[1658]: Prevent an admin from revoking their own ability to manage pe…

…rmissions.

x/exchange/msg.go

@@ -307,6 +307,9 @@ func (m MsgMarketManagePermissionsRequest) ValidateBasic() error {
 				errs = append(errs, fmt.Errorf("invalid revoke-all address %q: %w", addrStr, err))
 			}
 		}
+		if ContainsString(m.RevokeAll, m.Admin) {
+			errs = append(errs, fmt.Errorf("message administrator %s cannot revoke all of their permissions", m.Admin))
+		}
 
 		if err := ValidateAccessGrantsField("to-revoke", m.ToRevoke); err != nil {
 			errs = append(errs, err)
@@ -317,6 +320,10 @@ func (m MsgMarketManagePermissionsRequest) ValidateBasic() error {
 			if ContainsString(m.RevokeAll, ag.Address) {
 				errs = append(errs, fmt.Errorf("address %s appears in both the revoke-all and to-revoke fields", ag.Address))
 			}
+			if ag.Address == m.Admin && ag.Contains(Permission_permissions) {
+				errs = append(errs, fmt.Errorf("message administrator %s cannot revoke their own ability to manage permissions",
+					ag.Address))
+			}
 			toRevokeByAddr[ag.Address] = ag
 		}
 

x/exchange/msg_test.go

@@ -1317,6 +1317,43 @@ func TestMsgMarketManagePermissionsRequest_ValidateBasic(t *testing.T) {
 				"address " + goodAddr2 + " has both revoke and grant \"permissions\"",
 			},
 		},
+		{
+			name: "admin in revoke-all",
+			msg: MsgMarketManagePermissionsRequest{
+				Admin:     goodAdminAddr,
+				MarketId:  1,
+				RevokeAll: []string{goodAddr1, goodAdminAddr, goodAddr2},
+			},
+			expErr: []string{"message administrator " + goodAdminAddr + " cannot revoke all of their permissions"},
+		},
+		{
+			name: "admin revoking all their permissions except permissions",
+			msg: MsgMarketManagePermissionsRequest{
+				Admin:    goodAdminAddr,
+				MarketId: 1,
+				ToRevoke: []AccessGrant{
+					{
+						Address: goodAdminAddr,
+						Permissions: []Permission{Permission_settle, Permission_cancel,
+							Permission_withdraw, Permission_update, Permission_attributes},
+					},
+				},
+			},
+			expErr: nil,
+		},
+		{
+			name: "admin revoking own ability to manage permissions",
+			msg: MsgMarketManagePermissionsRequest{
+				Admin:    goodAdminAddr,
+				MarketId: 1,
+				ToRevoke: []AccessGrant{
+					{Address: goodAddr1, Permissions: []Permission{Permission_permissions}},
+					{Address: goodAdminAddr, Permissions: []Permission{Permission_permissions}},
+					{Address: goodAddr2, Permissions: []Permission{Permission_permissions}},
+				},
+			},
+			expErr: []string{"message administrator " + goodAdminAddr + " cannot revoke their own ability to manage permissions"},
+		},
 		{
 			name: "multiple errs",
 			msg: MsgMarketManagePermissionsRequest{