Govshuttle module does not register its transaction MsgServer

mediumCode4rena

Lines of code

https://github.com/code-423n4/2024-05-canto/blob/d1d51b2293d4689f467b8b1c82bba84f8f7ea008/canto-main/x/govshuttle/module.go#L127

Vulnerability details

The x/govshuttle module in canto-main defines and handles two messages that can be emitted by a governance proposal:

• MsgLendingMarketProposal
• MsgTreasuryProposal

However, because the module only registers the QueryServer (and not its MsgServer) in its RegisterServices function, causing no message to be routed to its message server:

go📋
func (am AppModule) RegisterServices(cfg module.Configurator) {
	types.RegisterQueryServer(cfg.QueryServer(), am.keeper)
}

If we compare this with another module that can handle messages, for example CSR, we see that this is the place for registering the MsgServer where transactional messages are routed to:

go📋
func (am AppModule) RegisterServices(cfg module.Configurator) {
	types.RegisterMsgServer(cfg.MsgServer(), am.keeper)
	types.RegisterQueryServer(cfg.QueryServer(), am.keeper)
}

Impact

Successful governance actions that include a LendingMarketProposal or TreasuryProposal will fail to execute because no handler is provided for them.

Proof of Concept

To reproduce the issue it is sufficient to create and approve a proposal among the affected ones.

Tools Used

Code review

Recommended Mitigation Steps

Consider adding a RegisterMsgServer call in the x/govshuttle RegisterService callback.

Assessed type

Other