Feat/add ibc v2 to node

.gitignore

@@ -8,7 +8,46 @@ release/
 
 
 .hnld/
+.hnld-*/
+.hnld.bak-*/
+# Node homes from before the cbdcd -> hnld rename; still on disk locally.
+.cbdcd/
+.cbdcd-*/
+.cbdcd.bak-*/
 *.out
 *.html
 
-bin/
+bin/
+# The same binaries when a build runs without -o bin/ and drops them in the repo
+# root instead -- `go build ./...` at the root does this for every main package.
+# Anchored so only the build output is caught, not the cmd/ package directories
+# that share these names. Listed as they occur rather than pre-emptively.
+/corridord
+/qbftattestor
+/qbftproofapi
+.claude/
+
+# Per-run corridor state: attestor logs, seen-set, relay height cursors. Written
+# under $PWD by scripts/corridor/{up-corridor,autorelay}.sh (STATE_ROOT), so it
+# lands in the repo root whenever the corridor is driven from here.
+.corridor/
+
+# relayer signing keys — never commit
+# Filled-in relayer signing keys, one file per corridor leg. Glob rather than a
+# single name: a second leg means a second keys file, and a private key that is
+# only ignored if someone remembers to extend this list is not ignored.
+scripts/corridor/relayer-keys*.json*
+!scripts/corridor/relayer-keys.example.json
+
+# attestor signing keys — never commit, and never lose either. The attestor set is
+# fixed in AttestationLightClient's constructor with no setter, so a key that only
+# ever existed in a shell scrollback costs a light-client redeploy to replace.
+scripts/corridor/attestor-key*.json*
+# The same key in the Web3 keystore form cosmos/ibc-attestor reads, plus the
+# password that opens it. Both are as sensitive as the hex above: together they
+# ARE the hex, and separately neither is useful.
+scripts/corridor/attestor-keystore*
+
+
+# Working docs — kept locally, deliberately untracked
+docs/*.md

.golangci.yml

@@ -41,6 +41,14 @@ linters-settings:
     suggest-new: true
   misspell:
     locale: US
+    ignore-words:
+      # Not prose: `Misbehaviour` is a protobuf-generated type in
+      # qbftclient.pb.go, registered in x/qbftclient/codec.go, and it spells the
+      # ibc-go interface methods this module must implement --
+      # CheckForMisbehaviour and UpdateStateOnMisbehaviour. Upstream uses the
+      # British form, so it is an external contract, not a choice. Prose keeps
+      # the US locale; only the identifier is exempt.
+      - Misbehaviour
   nolintlint:
     allow-unused: false
     allow-leading-space: true

Dockerfile

@@ -15,6 +15,17 @@ RUN make build
 
 
 FROM base AS integration
+RUN make lint
+# Unit tests -- test-unit, not test-poa: the latter runs ./x/poa/... only, which
+# left x/qbftclient, x/cbdc and app/ibc/corridorpause unenforced by CI.
+RUN make test-unit
+# Integration tests
+RUN make test-integration
+# Simulation tests
+# TODO: Restore simulation tests if possible
+# RUN make test-sim-benchmark-simulation
+# RUN make test-sim-full-app-fast
+
 RUN touch /test.lock
 
 FROM golang:1.23.8 AS release

Makefile

@@ -105,6 +105,19 @@ install: go.sum
 build:
 	go build $(BUILD_FLAGS) -o ./bin/hnld ./cmd/hnld
 
