Skip to content

feat(hyperlane): integrate hyperlane-cosmos v1.1.0 bridge modules #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
angelorc wants to merge 5 commits into
base: main
Choose a base branch
from
Open

feat(hyperlane): integrate hyperlane-cosmos v1.1.0 bridge modules #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ba7c922
feat(hyperlane): integrate hyperlane-cosmos v1.1.0 bridge modules
angelorc Feb 19, 2026
72315d0
refactor(keepers): clean up module account permissions and formatting
angelorc Feb 19, 2026
9b246ba
feat(hyperlane): add hyperlane scripts
angelorc Feb 19, 2026
bc637a7
add fantoken support
angelorc Feb 19, 2026
6ef6074
feat(docker): update workflow to push images on branch pushes and ref…
angelorc Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 38 additions & 31 deletions .github/workflows/push-docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,47 +1,44 @@
# This workflow pushes new Bitsong docker images on every new tag.
# This workflow pushes new Bitsong docker images on every new tag or branch push.
#
# On every new `vX.Y.Z` tag the following images are pushed:
#
# bitsongofficial/go-bitsong:vX.Y.Z # is pushed
# bitsongofficial/go-bitsong:X.Y.Z # is pushed
# bitsongofficial/go-bitsong:X.Y # is updated to X.Y.Z
# bitsongofficial/go-bitsong:X # is updated to X.Y.Z
# bitsongofficial/go-bitsong:latest # is updated to X.Y.Z
#
# bitsongofficial/go-bitsong-e2e:vX.Y.Z # is pushed
# bitsongofficial/go-bitsong-e2e:X.Y.Z # is pushed
# bitsongofficial/go-bitsong-e2e:X.Y # is updated to X.Y.Z
# bitsongofficial/go-bitsong-e2e:X # is updated to X.Y.Z
# bitsongofficial/go-bitsong-e2e:latest # is updated to X.Y.Z
# On branch pushes (e.g. feat-hyperlane) the following images are pushed:
#
# bitsongofficial/go-bitsong:feat-hyperlane # latest for that branch
# bitsongofficial/go-bitsong:feat-hyperlane-abc1234 # pinned to commit
#
# All the images above have support for linux/amd64 and linux/arm64.

name: Push Docker Images

env:
DOCKER_REPOSITORY: bitsongofficial/go-bitsong
RUNNER_BASE_IMAGE_DISTROLESS: gcr.io/distroless/static-debian12
RUNNER_BASE_IMAGE_NONROOT: gcr.io/distroless/static-debian12:nonroot
RUNNER_BASE_IMAGE_ALPINE: alpine:3.21

on:
release:
types: [published, created, edited]
push:
tags:
- 'v[0-9]+.[0-9]+.[0-9]+' # ignore rc
- 'v[0-9]+.[0-9]+.[0-9]+' # ignore rc
branches:
- 'feat-hyperlane'
Comment on lines 22 to +29
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

release and push.tags triggers can fire simultaneously for the same release.

Creating a GitHub release pushes a tag, so both the release and push.tags triggers will match, potentially producing two concurrent runs that build and push the same images. Consider keeping only one of the two triggers to avoid redundant builds and wasted CI minutes.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/push-docker-image.yml around lines 22 - 29, The workflow
currently uses both the release and push.tags triggers (the YAML keys "release"
and "push: tags: - 'v[0-9]+.[0-9]+.[0-9]+'") which can fire for the same
release; remove or disable one of these triggers to avoid duplicate runs—e.g.,
delete the entire "push: tags:" block (or alternatively remove the "release:"
block) so only a single trigger (either "release" or the tag-based "push")
remains, keeping the branch filter "branches: - 'feat-hyperlane'" untouched if
branch-scoped pushes are required.


