move stakingmsg ante logic to tx-boundary module and add validAuthz

app/ante/ante.go

@@ -10,6 +10,7 @@ import (
 	ante "github.com/cosmos/cosmos-sdk/x/auth/ante"
 	"github.com/cosmos/cosmos-sdk/x/auth/signing"
 	tfmwKeeper "github.com/notional-labs/centauri/v4/x/transfermiddleware/keeper"
+	txBoundaryAnte "github.com/notional-labs/centauri/v4/x/tx-boundary/ante"
 	txBoundaryKeeper "github.com/notional-labs/centauri/v4/x/tx-boundary/keeper"
 )
 
@@ -32,7 +33,7 @@ func NewAnteHandler(
 		ante.NewValidateMemoDecorator(ak),
 		ante.NewConsumeGasForTxSizeDecorator(ak),
 		NewIBCPermissionDecorator(codec, tfmwKeeper),
-		NewStakingPermissionDecorator(codec, txBoundaryKeeper),
+		txBoundaryAnte.NewStakingPermissionDecorator(codec, txBoundaryKeeper),
 		ante.NewSetPubKeyDecorator(ak), // SetPubKeyDecorator must be called before all signature verification decorators
 		ante.NewValidateSigCountDecorator(ak),
 		ante.NewSigGasConsumeDecorator(ak, sigGasConsumer),

app/ante/custom_ante.go → x/tx-boundary/ante/decorate.go

@@ -3,9 +3,11 @@ package ante
 import (
 	"fmt"
 
+	errorsmod "cosmossdk.io/errors"
 	"github.com/cosmos/cosmos-sdk/codec"
 	sdk "github.com/cosmos/cosmos-sdk/types"
 
+	"github.com/cosmos/cosmos-sdk/x/authz"
 	stakingtypes "github.com/cosmos/cosmos-sdk/x/staking/types"
 	txBoundaryKeeper "github.com/notional-labs/centauri/v4/x/tx-boundary/keeper"
 )
@@ -32,28 +34,38 @@ func (g StakingPermissionDecorator) AnteHandle(
 	}
 
 	msgs := tx.GetMsgs()
-	if err = g.ValidateStakingMsg(ctx, msgs); err != nil {
+	if err = g.ValidateStakingMsgs(ctx, msgs); err != nil {
 		return ctx, err
 	}
 
 	return next(ctx, tx, simulate)
 }
 
 // ValidateStakingMsg validate
-func (g StakingPermissionDecorator) ValidateStakingMsg(ctx sdk.Context, msgs []sdk.Msg) error {
+func (g StakingPermissionDecorator) ValidateStakingMsgs(ctx sdk.Context, msgs []sdk.Msg) error {
 	for _, m := range msgs {
-		switch msg := m.(type) {
-		case *stakingtypes.MsgDelegate:
-			if err := g.validDelegateMsg(ctx, msg); err != nil {
-				return err
-			}
-		case *stakingtypes.MsgBeginRedelegate:
-			if err := g.validRedelegateMsg(ctx, msg); err != nil {
-				return err
-			}
-		default:
-			return nil
+		g.ValidateStakingMsg(ctx, m)
+	}
+	return nil
+}
+
+func (g StakingPermissionDecorator) ValidateStakingMsg(ctx sdk.Context, msg sdk.Msg) error {
+	switch msg := msg.(type) {
+
+	case *stakingtypes.MsgDelegate:
+		if err := g.validDelegateMsg(ctx, msg); err != nil {
+			return err
+		}
+	case *stakingtypes.MsgBeginRedelegate:
+		if err := g.validRedelegateMsg(ctx, msg); err != nil {
+			return err
 		}
+	case *authz.MsgExec:
+		if err := g.validAuthz(ctx, msg); err != nil {
+			return err
+		}
+	default:
+		return nil
 	}
 	return nil
 }
@@ -82,3 +94,17 @@ func (g StakingPermissionDecorator) validRedelegateMsg(ctx sdk.Context, msg *sta
 	g.txBoundary.IncrementRedelegateCount(ctx, sdk.AccAddress(msg.DelegatorAddress))
 	return nil
 }
+
+func (g StakingPermissionDecorator) validAuthz(ctx sdk.Context, execMsg *authz.MsgExec) error {
+	for _, v := range execMsg.Msgs {
+		var innerMsg sdk.Msg
+		if err := g.cdc.UnpackAny(v, &innerMsg); err != nil {
+			return errorsmod.Wrap(err, "cannot unmarshal authz exec msgs")
+		}
+		if err := g.ValidateStakingMsg(ctx, innerMsg); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}