Merge branch 'main' into governors-no-aggregate-vp

Author: giunatale

.github/workflows/release-sims.yml

@@ -29,7 +29,7 @@ jobs:
           go-version-file: go.mod
       - name: Install runsim
         run: go install github.com/cosmos/tools/cmd/[email protected]
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -40,7 +40,7 @@ jobs:
     steps:
       - name: install runsim
         run: go install github.com/cosmos/tools/cmd/[email protected]
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -50,7 +50,7 @@ jobs:
     needs: [build, install-runsim]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -72,7 +72,7 @@ jobs:
             **/**.go
             go.mod
             go.sum
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary

.github/workflows/sim-label.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-go@v5
       - name: Install runsim
         run: go install github.com/cosmos/tools/cmd/[email protected]
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary

.github/workflows/sims.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/setup-go@v5
       - name: Install runsim
         run: go install github.com/cosmos/tools/cmd/[email protected]
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -41,7 +41,7 @@ jobs:
             **/**.go
             go.mod
             go.sum
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -65,7 +65,7 @@ jobs:
             **/**.go
             go.mod
             go.sum
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -81,7 +81,7 @@ jobs:
         - uses: actions/setup-go@v5
         - name: Install runsim
           run: go install github.com/cosmos/tools/cmd/[email protected]
-        - uses: actions/cache@v4.0.0
+        - uses: actions/cache@v4
           with:
             path: ~/go/bin
             key: ${{ runner.os }}-go-runsim-binary
@@ -92,7 +92,7 @@ jobs:
     steps:
       - name: install runsim
         run: go install github.com/cosmos/tools/cmd/[email protected]
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary
@@ -105,7 +105,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: ~/go/bin
           key: ${{ runner.os }}-go-runsim-binary

.github/workflows/test.yml

@@ -38,7 +38,7 @@ jobs:
             **/go.sum
             **/Makefile
             Makefile
-      - uses: actions/cache@v4.0.0
+      - uses: actions/cache@v4
         with:
           path: |
             ~/.cache/go-build

CHANGELOG.md

@@ -14,14 +14,32 @@
 
 ### STATE BREAKING
 
+### IMPROVEMENTS
+
 ## v2.0.0
 
 *Release date*
 
+### BUG FIXES
+
+- Fix swagger generation [#38](https://github.com/atomone-hub/atomone/pull/38)
+- Fix vuln GO-2024-3279 [#60](https://github.com/atomone-hub/atomone/pull/60)
+- Fix vuln GO-2024-3112 and GO-2024-2951 [#62](https://github.com/atomone-hub/atomone/pull/62)
+- Fix vuln GHSA-8wcc-m6j2-qxvm [#67](https://github.com/atomone-hub/atomone/pull/67)
+
 ### FEATURES
 
 - Add the photon module and use photon as the only fee denom [#57](https://github.com/atomone-hub/atomone/pull/57)
 
+### DEPENDENCIES
+
+- Upgrade CometBFT to v0.37.15 to fix securities issues (ASA-2025-001, ASA-2025-002) [#78](https://github.com/atomone-hub/atomone/pull/78)
+- Upgrade ibc-go to v7.9.2 to fix ASA-2025-004 [#84](https://github.com/atomone-hub/atomone/pull/84) [#85](https://github.com/atomone-hub/atomone/pull/85)
+
+### IMPROVEMENTS
+
+- (x/gov): override MinVotingPeriod with ldflags [#63](https://github.com/atomone-hub/atomone/pull/63)
+
 ## v1.0.0
 
