feat: wire x/evidence into the provider app and tidy both app wirings - #73
Open
giunatale wants to merge 1 commit into
Open
Conversation
giunatale
requested review from
clockworkgr,
julienrbrt and
tbruyelle
as code owners
July 30, 2026 16:09
Contributor
Author
- wire x/evidence (keeper, store key, module, begin-blocker) into the provider app so CometBFT duplicate-vote evidence is slashed, jailed, and tombstoned; add a full-app test that asserts that path end to end - app-wiring hygiene: drop the dead gov keeper and unused SetGovKeeper, add RedundantRelayDecorator to the provider ante, de-dup the consumer params module, strip gentx/collect-gentxs from the consumer daemon, remove the testpb wiring and the example vaas-v1-to-v2 upgrade handler, check the SetModuleVersionMap error, capture the zero-height export errors, and clean up the command-root cosmetics - register amino-json for the provider and consumer module messages so Ledger and legacy signing work - return proper gRPC errors (status.Error, nil-request guards) from the consumer provider-info and staking queries - extend the make test target to the app module: app/ is its own Go module, so the root go list ./... never reached it and every app test (starting with the one added here) was silently skipped by CI - extend make lint the same way, plus lint-fix and vulncheck, and give rundep an absolute modfile path so devdeps still resolves from inside app/; golangci-lint had never walked the app module, which was hiding 16 issues - fix all 16: gci import order in 9 files, the two append(authtx.DefaultSignModes, ...) calls that grew a package-level slice shared with every other caller, the unused jailAllowedAddrs parameter on the consumer prepForZeroHeightGenesis (a consumer wires no staking module, so it has nothing to jail), the always-nil error returned by enrichAutoCliOpts on both command roots, and two nolint directives written with a leading space
giunatale
force-pushed
the
giunatale/feat/provider-evidence-and-app-wiring
branch
from
July 31, 2026 18:41
3538422 to
9683cd3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reference provider app never wired
x/evidence, so a provider-nativedouble-sign (CometBFT duplicate-vote evidence) was silently unpunished — the
mock app must be faithful to what a real embedding chain needs, or localnet and
e2e exercise a security model that doesn't exist.
What
x/evidenceinto the provider app: keeper, store key, module, and thebegin-blocker that consumes CometBFT duplicate-vote evidence and routes it to
slashing — slash, jail, tombstone.
DUPLICATE_VOTEevidence throughFinalizeBlockand asserts the validator is slashed, jailed, and tombstoned(and that it was not before the wiring).
setter; add the IBC redundant-relay ante decorator on the provider; de-dup
the consumer's params module registration; strip gentx/collect-gentxs from
the consumer daemon (a consumer's validator set comes from the provider, not
gentxs); remove test-only protobuf services from production binaries; delete
an example upgrade handler; check the
SetModuleVersionMaperror; capturepreviously swallowed zero-height export errors; command-root cosmetics.
work.
the provider-info and staking queries.
Note for embedding chains: any real provider chain must wire
x/evidencethesame way, or provider-native equivocation goes unpunished (also stated in the
security-model documentation).
The
app/module is now actually covered by CIapp/is a separate Go module, and bothmake testandmake lintonly walkedthe root module —
go list ./...does not cross module boundaries. So every testin the app module, starting with the one added here, had never run in CI, and the
module's code had never been linted. Both targets now cover it (as does
vulncheck), and the 16 findings that surfaced the first time the app module waslinted are fixed on their merits rather than annotated away: the two
appendAssignhits were growing a shared package-level slice and now clone it,the
unparamhits had genuinely dead parameters removed (a consumer chain wiresno staking, so there is nothing to jail), and the two malformed
nolintdirectives were reformatted. No new suppressions.
Testing
The new full-app evidence test plus build, lint, and the full unit suite,
all green.