Merge pull request #1 from initia-labs/fix/bridge-hook

fix: bridge hook to check sender addr

app/app.go

@@ -360,7 +360,7 @@ func NewMinitiaApp(
 		runtime.NewKVStoreService(keys[opchildtypes.StoreKey]),
 		app.AccountKeeper,
 		app.BankKeeper,
-		apphook.NewEVMBridgeHook(app.EVMKeeper).Hook,
+		apphook.NewEVMBridgeHook(ac, app.EVMKeeper).Hook,
 		app.MsgServiceRouter(),
 		authorityAddr,
 		vc,

app/hook/evm.go

@@ -5,30 +5,40 @@ import (
 	"encoding/json"
 	"strings"
 
+	"cosmossdk.io/core/address"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	sdkerrors "github.com/cosmos/cosmos-sdk/types/errors"
 
 	evmkeeper "github.com/initia-labs/minievm/x/evm/keeper"
 	evmtypes "github.com/initia-labs/minievm/x/evm/types"
 )
 
 // bridge hook implementation for evm
 type EVMBridgeHook struct {
+	ac        address.Codec
 	evmKeeper *evmkeeper.Keeper
 }
 
-func NewEVMBridgeHook(evmKeeper *evmkeeper.Keeper) EVMBridgeHook {
-	return EVMBridgeHook{evmKeeper}
+func NewEVMBridgeHook(ac address.Codec, evmKeeper *evmkeeper.Keeper) EVMBridgeHook {
+	return EVMBridgeHook{ac, evmKeeper}
 }
 
 func (mbh EVMBridgeHook) Hook(ctx context.Context, sender sdk.AccAddress, msgBytes []byte) error {
-	msg := evmtypes.MsgCall{}
+	var msg evmtypes.MsgCall
 	decoder := json.NewDecoder(strings.NewReader(string(msgBytes)))
 	decoder.DisallowUnknownFields()
 	err := decoder.Decode(&msg)
 	if err != nil {
 		return err
 	}
 
+	senderAddr, err := mbh.ac.StringToBytes(msg.Sender)
+	if err != nil {
+		return err
+	} else if !sender.Equals(sdk.AccAddress(senderAddr)) {
+		return sdkerrors.ErrUnauthorized
+	}
+
 	ms := evmkeeper.NewMsgServerImpl(mbh.evmKeeper)
 	_, err = ms.Call(ctx, &msg)