add security param check to remove schedule

neutron-org · Sep 4, 2024 · 2d2a169 · 2d2a169
1 parent 46207d9
commit 2d2a169
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/contracts/neutron_chain_manager.wasm b/contracts/neutron_chain_manager.wasm
diff --git a/x/cron/keeper/msg_server.go b/x/cron/keeper/msg_server.go
@@ -47,12 +47,15 @@ func (k msgServer) RemoveSchedule(goCtx context.Context, req *types.MsgRemoveSch
 		return nil, errors.Wrap(err, "failed to validate MsgRemoveSchedule")
 	}
 
+	ctx := sdk.UnwrapSDKContext(goCtx)
+
+	params := k.keeper.GetParams(ctx)
+
 	authority := k.keeper.GetAuthority()
-	if authority != req.Authority {
-		return nil, errors.Wrapf(sdkerrors.ErrInvalidRequest, "invalid authority; expected %s, got %s", authority, req.Authority)
+	if authority != req.Authority && params.SecurityAddress != req.Authority {
+		return nil, errors.Wrapf(sdkerrors.ErrInvalidRequest, "invalid authority: only admin or security dao can remove schedule; expected %s or %s, got %s", authority, params.SecurityAddress, req.Authority)
 	}
 
-	ctx := sdk.UnwrapSDKContext(goCtx)
 	k.keeper.RemoveSchedule(ctx, req.Name)
 
 	return &types.MsgRemoveScheduleResponse{}, nil