+# The operator binaries a corridor leg needs, on top of the chain daemon. A
+# separate target rather than more lines in `build`: that target means "the chain
+# daemon" to scripts/ibcv2-devnet/up.sh and to the runbook's T3.2, and
+# build-rocksdb recurses into it — a corridor tool has no business being rebuilt
+# by a RocksDB chain build.
+#
+# qbftattestor is deliberately absent: the attestor runs from a published image
+# (DEC-32 adopted cosmos/ibc-attestor), and cmd/qbftattestor is the standby path.
+build-corridor: build
+	go build $(BUILD_FLAGS) -o ./bin/qbftinit ./cmd/qbftinit
+	go build $(BUILD_FLAGS) -o ./bin/qbftproofapi ./cmd/qbftproofapi
+	go build $(BUILD_FLAGS) -o ./bin/attestcheck ./cmd/attestcheck
+
 build-rocksdb:
 	# Make sure to run this command with root permission
 	CGO_ENABLED=1 CGO_CFLAGS="-I/usr/include" \
@@ -132,20 +145,28 @@ lint-fix:
 ###                                Testing                                  ###
 ###############################################################################
 EXCLUDED_POA_PACKAGES=$(shell go list ./x/poa/... | grep -v /x/poa/testutil | grep -v /x/poa/client | grep -v /x/poa/simulation | grep -v /x/poa/types)
-EXCLUDED_UNIT_PACKAGES=$(shell go list ./... | grep -v tests | grep -v testutil | grep -v tools | grep -v app | grep -v docs | grep -v cmd | grep -v /x/poa/testutil | grep -v /x/poa/client | grep -v /x/poa/simulation | grep -v /x/poa/types)
+# Anchored on /app so only the app package itself is dropped -- its sole test is
+# TestFullAppSimulation, which needs the -Enabled/-NumBlocks/-Params flags the
+# test-sim-* targets pass and panics without them. The unanchored filter this
+# replaces also dropped app/ibc/corridorpause, i.e. the corridor pause middleware.
+EXCLUDED_UNIT_PACKAGES=$(shell go list ./... | grep -v tests | grep -v testutil | grep -v tools | grep -v '/app$$' | grep -v docs | grep -v cmd | grep -v /x/poa/testutil | grep -v /x/poa/client | grep -v /x/poa/simulation | grep -v /x/poa/types)
 
 mocks:
 	@echo "--> Installing mockgen"
 	go install github.com/golang/mock/mockgen@v1.6.0
 	@echo "--> Generating mocks"
 	@./scripts/mockgen.sh
 
-test: test-poa test-integration test-sim-benchmark-simulation test-sim-full-app-fast
+test: test-unit test-integration test-sim-benchmark-simulation test-sim-full-app-fast
 
 test-integration:
 	@echo "--> Running integration testsuite"
 	@go test -mod=readonly -tags=test -v ./tests/integration
 
+test-unit:
+	@echo "--> Running unit tests"
+	@go test $(EXCLUDED_UNIT_PACKAGES)
+
 test-poa:
 	@echo "--> Running POA tests"
 	@go test $(EXCLUDED_POA_PACKAGES) 

app/app.go

@@ -13,6 +13,8 @@ import (
 	"github.com/cosmos/cosmos-sdk/client/flags"
 	"github.com/cosmos/cosmos-sdk/x/auth/posthandler"
 	"github.com/peersyst/cbdc-node/app/ante"
+	"github.com/peersyst/cbdc-node/app/ibc/corridorpause"
+	"github.com/peersyst/cbdc-node/app/ibc/ratelimitv2guard"
 
 	"github.com/ethereum/go-ethereum/common"
 
@@ -38,6 +40,7 @@ import (
 	"github.com/cosmos/gogoproto/proto"
 	ratelimit "github.com/cosmos/ibc-apps/modules/rate-limiting/v10"
 	ratelimittypes "github.com/cosmos/ibc-apps/modules/rate-limiting/v10/types"
+	ratelimitv2 "github.com/cosmos/ibc-apps/modules/rate-limiting/v10/v2"
 	ibcclienttypes "github.com/cosmos/ibc-go/v10/modules/core/02-client/types"
 	ibcconnectiontypes "github.com/cosmos/ibc-go/v10/modules/core/03-connection/types"
 	ibctesting "github.com/cosmos/ibc-go/v10/testing"
@@ -123,6 +126,7 @@ import (
 
 	ibc "github.com/cosmos/ibc-go/v10/modules/core"
 	ibcporttypes "github.com/cosmos/ibc-go/v10/modules/core/05-port/types"
+	ibcapi "github.com/cosmos/ibc-go/v10/modules/core/api"
 	ibcexported "github.com/cosmos/ibc-go/v10/modules/core/exported"
 	ibckeeper "github.com/cosmos/ibc-go/v10/modules/core/keeper"
 
