From a0185df3953070ba5ebcb66735925449d1dbe729 Mon Sep 17 00:00:00 2001
From: DimitrisJim <d.f.hilliard@gmail.com>
Date: Fri, 5 Apr 2024 10:18:03 +0300
Subject: [PATCH] Merge pull request from GHSA-j496-crgh-34mx

---
 go.mod                            |  3 ++-
 modules/core/keeper/msg_server.go | 20 ++++++++++----------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/go.mod b/go.mod
index 75297d22c4e..b2c5ad918ee 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,7 @@ go 1.19
 module github.com/cosmos/ibc-go/v4
 
 retract (
+	[v4.4.1, v4.5.1] // contains ASA-2024-007 vulnerability
 	v4.4.0 // contains huckleberry vulnerability
 	v4.3.0 // contains huckleberry vulnerability
 	v4.2.1 // contains state machine breaking change
@@ -150,4 +151,4 @@ require (
 replace (
 	github.com/gogo/protobuf => github.com/regen-network/protobuf v1.3.3-alpha.regen.1
 	github.com/tendermint/tendermint => github.com/cometbft/cometbft v0.34.27
-)
+)
\ No newline at end of file
diff --git a/modules/core/keeper/msg_server.go b/modules/core/keeper/msg_server.go
index bdd078a35bd..68771967000 100644
--- a/modules/core/keeper/msg_server.go
+++ b/modules/core/keeper/msg_server.go
@@ -483,17 +483,17 @@ func (k Keeper) Timeout(goCtx context.Context, msg *channeltypes.MsgTimeout) (*c
 		return nil, sdkerrors.Wrap(err, "timeout packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	err = cbs.OnTimeoutPacket(ctx, msg.Packet, relayer)
 	if err != nil {
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},
@@ -551,6 +551,11 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout on close packet verification failed")
 	}
 
+	// Delete packet commitment
+	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
+		return nil, err
+	}
+
 	// Perform application logic callback
 	//
 	// NOTE: MsgTimeout and MsgTimeoutOnClose use the same "OnTimeoutPacket"
@@ -560,11 +565,6 @@ func (k Keeper) TimeoutOnClose(goCtx context.Context, msg *channeltypes.MsgTimeo
 		return nil, sdkerrors.Wrap(err, "timeout packet callback failed")
 	}
 
-	// Delete packet commitment
-	if err = k.ChannelKeeper.TimeoutExecuted(ctx, cap, msg.Packet); err != nil {
-		return nil, err
-	}
-
 	defer func() {
 		telemetry.IncrCounterWithLabels(
 			[]string{"ibc", "timeout", "packet"},