jobs:
bitsong-images:
runs-on: ubuntu-latest
steps:
-
-
name: Check out the repo
uses: actions/checkout@v4
-
-
name: Set up QEMU
uses: docker/setup-qemu-action@v3
-
-
name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Login to GitHub Container Registry
Expand All @@ -51,28 +48,38 @@ jobs:
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}
-
name: Parse tag
id: tag
name: Determine image tags
id: tags
run: |
VERSION=$(echo ${{ github.ref_name }} | sed "s/v//")
MAJOR_VERSION=$(echo $VERSION | cut -d '.' -f 1)
MINOR_VERSION=$(echo $VERSION | cut -d '.' -f 2)
PATCH_VERSION=$(echo $VERSION | cut -d '.' -f 3)
echo "VERSION=$VERSION" >> $GITHUB_ENV
echo "MAJOR_VERSION=$MAJOR_VERSION" >> $GITHUB_ENV
echo "MINOR_VERSION=$MINOR_VERSION" >> $GITHUB_ENV
echo "PATCH_VERSION=$PATCH_VERSION" >> $GITHUB_ENV
-
name: Build and push
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)

if [[ "${{ github.ref_type }}" == "tag" ]]; then
# Tag push: produce semver tags (e.g. v0.21.0 -> 0, 0.21, 0.21.0, v0.21.0)
VERSION=$(echo "${{ github.ref_name }}" | sed "s/v//")
MAJOR_VERSION=$(echo "$VERSION" | cut -d '.' -f 1)
MINOR_VERSION=$(echo "$VERSION" | cut -d '.' -f 2)
PATCH_VERSION=$(echo "$VERSION" | cut -d '.' -f 3)
IMAGE_TAGS="ghcr.io/${{ env.DOCKER_REPOSITORY }}:${MAJOR_VERSION}
ghcr.io/${{ env.DOCKER_REPOSITORY }}:${MAJOR_VERSION}.${MINOR_VERSION}
ghcr.io/${{ env.DOCKER_REPOSITORY }}:${MAJOR_VERSION}.${MINOR_VERSION}.${PATCH_VERSION}
ghcr.io/${{ env.DOCKER_REPOSITORY }}:v${MAJOR_VERSION}.${MINOR_VERSION}.${PATCH_VERSION}"
else
# Branch push: produce branch + commit-pinned tags
BRANCH=$(echo "${{ github.ref_name }}" | sed 's/\//-/g')
IMAGE_TAGS="ghcr.io/${{ env.DOCKER_REPOSITORY }}:${BRANCH}
ghcr.io/${{ env.DOCKER_REPOSITORY }}:${BRANCH}-${SHORT_SHA}"
fi

echo "IMAGE_TAGS<<EOF" >> $GITHUB_OUTPUT
echo "$IMAGE_TAGS" >> $GITHUB_OUTPUT
echo "EOF" >> $GITHUB_OUTPUT
-
name: Build and push
id: build_push_image
uses: docker/build-push-action@v5
with:
file: Dockerfile
context: .
push: true
platforms: linux/amd64,linux/arm64
tags: |
ghcr.io/bitsongofficial/go-bitsong:${{ env.MAJOR_VERSION }}
ghcr.io/bitsongofficial/go-bitsong:${{ env.MAJOR_VERSION }}.${{ env.MINOR_VERSION }}
ghcr.io/bitsongofficial/go-bitsong:${{ env.MAJOR_VERSION }}.${{ env.MINOR_VERSION }}.${{ env.PATCH_VERSION }}
ghcr.io/bitsongofficial/go-bitsong:v${{ env.MAJOR_VERSION }}.${{ env.MINOR_VERSION }}.${{ env.PATCH_VERSION }}
tags: ${{ steps.tags.outputs.IMAGE_TAGS }}
12 changes: 11 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,4 +52,14 @@ state_export.json

github.com*
gogoproto*
target/
target/

.localbitsong-hyperlane/

evm/out/
evm/cache/
evm/broadcast/
evm/node_modules/

scripts/hyperlane/.env
infra/.env.secrets
34 changes: 34 additions & 0 deletions app/keepers/keepers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,10 @@ import (
distrkeeper "github.com/cosmos/cosmos-sdk/x/distribution/keeper"
distrtypes "github.com/cosmos/cosmos-sdk/x/distribution/types"