 *Sep 26th, 2024*

RELEASES.md

@@ -1,3 +1,21 @@
+# v1.1.1
+
+2b6046d9da9e88821a85e094ad3fccc21359b51883c8d3b73546df234250977b  atomoned-v1.1.1-darwin-amd64
+0a288988ab470a9bf245e7e19bea917fb8134786c37163309fd47ddf8e98f773  atomoned-v1.1.1-darwin-arm64
+8462f489b293d050ce58ed1adc0e9891b540ec77e80ed20bb5c1aa7389f61221  atomoned-v1.1.1-linux-amd64
+6b55e9318437bbbce58fde03d70c1de224b6890bbd9228a2e6eed75ccfce3e4b  atomoned-v1.1.1-linux-arm64
+ea40eb0abe24d0c6d7ba7fe7f8dbc5a1c1684ad6a86e1c2282320580728ea317  atomoned-v1.1.1-windows-amd64.exe
+7924285b362b89fb4d83aba61a56c5a5346813a45d13bf902986d8aad3dba720  atomoned-v1.1.1-windows-arm64.exe
+
+# v1.0.1
+
+0ce4da89a588a898e01ec1568c5253e9f4853f90f4e588408fb6c7ffc42d3425  atomoned-v1.0.1-darwin-amd64
+f36790fa7613ae86f2c64745532a4536bc814156bb1305df5fdb6ddc44bdada8  atomoned-v1.0.1-darwin-arm64
+2b87e2965c6f614761cb9e54e271b8b7fd3f8d3344d2554e52f1c9384ce43e52  atomoned-v1.0.1-linux-amd64
+40d97ad3c8fd639ce8ed34b10a022872d124956209536f372ac85b165ecb796c  atomoned-v1.0.1-linux-arm64
+1e08f5a7b4b0f5573ef0336fbca0ceb472a8d14eb0606eb89ccf47c9d66f3999  atomoned-v1.0.1-windows-amd64.exe
+96dc79cb3e1942efa43ae1f5e9ff59c2f93536a00fa3c869b9ad6871ecda5039  atomoned-v1.0.1-windows-arm64.exe
+
 # v1.0.0
 
 9e9ba6fda17e9791d5ea38e93807cd6dbd2af3a1a3e1dc97bfae26b9cb2fb201  atomoned-v1.0.0-darwin-amd64

UPGRADING.md

@@ -103,7 +103,7 @@ case the upgrade fails and the previous chain needs to be restarted.
 ### Current runtime
 
 The AtomOne mainnet network, `atomone-1`, is currently running [AtomOne
-v1.0.0][v1]. We anticipate that operators who are running on v1.0.0, will be
+v1.1.1][v1]. We anticipate that operators who are running on v1.1.1, will be
 able to upgrade successfully. Validators are expected to ensure that their
 systems are up to date and capable of performing the upgrade. This includes
 running the correct binary and if building from source, building with the
@@ -174,13 +174,24 @@ Note that unlike the validator config change which still accepts `uatone` for
 fees, this change should be done **after** the upgrade because it is restricted
 to `uphoton` which has no supply before the upgrade.
 
+### Relayer account balance
+
+Additionally, the relayer account balance will now require `uphoton` token
+instead of `uatone` to pay the fees.
+
+Accordingly, after the upgrade, the relayer operator will have to mint some
+photons using the new `MsgMintPhoton` message, and then transfer them to the
+relayer account. Consequently it is expected that IBC will take a bit of time
+to work properly after the upgrade, until the relayer account balance is filled
+with photons.
+
 ### Method I: Manual Upgrade
 
-Make sure **AtomOne v1.0.0** is installed by either downloading a [compatible
+Make sure **AtomOne v1.1.1** is installed by either downloading a [compatible
 binary][v1], or building from source. Check the required version to build this
 binary in the `Makefile`.
 
-Run AtomOne v1.0.0 till upgrade height, the node will panic:
+Run AtomOne v1.1.1 till upgrade height, the node will panic:
 
 ```shell
 ERR UPGRADE "v2" NEEDED at height: <UPGRADE_HEIGHT>: upgrade to v2 and applying upgrade "v2" at height:<UPGRADE_HEIGHT>
@@ -199,15 +210,13 @@ continue to produce blocks.
 
 ##### Preparation
 
-- Install the latest version of Cosmovisor (`1.5.0`):
+- Install the latest version of Cosmovisor:
 
 ```shell
 go install cosmossdk.io/tools/cosmovisor/cmd/cosmovisor@latest
-cosmovisor version
-# cosmovisor version: v1.5.0
 ```
 
-- Create a `cosmovisor` folder inside `$ATOMONE_HOME` and move AtomOne `v1.0.0`
+- Create a `cosmovisor` folder inside `$ATOMONE_HOME` and move AtomOne `v1.1.1`
 into `$ATOMONE_HOME/cosmovisor/genesis/bin`:
 
 ```shell
@@ -230,7 +239,7 @@ At this moment, you should have the following structure:
 ├── current -> genesis or upgrades/<name>
 ├── genesis
 │   └── bin
-│       └── atomoned  # old: v1.0.0
+│       └── atomoned  # old: v1.1.1
 └── upgrades
     └── v2
         └── bin
@@ -286,7 +295,7 @@ challenges, the core teams, after conferring with operators and attaining
 social consensus, may choose to declare that the upgrade will be skipped.
 
