[CT-1202] logic to handle unauthorized maker orders when authenticato…

protocol/testutil/memclob/keeper.go

@@ -528,3 +528,7 @@ func (f *FakeMemClobKeeper) AddOrderToOrderbookSubaccountUpdatesCheck(
 ) satypes.UpdateResult {
 	return satypes.Success
 }
+
+func (f *FakeMemClobKeeper) MaybeValidateAuthenticators(ctx sdk.Context, txBytes []byte) error {
+	return nil
+}

protocol/x/accountplus/keeper/authenticators.go

@@ -10,11 +10,69 @@ import (
 	"github.com/cosmos/cosmos-sdk/telemetry"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
+	authsigning "github.com/cosmos/cosmos-sdk/x/auth/signing"
 	gogotypes "github.com/cosmos/gogoproto/types"
 	"github.com/dydxprotocol/v4-chain/protocol/lib/metrics"
+	"github.com/dydxprotocol/v4-chain/protocol/x/accountplus/lib"
 	"github.com/dydxprotocol/v4-chain/protocol/x/accountplus/types"
 )
 
+// MaybeValidateAuthenticators checks if the transaction has authenticators specified and if so,
+// validates them. It returns an error if the authenticators are not valid or removed from state.
+func (k Keeper) MaybeValidateAuthenticators(ctx sdk.Context, tx sdk.Tx) error {
+	// Check if the tx had authenticator specified.
+	specified, txOptions := lib.HasSelectedAuthenticatorTxExtensionSpecified(tx, k.cdc)
+	if !specified {
+		return nil
+	}
+
+	// The tx had authenticators specified.
+	// First make sure smart account flow is enabled.
+	if active := k.GetIsSmartAccountActive(ctx); !active {
+		return types.ErrSmartAccountNotActive
+	}
+
+	// Make sure txn is a SigVerifiableTx and get signers from the tx.
+	sigVerifiableTx, ok := tx.(authsigning.SigVerifiableTx)
+	if !ok {
+		return errors.Wrap(sdkerrors.ErrTxDecode, "invalid transaction type")
+	}
+
+	signers, err := sigVerifiableTx.GetSigners()
+	if err != nil {
+		return err
+	}
+
+	if len(signers) != 1 {
+		return errors.Wrap(types.ErrTxnHasMultipleSigners, "only one signer is allowed")
+	}
+
+	account := sdk.AccAddress(signers[0])
+
+	// Retrieve the selected authenticators from the extension and make sure they are valid, i.e. they
+	// are registered and not removed from state.
+	//
+	// Note that we only verify the existence of the authenticators here without actually
+	// runnning them. This is because all current authenticators are stateless and do not read/modify any states.
+	selectedAuthenticators := txOptions.GetSelectedAuthenticators()
+	for _, authenticatorId := range selectedAuthenticators {
+		_, err := k.GetInitializedAuthenticatorForAccount(
+			ctx,
+			account,
+			authenticatorId,
+		)
+		if err != nil {
+			return errors.Wrapf(
+				err,
+				"selected authenticator (%s, %d) is not registered or removed from state",
+				account.String(),
+				authenticatorId,
+			)
+		}
+	}
+	return nil
+}
+
 // AddAuthenticator adds an authenticator to an account, this function is used to add multiple
 // authenticators such as SignatureVerifications and AllOfs
 func (k Keeper) AddAuthenticator(

protocol/x/accountplus/types/errors.go

@@ -28,4 +28,9 @@ var (
 		5,
 		"Error initializing authenticator",
 	)
+	ErrTxnHasMultipleSigners = errorsmod.Register(
+		ModuleName,
+		6,
+		"The transaction has multiple signers",
+	)
 )

protocol/x/clob/abci_test.go

@@ -1211,8 +1211,15 @@ func TestPrepareCheckState(t *testing.T) {
 				case *types.Operation_ShortTermOrderPlacement:
 					order := operation.GetShortTermOrderPlacement()
 					tempCtx, writeCache := setupCtx.CacheContext()
-					tempCtx = tempCtx.WithTxBytes(order.Order.GetOrderHash().ToBytes())
-					_, _, err := ks.ClobKeeper.PlaceShortTermOrder(
+
+					txBuilder := constants.TestEncodingCfg.TxConfig.NewTxBuilder()
+					err := txBuilder.SetMsgs(operation.GetShortTermOrderPlacement())
+					require.NoError(t, err)
+					bytes, err := constants.TestEncodingCfg.TxConfig.TxEncoder()(txBuilder.GetTx())
+					require.NoError(t, err)
+					tempCtx = tempCtx.WithTxBytes(bytes)
+
+					_, _, err = ks.ClobKeeper.PlaceShortTermOrder(
 						tempCtx,
 						order,
 					)

