remove capability authentication checks in core handlers that are routed from ICS 26

spec/app/ics-020-fungible-token-transfer/README.md

@@ -23,6 +23,10 @@ Users of a set of chains connected over the IBC protocol might wish to utilise a
 
 The IBC handler interface & IBC routing module interface are as defined in [ICS 25](../../core/ics-025-handler-interface) and [ICS 26](../../core/ics-026-routing-module), respectively.
 
+`channelCapabilityPath` is as defined in [ICS 4](../../core/ics-004-channel-and-packet-semantics).
+
+`claimCapability` is as defined in [ICS 5](../../core/ics-005-port-allocation).
+
 ### Desired Properties
 
 - Preservation of fungibility (two-way peg).
@@ -121,6 +125,7 @@ Both machines `A` and `B` accept new channels from any module on another machine
 
 ```typescript
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -134,6 +139,8 @@ function onChanOpenInit(
   // if empty, we return the default transfer version to core IBC
   // as the version for this channel
   abortTransactionUnless(version === "ics20-1" || version === "")
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   // allocate an escrow address
   channelEscrowAddresses[channelIdentifier] = newAddress()
   return "ics20-1", nil
@@ -142,6 +149,7 @@ function onChanOpenInit(
 
 ```typescript
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -153,6 +161,8 @@ function onChanOpenTry(
   abortTransactionUnless(order === UNORDERED)
   // assert that version is "ics20-1"
   abortTransactionUnless(counterpartyVersion === "ics20-1")
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   // allocate an escrow address
   channelEscrowAddresses[channelIdentifier] = newAddress()
   // return version that this chain will use given the

spec/app/ics-027-interchain-accounts/README.md

@@ -28,6 +28,10 @@ ICS-27 Interchain Accounts outlines a cross-chain account management protocol bu
 
 The IBC handler interface & IBC relayer module interface are as defined in [ICS-25](../../core/ics-025-handler-interface) and [ICS-26](../../core/ics-026-routing-module), respectively.
 
+`channelCapabilityPath` is as defined in [ICS 4](../../core/ics-004-channel-and-packet-semantics).
+
+`claimCapability` is as defined in [ICS 5](../../core/ics-005-port-allocation).
+
 ### Desired properties
 
 - Permissionless: An interchain account may be created by any actor without the approval of a third party (e.g. chain governance). Note: Individual implementations may implement their own permissioning scheme, however the protocol must not require permissioning from a trusted party to be secure.
@@ -384,6 +388,7 @@ An interchain account module will accept new channels from any module on another
 ```typescript
 // Called on Controller Chain by InitInterchainAccount
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -421,7 +426,7 @@ function onChanOpenInit(
     }
     version = marshalJSON(metadata)
   }
-
+  
   // only open the channel if:
   // - there is no active channel already set (with status OPEN)
   // OR
@@ -438,6 +443,9 @@ function onChanOpenInit(
     abortTransactionUnless(previousOrder === order)
     previousMetadata = UnmarshalJSON(activeChannel.version)
     abortTransactionUnless(previousMetadata === metadata)
+  } else {
+    // claim channel capability
+    claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   }
 
   return version, nil
@@ -447,6 +455,7 @@ function onChanOpenInit(
 ```typescript
 // Called on Host Chain by Relayer
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,

spec/app/ics-028-cross-chain-validation/methods.md

@@ -571,6 +571,7 @@ function CreateConsumerClient(p: ConsumerAdditionProposal) {
 // PCF: Provider Chain Function
 // implements the ModuleCallbacks interface defined in ICS26
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -601,6 +602,7 @@ function onChanOpenInit(
 // PCF: Provider Chain Function
 // implements the ModuleCallbacks interface defined in ICS26
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -621,6 +623,9 @@ function onChanOpenTry(
     // assert that the counterpartyVersion matches the expected version
     abortTransactionUnless(counterpartyVersion == ccvVersion)
 
+    // claim channel capability
+    claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
+
     // get the client state associated with the underlying client
     channelEnd = provableStore.get("channelEnds/ports/{portIdentifier}/channels/{channelIdentifier}")
     abortTransactionUnless(channelEnd != nil AND len(channelEnd.connectionHops) == 1)
@@ -888,6 +893,7 @@ function InitGenesis(gs: ConsumerGenesisState): [ValidatorUpdate] {
 // CCF: Consumer Chain Function
 // implements the ModuleCallbacks interface defined in ICS26
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -910,6 +916,9 @@ function onChanOpenInit(
     // the expected consumer port ID
     abortTransactionUnless(counterpartyPortIdentifier == ProviderPortId)
 
