Implement proof verification functions for Tendermint client

[yito88]

Closes: cosmos/ibc-rs#76

Description

Add proof verification functions for Tendermint client.
I referred to ibc-go implementation.
I think we need some tests and discussion. Welcome your feedback.

---

For contributor use:

• Added a changelog entry, using unclog.
• If applicable: Unit tests written, added test to CI.
• Linked to Github issue with discussion and accepted design OR link to spec that describes this work.
• Updated relevant documentation (docs/) and code comments.
• Re-reviewed Files changed in the Github PR explorer.

[hu55a1n1]

Thanks so much for this PR @yito88! 🙏 Amazing stuff! 👌

[hu55a1n1]

Sorry for the delay in getting to this @yito88. I just pushed some changes ->

• I moved the verify_height() code out of ics02 because I think it's Tendermint specific.
• I reverted to our old way of passing identifiers to verification functions instead of giving them ready-made paths because I think that is more error-prone and would require an assertion like assert!(matches!(path, Path::Connections(..))) to make sure we passed the right path.
• Also removed the ics23 file changes as they aren't required anymore.

I will continue to test/review and get back with more feedback.

[adizere]

Amazing work!

I left a bunch of improvement suggestions, none of them major. I think the PR is almost ready!

[hu55a1n1]

I tried to test this code with basecoin-rs and I see that verification is failing for ConnOpenTry proofs ->

$ RUST_BACKTRACE=1 hermes create connection ibc-0  basecoin-0
# ...
2021-12-21T19:16:55.367966Z ERROR ThreadId(01) Failed ConnTry ConnectionSide { chain: ProdChainHandle { chain_id: ChainId { id: "basecoin-0", version: 0 }, runtime_sender: Sender { .. } }, client_id: ClientId("07-tendermint-0"), connection_id: None }: 
   0: tx response event consists of an error: deliver_tx for A5AE0DDB8AE0AF6248BF97FD9BBF2378A6F38E26B265C864E0061A64DE70CE72 reports error: code=Err(2), log=Log("deliver failed with error: IBC module error\n\nCaused by:\n    ICS03 connection error\n\n    Caused by:\n       0: the client state proof verification failed for client id 07-tendermint-0\n       1: tendermint error\n       2: ics23 commitment error\n       3: proof verification failed\n\n    Location:\n        /home/hussaini/.cargo/registry/src/github.com-1ecc6299db9ec823/flex-error-0.4.4/src/tracer_impl/eyre.rs:10:9\n\nLocation:\n    /home/hussaini/.cargo/registry/src/github.com-1ecc6299db9ec823/flex-error-0.4.4/src/tracer_impl/eyre.rs:30:9")

[adizere]

Looks good, thanks Shoaib for the fixes and the follow-up issue!

Will let you merge this Shoaib 💯

[hu55a1n1]

Okay, so I spent some time again trying to debug the ConnOpenTry proof-verification failure and I see that there is another problem with ConnOpenAck verification too.

$ RUST_BACKTRACE=1 hermes create connection ibc-0 basecoin-0
# ...
2021-12-22T12:33:23.142732Z ERROR ThreadId(10) [ibc-0] estimate_gas: failed to simulate tx. propagating error to caller: gRPC call failed with status: status: InvalidArgument, message: "failed to execute message; message index: 1: connection handshake open ack failed: failed client state verification for target client: 07-tendermint-0: chained membership proof failed to verify membership of value: 0A2B2F6962632E6C69676874636C69656E74732E74656E6465726D696E742E76312E436C69656E74537461746512780A056962632D301204080110031A040880EA4922040880DF6E2A02081432003A02104842190A090801180120012A0100120C0A02000110211804200C300142190A090801180120012A0100120C0A02000110201801200130014A07757067726164654A107570677261646564494243537461746550015801 in subroot 653E3B80A1E23801DCF4485EDD8B670AF579EB22B04B4BC6172EAC6C104FF766 at index 0. Please ensure the path and value are both correct.: invalid proof: invalid request", details: [], metadata: MetadataMap { headers: {"content-type": "application/grpc"} }
2021-12-22T12:33:23.143331Z ERROR ThreadId(01) Failed ConnAck ConnectionSide { chain: ProdChainHandle { chain_id: ChainId { id: "ibc-0", version: 0 }, runtime_sender: Sender { .. } }, client_id: ClientId("07-tendermint-0"), connection_id: Some(ConnectionId("connection-0")) }: 
   0: failed during a transaction submission step to chain id ibc-0
   1: gRPC call failed with status: status: InvalidArgument, message: "failed to execute message; message index: 1: connection handshake open ack failed: failed client state verification for target client: 07-tendermint-0: chained membership proof failed to verify membership of value: 0A2B2F6962632E6C69676874636C69656E74732E74656E6465726D696E742E76312E436C69656E74537461746512780A056962632D301204080110031A040880EA4922040880DF6E2A02081432003A02104842190A090801180120012A0100120C0A02000110211804200C300142190A090801180120012A0100120C0A02000110201801200130014A07757067726164654A107570677261646564494243537461746550015801 in subroot 653E3B80A1E23801DCF4485EDD8B670AF579EB22B04B4BC6172EAC6C104FF766 at index 0. Please ensure the path and value are both correct.: invalid proof: invalid request", details: [], metadata: MetadataMap { headers: {"content-type": "application/grpc"} }

Interestingly, this is also seen on master, so I think it is unrelated to this PR. It is difficult to say whether this is a problem with basecoin-rs, but I'll continue to debug this separately and open an issue if required.

[yito88]

@hu55a1n1 Thank you so much for your help!