Govshuttle module does not register its transaction MsgServer

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-05-canto/blob/d1d51b2293d4689f467b8b1c82bba84f8f7ea008/canto-main/x/govshuttle/module.go#L127

Vulnerability details

The x/govshuttle module in canto-main defines and handles two messages that can be emitted by a governance proposal:

• MsgLendingMarketProposal
• MsgTreasuryProposal

However, because the module only registers the QueryServer (and not its MsgServer) in its RegisterServices function,
causing no message to be routed to its message server:

func (am AppModule) RegisterServices(cfg module.Configurator) {
	types.RegisterQueryServer(cfg.QueryServer(), am.keeper)
}

If we compare this with another module that can handle messages, for example CSR, we see that this is the place for
registering the MsgServer where transactional messages are routed to:

func (am AppModule) RegisterServices(cfg module.Configurator) {
	types.RegisterMsgServer(cfg.MsgServer(), am.keeper)
	types.RegisterQueryServer(cfg.QueryServer(), am.keeper)
}

Impact

Successful governance actions that include a LendingMarketProposal or TreasuryProposal will fail to execute because
no handler is provided for them.

Proof of Concept

To reproduce the issue it is sufficient to create and approve a proposal among the affected ones.

Tools Used

Code review

Recommended Mitigation Steps

Consider adding a RegisterMsgServer call in the x/govshuttle RegisterService callback.

Assessed type

Other

[thebrittfactor]

Warden will be acting as the judge for this audit and therefore, has agreed to forfeit their submissions and will not be eligible for awards for this audit.

[dudong2]

• Label
  • sponsor confirmed
• Reasoning
  • As your description, the MsgServer isn't not registered about govshuttle module.
    Even if gov proposal that include a LendingMarketProposal or TreasuryProposal is passed, the msgs are not executed because there is no handler registered.
• Severity
  • Mid
• Patch
  • We will patch this before the v0.50 production release.

[c4-judge]

3docSec marked the issue as satisfactory

[c4-judge]

3docSec marked the issue as selected for report

[thebrittfactor]

For transparency, staff have added the appropriate sponsor label, per discord confirmation and this comment from the sponsor team.