hyperlanekeeper "github.com/bcp-innovations/hyperlane-cosmos/x/core/keeper"
hyperlanetypes "github.com/bcp-innovations/hyperlane-cosmos/x/core/types"
warpkeeper "github.com/bcp-innovations/hyperlane-cosmos/x/warp/keeper"
warptypes "github.com/bcp-innovations/hyperlane-cosmos/x/warp/types"
cadencekeeper "github.com/bitsongofficial/go-bitsong/x/cadence/keeper"
cadencetypes "github.com/bitsongofficial/go-bitsong/x/cadence/types"
govkeeper "github.com/cosmos/cosmos-sdk/x/gov/keeper"
Expand Down Expand Up @@ -116,6 +120,8 @@ var maccPerms = map[string][]string{
wasmtypes.ModuleName: {authtypes.Burner},
protocolpooltypes.ModuleName: nil,
protocolpooltypes.ProtocolPoolEscrowAccount: nil,
hyperlanetypes.ModuleName: nil,
warptypes.ModuleName: {authtypes.Minter, authtypes.Burner},
Comment on lines +123 to +124
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for StoreUpgrades registrations for hyperlane and warp modules
rg -rn 'hyperlanetypes\.ModuleName\|warptypes\.ModuleName\|hyperlane.*StoreUpgrades\|StoreUpgrades.*hyperlane' \
  --type go -g '!app/keepers/keepers.go'

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Also search for upgrade handlers and StoreUpgrades in general to understand the upgrade structure
fd -e go | xargs rg -l 'StoreUpgrades\|UpgradeStoreLoader' --type go | head -20

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Search for any upgrade-related files
fd -e go -i -E node_modules -E vendor | xargs rg -l 'upgradetypes\.' --type go | head -20

Repository: bitsongofficial/go-bitsong

Length of output: 386

🏁 Script executed:

# Check the recent upgrade handler (v023) for StoreUpgrades pattern
cat app/upgrades/v023/upgrades.go

Repository: bitsongofficial/go-bitsong

Length of output: 2929

🏁 Script executed:

# Check the context in keepers.go around lines 123-124
sed -n '115,135p' app/keepers/keepers.go

Repository: bitsongofficial/go-bitsong

Length of output: 1113

🏁 Script executed:

# Search for hyperlane and warp module initialization in the codebase
rg -n 'hyperlane|warp' --type go | head -30

Repository: bitsongofficial/go-bitsong

Length of output: 2562

🏁 Script executed:

# Check if there are any StoreUpgrades definitions in existing upgrade handlers
rg -A 5 'StoreUpgrades' --type go app/upgrades/

Repository: bitsongofficial/go-bitsong

Length of output: 1245

🏁 Script executed:

# Check if hyperlane and warp modules appear in older upgrade versions
rg -n 'hyperlane|warp' app/upgrades/v021/ app/upgrades/v022/

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Check the v023 constants file to see the full StoreUpgrades definition
cat app/upgrades/v023/constants.go

Repository: bitsongofficial/go-bitsong

Length of output: 419

🏁 Script executed:

# Check app.go to understand how StoreUpgrades are applied during chain initialization
rg -B5 -A5 'SetStoreLoader\|UpgradeStoreLoader' app/app.go

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Check how the upgrade is registered and applied in the app
cat app/app.go | head -100

Repository: bitsongofficial/go-bitsong

Length of output: 3931

🏁 Script executed:

# Search for SetStoreLoader usage across the entire codebase
rg -rn 'SetStoreLoader' --type go

Repository: bitsongofficial/go-bitsong

Length of output: 90

🏁 Script executed:

# Check the upgrade types to understand the expected structure
cat app/upgrades/types.go

Repository: bitsongofficial/go-bitsong

Length of output: 1439

🏁 Script executed:

# Look at v021 upgrade handler to see how StoreUpgrades are typically used
cat app/upgrades/v021/upgrades.go | head -80

Repository: bitsongofficial/go-bitsong

Length of output: 3836

🏁 Script executed:

# Check if hyperlane and warp modules are imported/registered in the app
cat app/modules.go | grep -A5 -B5 'hyperlane\|warp'

