From 83f984cd55bb42b3001c5c741614b03aa6d8b6bc Mon Sep 17 00:00:00 2001
From: Marri Harish <harishmarri551@gmail.com>
Date: Mon, 3 Jun 2024 20:43:37 +0530
Subject: [PATCH] fix(tokenfactory): disable force transfer from module
 accounts  (#173)

* add upgrade details

* fix: patch token factory force transfer msg
---
 readme.md                                |  3 ++
 x/tokenfactory/keeper/bankactions.go     |  4 +++
 x/tokenfactory/keeper/msg_server_test.go | 39 ++++++++++++++++++++++--
 3 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/readme.md b/readme.md
index 7d91217..3c2aeae 100644
--- a/readme.md
+++ b/readme.md
@@ -74,6 +74,9 @@ curl https://raw.githubusercontent.com/OmniFlix/mainnet/main/omniflixhub-1/genes
  - [v0.12.x](https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v0.12.x-upgrade.md) at block 8054200
  - [v2](https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v2-upgrade.md) at block 10428200
  - [v2.1]((https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v2.1-upgrade.md)) at block 10678600
+ - [v3]((https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v3-upgrade.md)) at block 10872800
+ - [v3.3.0]((https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v3.3.0-upgrade.md)) at block 11140000
+  - [v4]((https://github.com/OmniFlix/docs/blob/main/guides/mainnet/omniflixhub-1/upgrades/v4-upgrade.md)) at block 11914000
 
 ### Testnets
 
diff --git a/x/tokenfactory/keeper/bankactions.go b/x/tokenfactory/keeper/bankactions.go
index 319f7e2..8bcd0f9 100644
--- a/x/tokenfactory/keeper/bankactions.go
+++ b/x/tokenfactory/keeper/bankactions.go
@@ -78,6 +78,10 @@ func (k Keeper) forceTransfer(ctx sdk.Context, amount sdk.Coin, fromAddr string,
 		return err
 	}
 
+	if k.bankKeeper.BlockedAddr(fromSdkAddr) {
+		return fmt.Errorf("failed to force transfer from a blocked address: %s", fromAddr)
+	}
+
 	if k.bankKeeper.BlockedAddr(toSdkAddr) {
 		return fmt.Errorf("failed to force transfer to blocked address: %s", toSdkAddr)
 	}
diff --git a/x/tokenfactory/keeper/msg_server_test.go b/x/tokenfactory/keeper/msg_server_test.go
index 2114734..59c4051 100644
--- a/x/tokenfactory/keeper/msg_server_test.go
+++ b/x/tokenfactory/keeper/msg_server_test.go
@@ -3,10 +3,10 @@ package keeper_test
 import (
 	"fmt"
 
+	"github.com/OmniFlix/omniflixhub/v4/x/tokenfactory/types"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
-
-	"github.com/OmniFlix/omniflixhub/v4/x/tokenfactory/types"
+	govtypes "github.com/cosmos/cosmos-sdk/x/gov/types"
 )
 
 // TestMintDenomMsg tests TypeMsgMint message is emitted on a successful mint
@@ -251,3 +251,38 @@ func (suite *KeeperTestSuite) TestSetDenomMetaDataMsg() {
 		})
 	}
 }
+
+func (s *KeeperTestSuite) TestForceTransferMsg() {
+	// Create a denom
+	s.CreateDefaultDenom()
+
+	s.Run("test force transfer", func() {
+		mintAmt := sdk.NewInt64Coin(s.defaultDenom, 10)
+
+		_, _ = s.msgServer.Mint(sdk.WrapSDKContext(s.Ctx), types.NewMsgMint(s.TestAccs[0].String(), mintAmt))
+
+		govModAcc := s.App.AccountKeeper.GetModuleAccount(s.Ctx, govtypes.ModuleName)
+
+		err := s.App.BankKeeper.SendCoins(s.Ctx, s.TestAccs[0], govModAcc.GetAddress(), sdk.NewCoins(mintAmt))
+		s.Require().NoError(err)
+
+		_, err = s.msgServer.ForceTransfer(s.Ctx, types.NewMsgForceTransfer(s.TestAccs[0].String(), mintAmt, govModAcc.GetAddress().String(), s.TestAccs[1].String()))
+		s.Require().ErrorContains(err, "failed to force transfer from a blocked address")
+	})
+}
+
+func (s *KeeperTestSuite) TestForceTransferMsgAccToModule() {
+	// Create a denom
+	s.CreateDefaultDenom()
+
+	s.Run("test force transfer account to module", func() {
+		mintAmt := sdk.NewInt64Coin(s.defaultDenom, 10)
+
+		_, _ = s.msgServer.Mint(sdk.WrapSDKContext(s.Ctx), types.NewMsgMint(s.TestAccs[0].String(), mintAmt))
+
+		govModAcc := s.App.AccountKeeper.GetModuleAccount(s.Ctx, govtypes.ModuleName)
+
+		_, err := s.msgServer.ForceTransfer(s.Ctx, types.NewMsgForceTransfer(s.TestAccs[0].String(), mintAmt, s.TestAccs[0].String(), govModAcc.GetAddress().String()))
+		s.Require().ErrorContains(err, "failed to force transfer to blocked address")
+	})
+}