 Steps to skip this upgrade proposal are simply to resume the `atomone-1`
-network with the (downgraded) v1.0.0 binary using the following command:
+network with the (downgraded) v1.1.1 binary using the following command:
 
 ```shell
 atomoned start --unsafe-skip-upgrade <UPGRADE_HEIGHT>
@@ -320,5 +329,5 @@ repeat the upgrade procedure again during the network startup. If you discover
 a mistake in the process, the best thing to do is wait for the network to start
 before correcting it.
 
-[v1]: https://github.com/atomone-hub/atomone/releases/tag/v1.0.0
+[v1]: https://github.com/atomone-hub/atomone/releases/tag/v1.1.1
 [v2]: https://github.com/atomone-hub/atomone/releases/tag/v2.0.0

docs/architecture/adr-002-photon-token.md

@@ -8,7 +8,7 @@
 
 ## Status
 
-DRAFT
+Implemented (https://github.com/atomone-hub/atomone/pull/57)
 
 ## Abstract
 
@@ -121,9 +121,7 @@ as the PHOTON balances and supply are handled by the `x/bank` module.
 
 ### Migration
 
-The PHOTON denom metadata has to be added to the `x/bank` module state (XXX while
-admittedly this record does not look very usefull, it is only used in
-queries...)
+The PHOTON denom metadata has to be added to the `x/bank` module state.
 
 ```json
 {

go.mod

@@ -11,13 +11,13 @@ require (
 	cosmossdk.io/simapp v0.0.0-20230602123434-616841b9704d
 	cosmossdk.io/tools/rosetta v0.2.1
 	github.com/chzyer/readline v1.5.1
-	github.com/cometbft/cometbft v0.37.13
+	github.com/cometbft/cometbft v0.37.15
 	github.com/cometbft/cometbft-db v0.10.0
 	github.com/cosmos/cosmos-proto v1.0.0-beta.5
 	github.com/cosmos/cosmos-sdk v0.47.15
 	github.com/cosmos/go-bip39 v1.0.0
 	github.com/cosmos/gogoproto v1.7.0
-	github.com/cosmos/ibc-go/v7 v7.8.0
+	github.com/cosmos/ibc-go/v7 v7.9.2
 	github.com/golang/mock v1.6.0
 	github.com/golang/protobuf v1.5.4
 	github.com/google/gofuzz v1.2.0
@@ -31,13 +31,12 @@ require (
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
-	github.com/stretchr/testify v1.9.0
-	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
-	golang.org/x/sync v0.8.0
-	google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142
-	google.golang.org/grpc v1.67.0
-	google.golang.org/protobuf v1.34.2
-	gopkg.in/yaml.v2 v2.4.0
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
+	golang.org/x/sync v0.10.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1
+	google.golang.org/grpc v1.68.0
+	google.golang.org/protobuf v1.36.1
 	gotest.tools/v3 v3.5.1
 	sigs.k8s.io/yaml v1.4.0
 )
@@ -79,10 +78,10 @@ require (
 	github.com/cosmos/ics23/go v0.10.0 // indirect
 	github.com/cosmos/ledger-cosmos-go v0.12.4 // indirect
 	github.com/cosmos/rosetta-sdk-go v0.10.0 // indirect
-	github.com/creachadair/taskgroup v0.10.0 // indirect
+	github.com/creachadair/taskgroup v0.13.0 // indirect
 	github.com/danieljoos/wincred v1.1.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.1.0 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.3.0 // indirect
 	github.com/desertbit/timer v0.0.0-20180107155436-c41aec40b27f // indirect
 	github.com/dgraph-io/badger/v2 v2.2007.4 // indirect
 	github.com/dgraph-io/ristretto v0.1.1 // indirect
@@ -159,9 +158,9 @@ require (
 	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.20.4 // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
 	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.59.1 // indirect
+	github.com/prometheus/common v0.60.1 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/rogpeppe/go-internal v1.11.0 // indirect
@@ -192,15 +191,15 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	go.uber.org/atomic v1.10.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
-	golang.org/x/crypto v0.27.0 // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.29.0 // indirect
-	golang.org/x/oauth2 v0.22.0 // indirect
-	golang.org/x/sys v0.25.0 // indirect
-	golang.org/x/term v0.24.0 // indirect
-	golang.org/x/text v0.18.0 // indirect
+	golang.org/x/crypto v0.31.0 // indirect
+	golang.org/x/mod v0.19.0 // indirect
+	golang.org/x/net v0.33.0 // indirect
+	golang.org/x/oauth2 v0.23.0 // indirect
+	golang.org/x/sys v0.28.0 // indirect
+	golang.org/x/term v0.27.0 // indirect
+	golang.org/x/text v0.21.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	golang.org/x/tools v0.23.0 // indirect
 	google.golang.org/api v0.171.0 // indirect
 	google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect