Duplicate token security vulnerability

[musnit]

With the change to remove whitelisting, the bridge is now vulnerable to an attacker who can duplicate tokens:

An attacker can duplicate any ERC20 that has come across the bridge by creating a copy of that ERC20's contract on Ethereum and relaying over copied tokens. The copied tokens will be indistinguishable from originals on the Cosmos side due to this security vulnerability.

[okwme]

i thought we were name spacing by contract address to prevent this?

[musnit]

@okwme cosmos doesn't support long enough names to do this

[okwme]

I see your comment here discussing this: #123 (comment)

[jkbrooks]

@okwme Is this still an open now that #123 has been closed?

If not, let's remove the warning on the ReadMe. If so, what do we need to do to resolve the issue?

[musnit]

@jkbrooks still an issue. to resolve, would need to implement a custom token metadata module, either within the peggy codebase or for cosmos-sdk as a whole