+    // claim channel capability
+    claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
+
     // require that the client ID of the client associated 
     // with this channel matches the expected provider client id
     channelEnd = provableStore.get("channelEnds/ports/{portIdentifier}/channels/{channelIdentifier}")
@@ -947,6 +956,7 @@ function onChanOpenInit(
 // CCF: Consumer Chain Function
 // implements the ModuleCallbacks interface defined in ICS26
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,

spec/app/ics-029-fee-payment/README.md

@@ -247,6 +247,7 @@ The fee middleware's handshake callbacks ensure that both modules agree on compa
 
 ```typescript
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -262,6 +263,7 @@ function onChanOpenInit(
         if err != nil {
             // call the underlying applications OnChanOpenInit callback
             return app.onChanOpenInit(
+                capability,
                 order,
                 connectionHops,
                 portIdentifier,
@@ -288,6 +290,7 @@ function onChanOpenInit(
     // if the version string is empty, OnChanOpenInit is expected to return
     // a default version string representing the version(s) it supports
     appVersion, err = app.onChanOpenInit(
+        capability,
         order,
         connectionHops,
         portIdentifier,
@@ -309,6 +312,7 @@ function onChanOpenInit(
 }
 
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -323,6 +327,7 @@ function onChanOpenTry(
     if err != nil {
         // call the underlying application's OnChanOpenTry callback
         return app.onChanOpenTry(
+            capability,
             order,
             connectionHops,
             portIdentifier,
@@ -341,6 +346,7 @@ function onChanOpenTry(
 
     // call the underlying application's OnChanOpenTry callback
     appVersion, err = app.onChanOpenTry(
+        capability,
         order,
         connectionHops,
         portIdentifier,

spec/app/ics-030-middleware/README.md

@@ -99,6 +99,7 @@ interface ICS4Wrapper {
 
 ```typescript
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -114,6 +115,7 @@ function onChanOpenInit(
         if err != nil {
             // call the underlying application's onChanOpenInit callback
             return app.onChanOpenInit(
+                capability,
                 order,
                 connectionHops,
                 portIdentifier,
@@ -138,6 +140,7 @@ function onChanOpenInit(
     // if the version string is empty, OnChanOpenInit is expected to return
     // a default version string representing the version(s) it supports
     appVersion, err = app.OnChanOpenInit(
+        capability,
         order,
         connectionHops,
         portIdentifier,
@@ -161,6 +164,7 @@ function onChanOpenInit(
 }
 
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -175,6 +179,7 @@ function onChanOpenTry(
     if err != nil {
         // call the underlying application's OnChanOpenTry callback
         return app.onChanOpenTry(
+            capability,
             order,
             connectionHops,
             portIdentifier,
@@ -195,6 +200,7 @@ function onChanOpenTry(
 
     // call the underlying application's OnChanOpenTry callback
     appVersion, err = app.OnChanOpenTry(
+        capability,
         order,
         connectionHops,
         portIdentifier,

spec/app/ics-100-atomic-swap/README.md

@@ -36,6 +36,10 @@ For example, a token exchange would require only one transaction from a user, co
 
 `Taker Chain`: The blockchain where a taker takes or responds to an order.
 
+`channelCapabilityPath` is as defined in [ICS 4](../../core/ics-004-channel-and-packet-semantics).
+
+`claimCapability` is as defined in [ICS 5](../../core/ics-005-port-allocation).
+
 ### Desired Properties
 
 - `Permissionless`: no need to whitelist connections, modules, or denominations.
@@ -343,6 +347,7 @@ An fungible token swap module will accept new channels from any module on anothe
 
 ```typescript
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -357,6 +362,8 @@ function onChanOpenInit(
   // as the version for this channel
   abortTransactionUnless(version === "ics100-1" || version === "")
 
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   // allocate an escrow address
   channelEscrowAddresses[channelIdentifier] = newAddress()
 
@@ -366,6 +373,7 @@ function onChanOpenInit(
 
 ```typescript
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: [Identifier],
   portIdentifier: Identifier,
@@ -378,6 +386,8 @@ function onChanOpenTry(
   // assert that version is "ics100-1"
   abortTransactionUnless(counterpartyVersion === "ics100-1")
 
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   // allocate an escrow address
   channelEscrowAddresses[channelIdentifier] = newAddress()
 

spec/app/ics-721-nft-transfer/README.md

@@ -24,6 +24,10 @@ Users of a set of chains connected over the IBC protocol might wish to utilize a
 
 The IBC handler interface & IBC routing module interface are as defined in [ICS 25](../../core/ics-025-handler-interface) and [ICS 26](../../core/ics-026-routing-module), respectively.
 
+`channelCapabilityPath` is as defined in [ICS 4](../../core/ics-004-channel-and-packet-semantics).
+
+`claimCapability` is as defined in [ICS 5](../../core/ics-005-port-allocation).
+
 ### Desired Properties
 
 - Preservation of non-fungibility (i.e., only one instance of any token is *live* across all the IBC-connected blockchains).
@@ -222,6 +226,7 @@ Both machines `A` and `B` accept new channels from any module on another machine
 
 ```typescript
 function onChanOpenInit(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: Identifier[],
   portIdentifier: Identifier,
@@ -234,12 +239,15 @@ function onChanOpenInit(
   // assert that version is "ics721-1"
   // or relayer passed in empty version
   abortTransactionUnless(version === "ics721-1" || version === "")
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   return "ics721-1", nil
 }
 ```
 
 ```typescript
 function onChanOpenTry(
+  capability: CapabilityKey,
   order: ChannelOrder,
   connectionHops: Identifier[],
   portIdentifier: Identifier,
@@ -251,6 +259,8 @@ function onChanOpenTry(
   abortTransactionUnless(order === UNORDERED)
   // assert that version is "ics721-1"
   abortTransactionUnless(counterpartyVersion === "ics721-1")
+  // claim channel capability
+  claimCapability(channelCapabilityPath(portIdentifier, channelIdentifier), capability)
   return "ics721-1", nil
 }
 ```