Submitted by oakcobalt, also found by 0xAlix2 and gxh191
https://github.com/initia-labs/miniwasm/blob/ed1728e2ad51f214ee0191dde62d96a074f55f1f/x/tokenfactory/types/msgs.go#L145-L148
setBeforeSendHook allows disabling an existing token transfer hook (deleting a store) by setting an empty cosmwasmAddress. However, this functionality is not available due to a vulnerable validate flow.
We see the intention of allowing empty cosmwasmAddress to disable a hook in before_send::setBeforeSendHook. This is also consistent with osmosis token factory where empty cosmwasmAddress is a valid input to delete the current store.
https://github.com/initia-labs/miniwasm/blob/ed1728e2ad51f214ee0191dde62d96a074f55f1f/x/tokenfactory/keeper/before_send.go#L26-L27
However, we see in msg_server::SetBeforeSendHook -> msgs::validate, empty cosmwasmAddress will always return error in validate.
https://github.com/initia-labs/miniwasm/blob/ed1728e2ad51f214ee0191dde62d96a074f55f1f/x/tokenfactory/keeper/msg_server.go#L198
https://github.com/initia-labs/miniwasm/blob/ed1728e2ad51f214ee0191dde62d96a074f55f1f/x/tokenfactory/types/msgs.go#L177-L180
Deleting an existing before send hook will always error out.
In func (m MsgSetBeforeSendHook) Validate, add a bypass for m.CosmwasmAddress == .
hoon (Initia) confirmed and commented via duplicate issue S-18:
Initia mitigated:
Status: Mitigation confirmed. Full details in reports from berndartmueller, 0xAlix2 and Franfran.