protocol/x/clob/keeper/authenticators.go

@@ -0,0 +1,21 @@
+package keeper
+
+import (
+	sdk "github.com/cosmos/cosmos-sdk/types"
+)
+
+// MaybeValidateAuthenticators checks if the transaction has authenticators specified and if so,
+// validates them. It returns an error if the authenticators are not valid or removed from state.
+func (k Keeper) MaybeValidateAuthenticators(ctx sdk.Context, txBytes []byte) error {
+	// Decode the tx from the tx bytes.
+	tx, err := k.txDecoder(txBytes)
+	if err != nil {
+		return err
+	}
+
+	// Perform a light-weight validation of the authenticators via the accountplus module.
+	//
+	// Note that alternatively we could have been calling the ante handler directly on this transaction,
+	// but there are some deadlock issues that are non-trivial to resolve.
+	return k.accountPlusKeeper.MaybeValidateAuthenticators(ctx, tx)
+}

protocol/x/clob/keeper/keeper.go

@@ -44,6 +44,7 @@ type (
 		rewardsKeeper     types.RewardsKeeper
 		affiliatesKeeper  types.AffiliatesKeeper
 		revshareKeeper    types.RevShareKeeper
+		accountPlusKeeper types.AccountPlusKeeper
 
 		indexerEventManager indexer_manager.IndexerEventManager
 		streamingManager    streamingtypes.FullNodeStreamingManager

protocol/x/clob/keeper/liquidations_test.go

@@ -352,7 +352,16 @@ func TestPlacePerpetualLiquidation(t *testing.T) {
 
 			// Create all existing orders.
 			for _, order := range tc.existingOrders {
-				_, _, err := ks.ClobKeeper.PlaceShortTermOrder(ctx, &types.MsgPlaceOrder{Order: order})
+				msg := &types.MsgPlaceOrder{Order: order}
+
+				txBuilder := constants.TestEncodingCfg.TxConfig.NewTxBuilder()
+				err := txBuilder.SetMsgs(msg)
+				require.NoError(t, err)
+				bytes, err := constants.TestEncodingCfg.TxConfig.TxEncoder()(txBuilder.GetTx())
+				require.NoError(t, err)
+				ctx = ctx.WithTxBytes(bytes)
+
+				_, _, err = ks.ClobKeeper.PlaceShortTermOrder(ctx, msg)
 				require.NoError(t, err)
 			}
 
@@ -1306,7 +1315,16 @@ func TestPlacePerpetualLiquidation_PreexistingLiquidation(t *testing.T) {
 					require.NoError(t, err)
 				} else {
 					order := matchableOrder.MustGetOrder()
-					_, _, err := ks.ClobKeeper.PlaceShortTermOrder(ctx, &types.MsgPlaceOrder{Order: order.MustGetOrder()})
+					msg := &types.MsgPlaceOrder{Order: order}
+
+					txBuilder := constants.TestEncodingCfg.TxConfig.NewTxBuilder()
+					err := txBuilder.SetMsgs(msg)
+					require.NoError(t, err)
+					bytes, err := constants.TestEncodingCfg.TxConfig.TxEncoder()(txBuilder.GetTx())
+					require.NoError(t, err)
+					ctx = ctx.WithTxBytes(bytes)
+
+					_, _, err = ks.ClobKeeper.PlaceShortTermOrder(ctx, msg)
 					require.NoError(t, err)
 				}
 			}

protocol/x/clob/keeper/orders_test.go

@@ -623,7 +623,16 @@ func TestPlaceShortTermOrder(t *testing.T) {
 
 			// Create all existing orders.
 			for _, order := range tc.existingOrders {
-				_, _, err := ks.ClobKeeper.PlaceShortTermOrder(ctx, &types.MsgPlaceOrder{Order: order})
+				msg := &types.MsgPlaceOrder{Order: order}
+
+				txBuilder := constants.TestEncodingCfg.TxConfig.NewTxBuilder()
+				err := txBuilder.SetMsgs(msg)
+				require.NoError(t, err)
+				bytes, err := constants.TestEncodingCfg.TxConfig.TxEncoder()(txBuilder.GetTx())
+				require.NoError(t, err)
+				ctx = ctx.WithTxBytes(bytes)
+
+				_, _, err = ks.ClobKeeper.PlaceShortTermOrder(ctx, msg)
 				require.NoError(t, err)
 			}
 