Repository: bitsongofficial/go-bitsong

Length of output: 3468

🏁 Script executed:

# Check when hyperlane and warp were added - search git history or comments
rg -n 'hyperlane|warp' app/keepers/keys.go -B2 -A2

Repository: bitsongofficial/go-bitsong

Length of output: 748

🏁 Script executed:

# Verify if there's a planned next upgrade version (v024, etc)
ls -la app/upgrades/

Repository: bitsongofficial/go-bitsong

Length of output: 459

🏁 Script executed:

# Check how StoreUpgrades are actually applied during upgrade
rg -rn 'storeUpgrades\|StoreUpgrades' app/ --type go -A3 | head -50

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Check if hyperlane/warp appear in any of the historical upgrade handlers
rg -rn 'hyperlane\|warp' app/upgrades/v021 app/upgrades/v022

Repository: bitsongofficial/go-bitsong

Length of output: 52

🏁 Script executed:

# Look at the full constants files for v021 and v022 to see the pattern
cat app/upgrades/v021/constants.go
cat app/upgrades/v022/constants.go

Repository: bitsongofficial/go-bitsong

Length of output: 3401

🏁 Script executed:

# Verify if these modules need to be added to StoreUpgrades by checking the external library documentation expectations
rg -n 'SetStoreLoader\|UpgradeStoreLoader' app/

Repository: bitsongofficial/go-bitsong

Length of output: 52

Add StoreUpgrades for hyperlane and warp modules to v023 upgrade.

The hyperlane and warp modules are now integrated in the codebase (keepers.go, keys.go, modules.go) but are missing from v023's StoreUpgrades. When deploying this upgrade to a live chain, the missing store initialization will cause the node to panic. Follow the established pattern from v021 and v022 by adding their store keys to the Added list:

Example StoreUpgrades update for v023 
StoreUpgrades: store.StoreUpgrades{
    Added: []string{
        hyperlanetypes.ModuleName,
        warptypes.ModuleName,
    },
    Deleted: []string{},
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@app/keepers/keepers.go` around lines 123 - 124, Add the hyperlane and warp
module store keys to the v023 upgrade's StoreUpgrades so their KV stores are
created during migration: update the StoreUpgrades.Added slice (the v023 upgrade
definition that contains StoreUpgrades) to include hyperlanetypes.ModuleName and
warptypes.ModuleName (follow the same pattern used in v021/v022), leaving
Deleted empty; ensure you reference the existing StoreUpgrades variable/struct
in the v023 upgrade block so the stores are initialized at upgrade time.

}

type AppKeepers struct {
Expand Down Expand Up @@ -160,6 +166,10 @@ type AppKeepers struct {
AuthenticatorManager *authenticator.AuthenticatorManager
ProtocolPoolKeeper protocolpoolkeeper.Keeper

// Hyperlane keepers
HyperlaneKeeper *hyperlanekeeper.Keeper
WarpKeeper warpkeeper.Keeper

// Middleware wrapper
Ics20WasmHooks *ibchooks.WasmHooks
HooksICS4Wrapper ibchooks.ICS4Middleware
Expand Down Expand Up @@ -245,6 +255,30 @@ func NewAppKeepers(
govModAddress, bApp.Logger(),
)

// Hyperlane Core Keeper
hyperlaneKeeper := hyperlanekeeper.NewKeeper(
appCodec,
appKeepers.AccountKeeper.AddressCodec(),
runtime.NewKVStoreService(keys[hyperlanetypes.ModuleName]),
govModAddress,
appKeepers.BankKeeper,
)
appKeepers.HyperlaneKeeper = &hyperlaneKeeper

// Hyperlane Warp Keeper
appKeepers.WarpKeeper = warpkeeper.NewKeeper(
appCodec,
appKeepers.AccountKeeper.AddressCodec(),
runtime.NewKVStoreService(keys[warptypes.ModuleName]),
govModAddress,
appKeepers.BankKeeper,
appKeepers.HyperlaneKeeper,
[]int32{
int32(warptypes.HYP_TOKEN_TYPE_COLLATERAL),
int32(warptypes.HYP_TOKEN_TYPE_SYNTHETIC),
},
)