@@ -132,12 +136,15 @@ import (
 	cbdctypes "github.com/peersyst/cbdc-node/x/cbdc/types"
 	poakeeper "github.com/peersyst/cbdc-node/x/poa/keeper"
 	poatypes "github.com/peersyst/cbdc-node/x/poa/types"
+	"github.com/peersyst/cbdc-node/x/qbftclient"
+	qbfttypes "github.com/peersyst/cbdc-node/x/qbftclient/types"
 
 	srvflags "github.com/cosmos/evm/server/flags"
 
 	"github.com/cosmos/evm/x/erc20"
 	erc20keeper "github.com/cosmos/evm/x/erc20/keeper"
 	erc20types "github.com/cosmos/evm/x/erc20/types"
+	erc20v2 "github.com/cosmos/evm/x/erc20/v2"
 	"github.com/cosmos/evm/x/feemarket"
 	feemarketkeeper "github.com/cosmos/evm/x/feemarket/keeper"
 	feemarkettypes "github.com/cosmos/evm/x/feemarket/types"
@@ -151,6 +158,7 @@ import (
 	transfer "github.com/cosmos/ibc-go/v10/modules/apps/transfer"
 	transferkeeper "github.com/cosmos/ibc-go/v10/modules/apps/transfer/keeper"
 	ibctransfertypes "github.com/cosmos/ibc-go/v10/modules/apps/transfer/types"
+	transferv2 "github.com/cosmos/ibc-go/v10/modules/apps/transfer/v2"
 
 	// Force-load the tracer engines to trigger registration due to Go-Ethereum v1.10.15 changes
 	_ "github.com/ethereum/go-ethereum/eth/tracers/js"
@@ -556,6 +564,14 @@ func New(
 	)
 	app.TransferKeeper.SetAddressCodec(evmaddress.NewEvmCodec(sdk.GetConfig().GetBech32AccountAddrPrefix()))
 
+	// Route v1 outbound packets through the rate limit keeper, which implements
+	// ICS4Wrapper. Constructed with the channel keeper above, the transfer keeper
+	// would send straight to core IBC and outbound quotas would never be applied
+	// (inbound is unaffected: it runs through the IBCModule stack). Only the v1
+	// send path uses the ICS4Wrapper; v2 accounting happens in ratelimitv2's
+	// OnSendPacket, so this does not double count.
+	app.TransferKeeper.WithICS4Wrapper(app.RateLimitKeeper)
+
 	transferModule := transfer.NewAppModule(app.TransferKeeper)
 	// Create the app.ICAHostKeeper
 	app.ICAHostKeeper = icahostkeeper.NewKeeper(
@@ -642,12 +658,38 @@ func New(
 		AddRoute(ibctransfertypes.ModuleName, transferStack)
 	app.IBCKeeper.SetRouter(ibcRouter)
 
+	/**** IBC V2 ****/
+
+	// create IBC v2 transfer stack from bottom to top of stack, mirroring v1
+	var transferStackV2 ibcapi.IBCModule
+	transferStackV2 = transferv2.NewIBCModule(app.TransferKeeper)
+	transferStackV2 = ratelimitv2.NewIBCMiddleware(app.RateLimitKeeper, transferStackV2)
+	// ratelimitv2 passes v2 sends with no client-keyed quota silently; the guard
+	// emits an event and logs them, without blocking the packet.
+	transferStackV2 = ratelimitv2guard.NewIBCMiddleware(app.RateLimitKeeper, transferStackV2)
+	transferStackV2 = erc20v2.NewIBCMiddleware(transferStackV2, app.Erc20Keeper)
+
+	// Gov emergency stop per corridor, outermost so a paused client is refused
+	// before anything escrows, mints or converts. x/cbdc's issuance_paused does not
+	// reach IBC, and would stop domestic transfers too.
+	transferStackV2 = corridorpause.NewIBCMiddleware(app.CbdcKeeper, transferStackV2)
+
+	// Create static IBC v2 router, add transfer route, then set it (SetRouterV2 does not seal)
+	ibcRouterV2 := ibcapi.NewRouter()
+	ibcRouterV2.AddRoute(ibctransfertypes.PortID, transferStackV2)
+	app.IBCKeeper.SetRouterV2(ibcRouterV2)
+
 	clientKeeper := app.IBCKeeper.ClientKeeper
 	storeProvider := app.IBCKeeper.ClientKeeper.GetStoreProvider()
 
 	tmLightClientModule := ibctm.NewLightClientModule(appCodec, storeProvider)
 	clientKeeper.AddRoute(ibctm.ModuleName, &tmLightClientModule)
 
