feat(x/gov): reject proposals with self-executing authz.MsgExec messages (granter == grantee == authority) - #106
Merged
Conversation
julienrbrt
approved these changes
Jun 26, 2026
tbruyelle
reviewed
Jun 26, 2026
tbruyelle
approved these changes
Jun 26, 2026
giunatale
added a commit
to atomone-hub/atomone
that referenced
this pull request
Jun 29, 2026
This PR removes the dependency on atomone `x/gov` wrapper from `x/coredaos` in favor of using the atomone-sdk `x/gov`. This work alongside atomone-hub/atomone-sdk#106 is a prerequisite for a future-coming PR that does some further cleaning/refactoring.
giunatale
added a commit
to atomone-hub/atomone
that referenced
this pull request
Jun 30, 2026
…oredaos gov hook (#354) Now that the atomone-sdk rejects self-executing `authz.MsgExec` proposals at submission (atomone-hub/atomone-sdk#106), the AtomOne-side logic that existed to catch `MsgExec`-wrapped governance abuse is redundant. This PR consolidates the AtomOne-side proposal-submission checks accordingly: - moves the **oversight-DAO bundling prevention** out of the ante and into a coredaos gov `AfterProposalSubmission` hook - deletes the `GovSubmitProposalDecorator` ante - drops the dead `MsgExec`-flattening helper that only existed to see through wrapped proposal messages
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds inspection of proposals at
SubmitProposaltime to detect and reject nestedauthz.MsgExecmsgs that are "self-executing" i.e. wheregranter == grantee == authority.The
authzmodule acceptsMsgExecwheregranter == granteeautomatically without the need for an existing grant. In the case of gov proposals, whereauthorityis the only designated account that can execute proposal msgs, such proposals serve no purpose and can actually result in a bypass of existing rules and logic that inspect proposals such as pass threshold determination based on the proposal kind (amendment, law, ...)A maximum depth constant (set at 8 at the time of this PR) bounds the maximum nesting depth and result in rejection if this threshold is exceeded.