x/authz pruning and gas

[aaronc]

Following up from #7105 (comment), as improvements to the core x/authz implementations it would be desirable to:

• DONE support some method for pruning expired authorizations
• have a gas fee or some other financial mechanism to prevent lots of spurious authorizations from polluting state

[robert-zaremba]

Do we have any framework, guidelines or simulation about gas costs?

[robert-zaremba]

My proposal for storage is following:

1. charge small amount of gas
2. and require a stake, which will be released once we delete the storage.

This is what Ethereum simulations and research are suggesting.

[clevinson]

Let's put this in the icebox until we have a better solution for deposits for messages like this.

[yun-yeo]

@aaronc The auth module has been added as sdk module, so this will be done before v0.43.0 release?

[aaronc]

@YunSuk-Yeo actually the latest status of this conversation is that this should be done more generally with storage deposits/bonds (see #8929). As a result we have not prioritized just deleting expired grants because it only covers a subset of pruning, and instead are planning to do a more general solution in the next release. That general solution though could be a hybrid between storage deposits and expiration-based pruning.

[yun-yeo]

@aaronc so next release means v0.43.0?

Btw there are some issues

Simulation

cosmos-sdk/x/authz/simulation/operations.go

Line 252 in eb7d939

if sendAuthorization.SpendLimit.IsAllLT(coins) {

cosmos-sdk/x/authz/simulation/operations.go

Line 258 in eb7d939

if granterspendableCoins.IsAllLTE(coins) {

Both must use {}.!IsAllGTE(coins) to check the balance properly. {}.IsAllLTE(coins) only works for simulation with single stake coin. If there are more coins like atom then the comparison always return false.

Implementation

There is an attempt to delete a expired Grant, but if GetCleanAuthorization returns nil when the Grant has been expired.

cosmos-sdk/x/authz/keeper/keeper.go

Lines 181 to 184 in f2cea6a

	if grant.Expiration.Before(ctx.BlockHeader().Time) {
	k.DeleteGrant(ctx, grantee, granter, msgType)
	return nil, time.Time{}
	}

but, DispatchActions revert all state when the returned authorization is nil.

cosmos-sdk/x/authz/keeper/keeper.go

Lines 86 to 89 in f2cea6a

	authorization, _ := k.GetCleanAuthorization(ctx, grantee, granter, sdk.MsgTypeURL(msg))
	if authorization == nil {
	return nil, sdkerrors.ErrUnauthorized.Wrap("authorization not found")
	}

so don't need to call k.DeleteGrant(ctx, grantee, granter, msgType) in func GetCleanAuthoization

[aaronc]

@aaronc so next release means v0.43.0?

No a generalized pruning solution will be in the next release - v0.44. 0.43 is the current release which we're hoping to finalize ASAP.

Thanks for identifying those issues @AmauryM @robert-zaremba can you triage?

[robert-zaremba]

So, the issue of "reverting" expired grant deletion caused a bug: #10611. Ah, we didn't put enough attention to triage this task.
I'm discussing a potential solution here: #10633 (right now, the PR removes grant deletion).

[amaury1093]

Pruning has been done in #10714.

Only item left here is gas consumption to avoid polluting state. We currently didn't decide on a solution for this.

[alpe]

I am working on authz support for wasmd and was wondering about the gas consumption, too. It is too cheap currently as the time the date is stored is not taken into account. There is no incentive to optimize the grants (for contracts).

[giansalex]

Is it possible to add a MsgReject where a grantee can reject an authorization granted?

For example, in restake apps (granter is a third party account) there are many delegators who have re-delegated or undelegated all their tokens, but they do not revoke authorization. This may become relevant in cosmos-sdk 46 where authorizations may not expire.

If it is feasible, I could work on it.

[robert-zaremba]

@giansalex I think this is a good idea, and it should be rather easy to do. I don't see any security concern.