+	// Besu/QBFT counterparty light client. Needs no ibc-go change (AddRoute takes
+	// any exported.LightClientModule) and no param update (AllowedClients wildcard).
+	qbftLightClientModule := qbftclient.NewLightClientModule(appCodec, storeProvider)
+	clientKeeper.AddRoute(qbfttypes.ClientType, &qbftLightClientModule)
+
 	/**** Module Hooks ****/
 
 	// register hooks after all modules have been initialized
@@ -719,6 +761,11 @@ func New(
 	app.BasicModuleManager.RegisterLegacyAminoCodec(cdc)
 	app.BasicModuleManager.RegisterInterfaces(interfaceRegistry)
 
+	// The QBFT light client has no AppModule (no genesis, no state outside the
+	// client store), so its proto types are registered here; without this the codec
+	// cannot unmarshal them into ibc-go's interface types.
+	qbftclient.RegisterInterfaces(interfaceRegistry)
+
 	// NOTE: upgrade module is required to be prioritized
 	app.mm.SetOrderPreBlockers(
 		upgradetypes.ModuleName,

app/ibc/corridorpause/middleware.go

@@ -0,0 +1,143 @@
+// Package corridorpause gives governance an emergency stop for an IBC corridor.
+//
+// Why it exists: x/cbdc's issuance_paused switch is checked only in the module's
+// own mint and burn path (keeper/mint.go, keeper/burn.go). It does not touch the
+// transfer module, IBC, or the bank send path — so with issuance paused, the
+// central bank cannot mint, while tokens continue to flow across every corridor.
+// For an incident where the corridor itself is the problem, the switch everyone
+// reaches for did nothing.
+//
+// The levers that existed before this one were all wrong in some way: emptying
+// allowed_relayers works but is signed by the client creator rather than
+// governance; rate limits are percentage quotas meant for shaping flow, and
+// cannot exist before a denom has supply; freezing the client needs genuine
+// misbehavior evidence; and disabling bank sends for the denom also stops every
+// domestic transfer.
+//
+// This middleware is the missing lever: gov-controlled, per-corridor, and it
+// stops both directions.
+package corridorpause
+
+import (
+	"fmt"
+
+	sdk "github.com/cosmos/cosmos-sdk/types"
+
+	channeltypesv2 "github.com/cosmos/ibc-go/v10/modules/core/04-channel/v2/types"
+	"github.com/cosmos/ibc-go/v10/modules/core/api"
+)
+
+// EventTypeRecvPaused is emitted when an inbound packet is rejected on a paused
+// corridor. ibc-go runs OnRecvPacket in a cached context and, on failure,
+// discards the cache but re-emits its events through ConvertToErrorEvents,
+// which prefixes both the type and every attribute key. What lands on chain is
+// therefore type "ibccallbackerror-ibc_corridor_recv_paused" with attributes
+// "ibccallbackerror-client_id" and "ibccallbackerror-sequence" -- alarms must
+// subscribe to the prefixed names; the middleware cannot avoid the prefix.
+//
+// The send side deliberately emits nothing: OnSendPacket refuses by returning
+// an error, which fails the whole transaction, and baseapp keeps only ante
+// events for a failed tx -- anything emitted by the message itself is dropped.
+// x/cbdc emits cbdc_corridor_pause at the governance action instead, which is
+// the reliable signal for both directions.
+const (
+	EventTypeRecvPaused  = "ibc_corridor_recv_paused"
+	AttributeKeyClientID = "client_id"
+	AttributeKeySequence = "sequence"
+)
+
+// ParamsGetter is the slice of the cbdc keeper this middleware needs. Keeping it
+// to one method means the middleware can be tested without a keeper.
