func(t *testing.T) {
 			res, err := k.UserFeeTier(ctx, tc.req)