// Initialize authenticators
appKeepers.AuthenticatorManager = authenticator.NewAuthenticatorManager()
appKeepers.AuthenticatorManager.InitializeAuthenticators([]authenticator.Authenticator{
Expand Down
4 changes: 4 additions & 0 deletions app/keepers/keys.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ import (

"cosmossdk.io/x/feegrant"
wasmtypes "github.com/CosmWasm/wasmd/x/wasm/types"
hyperlanetypes "github.com/bcp-innovations/hyperlane-cosmos/x/core/types"
warptypes "github.com/bcp-innovations/hyperlane-cosmos/x/warp/types"
cadencetypes "github.com/bitsongofficial/go-bitsong/x/cadence/types"
smartaccounttypes "github.com/bitsongofficial/go-bitsong/x/smart-account/types"
authzkeeper "github.com/cosmos/cosmos-sdk/x/authz/keeper"
Expand Down Expand Up @@ -60,6 +62,8 @@ func (appKeepers *AppKeepers) GenerateKeys() {
cadencetypes.StoreKey,
smartaccounttypes.StoreKey,
protocolpooltypes.StoreKey,
hyperlanetypes.ModuleName, // "hyperlane" — no StoreKey constant exported, ModuleName is the store key
warptypes.ModuleName, // "warp" — no StoreKey constant exported, ModuleName is the store key
)

appKeepers.tkeys = storetypes.NewTransientStoreKeys(paramstypes.TStoreKey)
Expand Down
16 changes: 14 additions & 2 deletions app/modules.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ import (
"cosmossdk.io/x/upgrade"
upgradetypes "cosmossdk.io/x/upgrade/types"
"github.com/CosmWasm/wasmd/x/wasm"
hyperlane "github.com/bcp-innovations/hyperlane-cosmos/x/core"
hyperlanetypes "github.com/bcp-innovations/hyperlane-cosmos/x/core/types"
warp "github.com/bcp-innovations/hyperlane-cosmos/x/warp"
warptypes "github.com/bcp-innovations/hyperlane-cosmos/x/warp/types"
encparams "github.com/bitsongofficial/go-bitsong/app/params"
"github.com/bitsongofficial/go-bitsong/x/cadence"
"github.com/cosmos/cosmos-sdk/client"
Expand Down Expand Up @@ -109,6 +113,8 @@ var AppModuleBasics = module.NewBasicManager(
ibcwasm.AppModuleBasic{},
smartaccount.AppModuleBasic{},
protocolpool.AppModule{},
hyperlane.AppModule{},
warp.AppModule{},
)