+type ParamsGetter interface {
+	IsIBCClientPaused(ctx sdk.Context, clientID string) bool
+}
+
+var _ api.IBCModule = (*IBCMiddleware)(nil)
+
+// IBCMiddleware refuses packets on paused corridors.
+type IBCMiddleware struct {
+	app    api.IBCModule
+	params ParamsGetter
+}
+
+// NewIBCMiddleware wraps app so both packet directions honor the pause.
+func NewIBCMiddleware(params ParamsGetter, app api.IBCModule) IBCMiddleware {
+	return IBCMiddleware{app: app, params: params}
+}
+
+// OnSendPacket refuses to originate a transfer on a paused corridor.
+//
+// Returning an error here fails the sending transaction, so nothing is escrowed
+// and the sender keeps their funds.
+func (im IBCMiddleware) OnSendPacket(
+	ctx sdk.Context,
+	sourceClient string,
+	destinationClient string,
+	sequence uint64,
+	payload channeltypesv2.Payload,
+	signer sdk.AccAddress,
+) error {
+	if im.params.IsIBCClientPaused(ctx, sourceClient) {
+		return fmt.Errorf("ibc corridor %s is paused by governance", sourceClient)
+	}
+	return im.app.OnSendPacket(ctx, sourceClient, destinationClient, sequence, payload, signer)
+}
+
+// OnRecvPacket rejects an inbound transfer on a paused corridor.
+//
+// It returns a *failed* recv result rather than an error, which is the important
+// choice: a failure acknowledgement travels back to the counterparty and refunds
+// its sender. Erroring instead would leave the packet stuck until it timed out,
+// holding the sender's funds in escrow on the other chain for the duration.
+//
+// The destination client is the one checked here — that is this chain's name for
+// the corridor, the same id governance pauses.
+func (im IBCMiddleware) OnRecvPacket(
+	ctx sdk.Context,
+	sourceClient string,
+	destinationClient string,
+	sequence uint64,
+	payload channeltypesv2.Payload,
+	relayer sdk.AccAddress,
+) channeltypesv2.RecvPacketResult {
+	if im.params.IsIBCClientPaused(ctx, destinationClient) {
+		ctx.EventManager().EmitEvent(sdk.NewEvent(
+			EventTypeRecvPaused,
+			sdk.NewAttribute(AttributeKeyClientID, destinationClient),
+			sdk.NewAttribute(AttributeKeySequence, fmt.Sprint(sequence)),
+		))
+		return channeltypesv2.RecvPacketResult{Status: channeltypesv2.PacketStatus_Failure}
+	}
+	return im.app.OnRecvPacket(ctx, sourceClient, destinationClient, sequence, payload, relayer)
+}
+
+// OnTimeoutPacket is deliberately not gated.
+//
+// A timeout refunds a sender whose packet was never delivered. Blocking it while
+// paused would strand exactly the funds the pause is meant to protect.
+func (im IBCMiddleware) OnTimeoutPacket(
+	ctx sdk.Context,
+	sourceClient string,
+	destinationClient string,
+	sequence uint64,
+	payload channeltypesv2.Payload,
+	relayer sdk.AccAddress,
+) error {
+	return im.app.OnTimeoutPacket(ctx, sourceClient, destinationClient, sequence, payload, relayer)
+}
+
+// OnAcknowledgementPacket is deliberately not gated, for the same reason as
+// timeouts: an acknowledgement settles a transfer that already happened. Refusing
+// it would leave in-flight packets unresolved on both sides, which is worse than
+// the state the pause was called to stop.
+func (im IBCMiddleware) OnAcknowledgementPacket(
+	ctx sdk.Context,
+	sourceClient string,
+	destinationClient string,
+	sequence uint64,
+	acknowledgement []byte,
+	payload channeltypesv2.Payload,
+	relayer sdk.AccAddress,
+) error {
+	return im.app.OnAcknowledgementPacket(ctx, sourceClient, destinationClient, sequence, acknowledgement, payload, relayer)
+}