Deserializing untrusted cosmos transactions with the legacy amino codec can crash the program

[crodriguezvega]

This issue was found by Trail of Bits during the audit of ICS27 Interchain Accounts

Problem Definition

The DeserializeCosmosTx function can panic and crash the program if it is used with the
legacy amino codec and a specially crafted input. We found this bug by fuzzing the DeserializeCosmosTx function with the legacy amino and protobuf codecs.

This problem can be reproduced with the test

func (suite *TypesTestSuite) TestDeserializeCosmosTxNotCrashes() {
    cdc := codec.NewLegacyAmino()
    marshaler := codec.NewAminoCodec(cdc)
    types.DeserializeCosmosTx(marshaler, []byte{0x10, 0})
}

which can be added directly to ibc-go/modules/apps/27-interchain-accounts/types/codec_test.go file.

Proposal

Investigate and fix the issue that causes the DeserializeCosmosTx function to panic and crash the program when it is used with the legacy amino codec and called with untrusted input. Alternatively, if the function is not intended to be used with untrusted input, add a documentation string that explains this intention and the risks associated with passing untrusted input to this function.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged/assigned

[crodriguezvega]

Ensure that amino codec is not used for deserializing Cosmos TX and update documentation.