Hermes ft-transfer accepts mismatching arguments

[adizere]

Many thanks to Jeseon Lee for reporting this bug!

Crate

ibc-relayer-cli

Summary of Bug

The command hermes tx raw ft-transfer ibc-2 ibc-0 transfer channel-0 9999 10000 -n1 -d stake never verifies that the arguments are coherent, and blindly constructs a PacketRecv even if the arguments mismatch. Concretely, the channel-port tuple transfer channel-0 which is supposedly hosted on chain ibc-0 should provide a path to chain ibc-2, but this is never verified. The channel channel-0 might be serving a path to another chain.

Version

0.2.0

Steps to Reproduce

./scripts/dev-env ~/.hermes/config.toml ibc-0 ibc-1 ibc-2
hermes create channel ibc-0 ibc-1 --port-a transfer --port-b transfer
hermes create channel ibc-0 ibc-2 --port-a transfer --port-b transfer
hermes create channel ibc-1 ibc-2 --port-a transfer --port-b transfer


# Now in order to transfer from source chain ibc-0 to dest. ibc-2 
# we should specify channel-1 on source chain. If we give channel-0 the 
# command shouldn't work because this channel is a path to ibc-1 (not ibc-2).
hermes tx raw ft-transfer ibc-2 ibc-0 transfer channel-0 9999 10000 -n1 -d stake
# The above command produces a PacketRecv destined to chain ibc-1 instead of ibc-2

Acceptance Criteria

Error should be returned in case of mismatching ft-transfer arguments.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate milestone (priority) applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned