fix: Expedited Governance Proposal Whitelist Bypass via authz Wrapping

[mattkii]

Description

The GovExpeditedProposalsDecorator only inspected top level messages, so a non-whitelisted MsgSubmitProposal marked as expedited could slip through by being wrapped inside an authz.MsgExec. That let non-whitelisted proposal types use the shortened expedited voting window that governance policy intended to reserve for the standard timeline.

The fix unwraps authz.MsgExec recursively and applies the same expedited whitelist validation to the wrapped proposals, matching the pattern already used by GovVoteDecorator.

No new dependencies.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

go test -tags=test ./ante/ -run TestGovExpeditedProposalsDecorator -v

• A non-whitelisted expedited proposal wrapped in authz.MsgExec (and nested exec(exec(...))) is now rejected
• A whitelisted expedited proposal in authz still passes, and non-expedited proposals in authz are unaffected

PR Checklist:

• Updated changelog with PR's intent
• Lint with make lint-fix

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 299ec718-5153-481e-b5d7-81780bbd596c

📥 Commits

Reviewing files that changed from the base of the PR and between 0a101b7 and c53b016.

📒 Files selected for processing (2)

• CHANGELOG.md
• ante/gov_expedited_ante.go

✅ Files skipped from review due to trivial changes (1)

• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

• ante/gov_expedited_ante.go

---

Walkthrough

This change fixes a bypass in GovExpeditedProposalsDecorator where a MsgSubmitProposal wrapped in authz.MsgExec could evade expedited-proposal whitelist validation. The decorator now recursively unpacks and validates messages within authz.MsgExec (including nested execs) via new validateMsgs and validateAuthzExec helpers. Tests were extended to cover authz-wrapped expedited proposal scenarios, and a changelog entry documents the fix.

Changes

File	Summary
ante/gov_expedited_ante.go	Adds authz import; replaces inline message scan with recursive validateMsgs/validateAuthzExec helpers to catch authz-wrapped expedited proposals.
ante/gov_expedited_ante_test.go	Adds authz import, newAuthzExec helper, and new test cases for authz-wrapped and nested authz proposal scenarios.
CHANGELOG.md	Adds an Unreleased → Fixed entry describing the authz.MsgExec bypass fix.

Estimated code review effort: 2 (Simple) | ~15 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the authz-wrapping bypass fix for expedited governance whitelist validation.
Description check	✅ Passed	The description matches the change: recursive authz.MsgExec unwrapping, tests, and changelog updates for the expedited whitelist fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/gov-expedited-whitelist-authz-bypass

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 0% with 24 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
ante/gov_expedited_ante.go	0.00%	24 Missing ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

ante/gov_expedited_ante.go (1)

50-82: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Extract a shared authz-unwrapping helper

ante/gov_expedited_ante.go and ante/gov_vote_ante.go both recurse through authz.MsgExec in the same way. Pulling that into a small helper would remove duplication and keep the bypass checks aligned.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ante/gov_expedited_ante.go` around lines 50 - 82, The authz unwrapping logic
is duplicated between
GovExpeditedProposalsDecorator.validateMsgs/validateAuthzExec and the similar
flow in gov_vote_ante.go. Extract the shared MsgExec recursion and Any unpacking
into a small helper, then call that helper from both decorators so bypass checks
and authz handling stay consistent in one place.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ante/gov_expedited_ante.go`:
- Around line 50-82: The authz unwrapping logic is duplicated between
GovExpeditedProposalsDecorator.validateMsgs/validateAuthzExec and the similar
flow in gov_vote_ante.go. Extract the shared MsgExec recursion and Any unpacking
into a small helper, then call that helper from both decorators so bypass checks
and authz handling stay consistent in one place.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 092f5b47-5165-4c8c-96d4-3681782df074

📥 Commits

Reviewing files that changed from the base of the PR and between e0d3113 and 0a101b7.

📒 Files selected for processing (3)

• CHANGELOG.md
• ante/gov_expedited_ante.go
• ante/gov_expedited_ante_test.go

[Copilot]

Pull request overview

Fixes an expedited governance proposal whitelist bypass where GovExpeditedProposalsDecorator only validated top-level messages, allowing non-whitelisted expedited MsgSubmitProposal to slip through when wrapped in authz.MsgExec.

Changes:

• Add recursive unwrapping/validation of authz.MsgExec messages in GovExpeditedProposalsDecorator.
• Add test coverage for expedited/non-expedited proposals wrapped in authz.MsgExec, including nested execs.
• Document the fix in the changelog.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
CHANGELOG.md	Documents the expedited governance whitelist bypass fix and the new recursive authz exec validation.
ante/gov_expedited_ante.go	Recursively unwraps authz.MsgExec and applies the expedited proposal whitelist validation to inner MsgSubmitProposal messages.
ante/gov_expedited_ante_test.go	Adds tests ensuring wrapped (and nested wrapped) expedited proposals are validated consistently.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.