Invalid CosmWasm Core Contract Implementation of TransferFees Payload

[joelsmith-2019]

I was looking through the white papers to determine how the TransferFees payload should be structured and noticed it did not match the implementation in the CosmWasm Core Contract.

Links:

• Whitepaper Docs: https://github.com/wormhole-foundation/wormhole/blob/main/whitepapers/0004_message_publishing.md?plain=1#L103-L115
• CosmWasm Implementation: https://github.com/wormhole-foundation/wormhole/blob/main/cosmwasm/contracts/wormhole/src/state.rs#L386-L397

If you notice in the whitepaper, it defines the struct with the Amount first and then the Recipient. However, the CosmWasm Core Contract defines the structure as Recipient first and then Amount.

[evan-gray]

Worth noting that there are likely other implementations of this governance across the other runtimes. For example, Solana appears to conform to the whitepaper.

wormhole/solana/bridge/program/src/types.rs

Lines 188 to 194 in 56cf37a

	pub struct GovernancePayloadTransferFees {
	// Amount to be transferred
	pub amount: U256,
	// Recipient
	pub to: ForeignAddress,
	}

[evan-gray]

Other implementations

✅ Algorand

wormhole/algorand/wormhole_core.py

Lines 283 to 301 in 83224c5

	[a.load() == Int(4), Seq([
	off.store(off.load() + Int(1)),
	MagicAssert(tchain.load() == Bytes("base16", "0008")),
	off.store(off.load() + Int(26)),
	fee.store(Btoi(Extract(Txn.application_args[1], off.load(), Int(8)))),
	off.store(off.load() + Int(8)),
	dest.store(Extract(Txn.application_args[1], off.load(), Int(32))),
	InnerTxnBuilder.Begin(),
	InnerTxnBuilder.SetFields(
	{
	TxnField.type_enum: TxnType.Payment,
	TxnField.receiver: dest.load(),
	TxnField.amount: fee.load(),
	TxnField.fee: Int(0),
	}
	),
	InnerTxnBuilder.Submit(),
	])]

❓ Aptos

I couldn't immediately find where SetMessageFee or TransferFees are handled.

❌ CosmWasm

wormhole/cosmwasm/contracts/wormhole/src/state.rs

Lines 386 to 397 in 83224c5

	impl TransferFee {
	pub fn deserialize(data: &[u8], fee_denom: String) -> StdResult<Self> {
	let recipient = data.get_address(0);
	let (_, amount) = data.get_u256(32);
	let amount = Coin {
	denom: fee_denom,
	amount: Uint128::new(amount),
	};
	Ok(TransferFee { amount, recipient })
	}
	}

✅ Ethereum

wormhole/ethereum/contracts/GovernanceStructs.sol

Lines 139 to 161 in 83224c5

	/// @dev Parse a transferFees (action 4) with minimal validation
	function parseTransferFees(bytes memory encodedTransferFees) public pure returns (TransferFees memory tf) {
	uint index = 0;
	tf.module = encodedTransferFees.toBytes32(index);
	index += 32;
	tf.action = encodedTransferFees.toUint8(index);
	index += 1;
	require(tf.action == 4, "invalid TransferFees");
	tf.chain = encodedTransferFees.toUint16(index);
	index += 2;
	tf.amount = encodedTransferFees.toUint256(index);
	index += 32;
	tf.recipient = encodedTransferFees.toBytes32(index);
	index += 32;
	require(encodedTransferFees.length == index, "invalid TransferFees");
	}

✅ Near

wormhole/near/contracts/wormhole/src/lib.rs

Lines 302 to 325 in 83224c5

	fn handle_transfer_fee(
	self: &mut Wormhole,
	_vaa: &state::ParsedVAA,
	payload: &[u8],
	deposit: Balance,
	) -> PromiseOrValue<bool> {
	let (_, amount) = payload.get_u256(0);
	let destination = payload.get_bytes32(32).to_vec();
	if amount > self.bank {
	env::panic_str("bankUnderFlow");
	}
	// We only support addresses 32 bytes or shorter... No, we don't
	// support hash addresses in this governance message
	let d = AccountId::new_unchecked(get_string_from_32(&destination));
	if (deposit + amount) > 0 {
	self.bank -= amount;
	PromiseOrValue::Promise(Promise::new(d).transfer(deposit + amount))
	} else {
	PromiseOrValue::Value(true)
	}
	}

✅ Solana

wormhole/solana/bridge/program/src/types.rs

Lines 188 to 194 in 56cf37a

	pub struct GovernancePayloadTransferFees {
	// Amount to be transferred
	pub amount: U256,
	// Recipient
	pub to: ForeignAddress,
	}

✅ Sui

wormhole/sui/wormhole/sources/governance/transfer_fee.move

Lines 84 to 99 in 83224c5

	fun deserialize(payload: vector<u8>): TransferFee {
	let cur = cursor::new(payload);
	// This amount cannot be greater than max u64.
	let amount = bytes32::to_u64_be(bytes32::take_bytes(&mut cur));
	// Recipient must be non-zero address.
	let recipient = external_address::take_nonzero(&mut cur);
	cursor::destroy_empty(cur);
	TransferFee {
	amount: (amount as u64),
	recipient: external_address::to_address(recipient)
	}
	}

❌ Terra

To be expected, as this was the source for CosmWasm

wormhole/terra/contracts/wormhole/src/state.rs

Lines 348 to 359 in 83224c5

	impl TransferFee {
	pub fn deserialize(data: &[u8]) -> StdResult<Self> {
	let recipient = data.get_address(0);
	let (_, amount) = data.get_u256(32);
	let amount = Coin {
	denom: String::from(FEE_DENOMINATION),
	amount: Uint128::new(amount),
	};
	Ok(TransferFee { amount, recipient })
	}
	}

❔ Wormchain Module

Unsupported

wormhole/wormchain/x/wormhole/keeper/msg_server_execute_governance_vaa.go

Lines 62 to 63 in 83224c5

	default:
	return nil, types.ErrUnknownGovernanceAction