diff --git a/x/exchange/msg.go b/x/exchange/msg.go index 1bb37ccdcf..8cd13b79c7 100644 --- a/x/exchange/msg.go +++ b/x/exchange/msg.go @@ -307,6 +307,9 @@ func (m MsgMarketManagePermissionsRequest) ValidateBasic() error { errs = append(errs, fmt.Errorf("invalid revoke-all address %q: %w", addrStr, err)) } } + if ContainsString(m.RevokeAll, m.Admin) { + errs = append(errs, fmt.Errorf("message administrator %s cannot revoke all of their permissions", m.Admin)) + } if err := ValidateAccessGrantsField("to-revoke", m.ToRevoke); err != nil { errs = append(errs, err) @@ -317,6 +320,10 @@ func (m MsgMarketManagePermissionsRequest) ValidateBasic() error { if ContainsString(m.RevokeAll, ag.Address) { errs = append(errs, fmt.Errorf("address %s appears in both the revoke-all and to-revoke fields", ag.Address)) } + if ag.Address == m.Admin && ag.Contains(Permission_permissions) { + errs = append(errs, fmt.Errorf("message administrator %s cannot revoke their own ability to manage permissions", + ag.Address)) + } toRevokeByAddr[ag.Address] = ag } diff --git a/x/exchange/msg_test.go b/x/exchange/msg_test.go index 220352248b..311d8e98fa 100644 --- a/x/exchange/msg_test.go +++ b/x/exchange/msg_test.go @@ -1317,6 +1317,43 @@ func TestMsgMarketManagePermissionsRequest_ValidateBasic(t *testing.T) { "address " + goodAddr2 + " has both revoke and grant \"permissions\"", }, }, + { + name: "admin in revoke-all", + msg: MsgMarketManagePermissionsRequest{ + Admin: goodAdminAddr, + MarketId: 1, + RevokeAll: []string{goodAddr1, goodAdminAddr, goodAddr2}, + }, + expErr: []string{"message administrator " + goodAdminAddr + " cannot revoke all of their permissions"}, + }, + { + name: "admin revoking all their permissions except permissions", + msg: MsgMarketManagePermissionsRequest{ + Admin: goodAdminAddr, + MarketId: 1, + ToRevoke: []AccessGrant{ + { + Address: goodAdminAddr, + Permissions: []Permission{Permission_settle, Permission_cancel, + Permission_withdraw, Permission_update, Permission_attributes}, + }, + }, + }, + expErr: nil, + }, + { + name: "admin revoking own ability to manage permissions", + msg: MsgMarketManagePermissionsRequest{ + Admin: goodAdminAddr, + MarketId: 1, + ToRevoke: []AccessGrant{ + {Address: goodAddr1, Permissions: []Permission{Permission_permissions}}, + {Address: goodAdminAddr, Permissions: []Permission{Permission_permissions}}, + {Address: goodAddr2, Permissions: []Permission{Permission_permissions}}, + }, + }, + expErr: []string{"message administrator " + goodAdminAddr + " cannot revoke their own ability to manage permissions"}, + }, { name: "multiple errs", msg: MsgMarketManagePermissionsRequest{