imp: deny selected client types from VerifyMembership rpc (#5871) (#5877

)

* chore: add client status check to verify membership rpc

* imp: deny selected client types from VerifyMembership rpc

(cherry picked from commit 4f14cfd)

Co-authored-by: Damian Nolan <damiannolan@gmail.com>

modules/core/02-client/keeper/grpc_query.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 
@@ -341,6 +342,16 @@ func (k Keeper) VerifyMembership(c context.Context, req *types.QueryVerifyMember
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 
+	clientType, _, err := types.ParseClientIdentifier(req.ClientId)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	denyClients := []string{exported.Localhost, exported.Solomachine}
+	if slices.Contains(denyClients, clientType) {
+		return nil, status.Error(codes.InvalidArgument, errorsmod.Wrapf(types.ErrInvalidClientType, "verify membership is disabled for client types %s", denyClients).Error())
+	}
+
 	if len(req.Proof) == 0 {
 		return nil, status.Error(codes.InvalidArgument, "empty proof")
 	}

modules/core/02-client/keeper/grpc_query_test.go

@@ -713,6 +713,24 @@ func (suite *KeeperTestSuite) TestQueryVerifyMembershipProof() {
 			},
 			host.ErrInvalidID,
 		},
+		{
+			"localhost client ID is denied",
+			func() {
+				req = &types.QueryVerifyMembershipRequest{
+					ClientId: exported.LocalhostClientID,
+				}
+			},
+			types.ErrInvalidClientType,
+		},
+		{
+			"solomachine client ID is denied",
+			func() {
+				req = &types.QueryVerifyMembershipRequest{
+					ClientId: types.FormatClientIdentifier(exported.Solomachine, 1),
+				}
+			},
+			types.ErrInvalidClientType,
+		},
 		{
 			"empty proof",
 			func() {