@@ -632,6 +641,14 @@ func TestPlaceShortTermOrder(t *testing.T) {
 			ctx.MultiStore().SetTracer(traceDecoder)
 
 			msg := &types.MsgPlaceOrder{Order: tc.order}
+
+			txBuilder := constants.TestEncodingCfg.TxConfig.NewTxBuilder()
+			err = txBuilder.SetMsgs(msg)
+			require.NoError(t, err)
+			bytes, err := constants.TestEncodingCfg.TxConfig.TxEncoder()(txBuilder.GetTx())
+			require.NoError(t, err)
+			ctx = ctx.WithTxBytes(bytes)
+
 			orderSizeOptimisticallyFilledFromMatching,
 				orderStatus,
 				err := ks.ClobKeeper.PlaceShortTermOrder(ctx, msg)

protocol/x/clob/memclob/memclob.go

@@ -1624,6 +1624,24 @@ func (m *MemClobPriceTimePriority) mustPerformTakerOrderMatching(
 			continue
 		}
 
+		// Perform a lightweight check on maker orders that use the new smart account authentication flow.
+		// Note that this only applies to short term orders since short term orders go through the ante
+		// handlers one more time during `DeliverTx`.
+		if makerOrder.Order.IsShortTermOrder() {
+			txBytes := m.operationsToPropose.MustGetShortTermOrderTxBytes(makerOrder.Order)
+			err := m.clobKeeper.MaybeValidateAuthenticators(ctx, txBytes)
+			if err != nil {
+				makerOrdersToRemove = append(
+					makerOrdersToRemove,
+					OrderWithRemovalReason{
+						Order:         makerOrder.Order,
+						RemovalReason: types.OrderRemoval_REMOVAL_REASON_PERMISSIONED_KEY_EXPIRED,
+					},
+				)
+				continue
+			}
+		}
+
 		makerRemainingSize, makerHasRemainingSize := m.GetOrderRemainingAmount(ctx, makerOrder.Order)
 		if !makerHasRemainingSize {
 			panic(fmt.Sprintf("mustPerformTakerOrderMatching: maker order has no remaining amount %v", makerOrder.Order))

protocol/x/clob/types/expected_keepers.go

@@ -184,3 +184,7 @@ type RevShareKeeper interface {
 type AffiliatesKeeper interface {
 	GetAffiliateWhitelistMap(ctx sdk.Context) (map[string]uint32, error)
 }
+
+type AccountPlusKeeper interface {
+	MaybeValidateAuthenticators(ctx sdk.Context, tx sdk.Tx) error
+}

protocol/x/clob/types/mem_clob_keeper.go

@@ -115,4 +115,5 @@ type MemClobKeeper interface {
 		subaccountId satypes.SubaccountId,
 		order PendingOpenOrder,
 	) satypes.UpdateResult
+	MaybeValidateAuthenticators(ctx sdk.Context, txBytes []byte) error
 }

protocol/x/clob/types/operations_to_propose.go

@@ -475,3 +475,27 @@ func (o *OperationsToPropose) GetOperationsToPropose() []OperationRaw {
 
 	return operationRaws
 }
+
+// MustGetShortTermOrderTxBytes returns the `ShortTermOrderHashToTxBytes` for a short term order.
+// This function will panic for any of the following:
+// - the order is not a short term order.
+// - the order hash is not present in `ShortTermOrderHashToTxBytes`
+func (o *OperationsToPropose) MustGetShortTermOrderTxBytes(
+	order Order,
+) (txBytes []byte) {
+	order.OrderId.MustBeShortTermOrder()
+
+	orderHash := order.GetOrderHash()
+	bytes, exists := o.ShortTermOrderHashToTxBytes[orderHash]
+	if !exists {
+		panic(
+			fmt.Sprintf(
+				"MustGetShortTermOrderTxBytes: Order (%s) does not exist in "+
+					"`ShortTermOrderHashToTxBytes`.",
+				order.GetOrderTextString(),
+			),
+		)
+	}
+
+	return bytes
+}