func appModules(
Expand Down Expand Up @@ -149,6 +155,8 @@ func appModules(
cadence.NewAppModule(appCodec, app.CadenceKeeper),
protocolpool.NewAppModule(app.ProtocolPoolKeeper, app.AccountKeeper, app.BankKeeper),
smartaccount.NewAppModule(appCodec, *app.SmartAccountKeeper),
hyperlane.NewAppModule(appCodec, app.HyperlaneKeeper),
warp.NewAppModule(appCodec, app.WarpKeeper),
crisis.NewAppModule(app.CrisisKeeper, skipGenesisInvariants, app.GetSubspace(crisistypes.ModuleName)), // always be last to make sure that it checks for all invariants and not only part of them
}
}
Expand All @@ -158,7 +166,8 @@ func orderBeginBlockers() []string {
capabilitytypes.ModuleName, minttypes.ModuleName, authtypes.ModuleName,
banktypes.ModuleName, distrtypes.ModuleName, protocolpooltypes.ModuleName, slashingtypes.ModuleName, govtypes.ModuleName, crisistypes.ModuleName,
stakingtypes.ModuleName, ibctransfertypes.ModuleName, ibcexported.ModuleName, packetforwardtypes.ModuleName,
icqtypes.ModuleName, authz.ModuleName, genutiltypes.ModuleName, evidencetypes.ModuleName, wasmtypes.ModuleName,
icqtypes.ModuleName, hyperlanetypes.ModuleName, warptypes.ModuleName,
authz.ModuleName, genutiltypes.ModuleName, evidencetypes.ModuleName, wasmtypes.ModuleName,
feegrant.ModuleName, paramstypes.ModuleName, vestingtypes.ModuleName, cadencetypes.ModuleName,
ibchookstypes.ModuleName, ibcwasmtypes.ModuleName, fantokentypes.ModuleName,
}
Expand All @@ -167,7 +176,8 @@ func orderBeginBlockers() []string {
func orderEndBlockers() []string {
return []string{
crisistypes.ModuleName, govtypes.ModuleName, stakingtypes.ModuleName, ibctransfertypes.ModuleName, ibcexported.ModuleName,
packetforwardtypes.ModuleName, icqtypes.ModuleName, feegrant.ModuleName, authz.ModuleName, capabilitytypes.ModuleName, authtypes.ModuleName,
packetforwardtypes.ModuleName, icqtypes.ModuleName, hyperlanetypes.ModuleName, warptypes.ModuleName,
feegrant.ModuleName, authz.ModuleName, capabilitytypes.ModuleName, authtypes.ModuleName,
protocolpooltypes.ModuleName, // must be before bank
banktypes.ModuleName, distrtypes.ModuleName, slashingtypes.ModuleName, minttypes.ModuleName, genutiltypes.ModuleName, wasmtypes.ModuleName,
evidencetypes.ModuleName, paramstypes.ModuleName, upgradetypes.ModuleName, vestingtypes.ModuleName, cadencetypes.ModuleName,
Expand Down Expand Up @@ -200,6 +210,8 @@ func orderInitBlockers() []string {
paramstypes.ModuleName,
upgradetypes.ModuleName,
vestingtypes.ModuleName,
hyperlanetypes.ModuleName,
warptypes.ModuleName,
wasmtypes.ModuleName,
ibcwasmtypes.ModuleName,
ibchookstypes.ModuleName,
Expand Down
7 changes: 5 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.23.2

require (
cosmossdk.io/api v0.9.2
cosmossdk.io/client/v2 v2.0.0-beta.3
cosmossdk.io/client/v2 v2.0.0-beta.8
cosmossdk.io/collections v1.2.0
cosmossdk.io/core v0.11.3
cosmossdk.io/errors v1.0.2
Expand All @@ -17,6 +17,7 @@ require (
cosmossdk.io/x/upgrade v0.1.4
github.com/CosmWasm/wasmd v0.53.3
github.com/CosmWasm/wasmvm/v2 v2.1.6
github.com/bcp-innovations/hyperlane-cosmos v1.1.0
github.com/cometbft/cometbft v0.38.21
github.com/cosmos/cosmos-db v1.1.1
github.com/cosmos/cosmos-proto v1.0.0-beta.5
Expand Down Expand Up @@ -107,6 +108,7 @@ require (
github.com/emicklei/dot v1.6.4 // indirect
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
github.com/ethereum/go-ethereum v1.14.12 // indirect
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

go-ethereum v1.14.12 vulnerabilities GHSA-m6j8-rg6r-7mv8 ECIES

💡 Result:

go-ethereum v1.14.12 is affected by GHSA-m6j8-rg6r-7mv8 / CVE-2026-26315 (ECIES / RLPx handshake).

  • Issue: Geth improperly validates the ECIES public key during the RLPx handshake, and a remote peer may be able to extract bits of the node’s p2p (enode) private key (information leak / observable discrepancy). [1][2]
  • Affected versions: all versions ≤ 1.16.8 (i.e., all versions before 1.16.9, which includes 1.14.12). [1][2]
  • Fix: upgrade to v1.16.9 (or newer; GitHub notes it’s also resolved in v1.17.0). [1][2]
  • Post-upgrade action: rotate your node key (GitHub recommends deleting <datadir>/geth/nodekey before starting Geth). [1]

Sources:
[1] GitHub Advisory Database – GHSA-m6j8-rg6r-7mv8 / CVE-2026-26315: affected versions, impact, patched versions, and key-rotation guidance. (github.com)
[2] GitLab Advisory Database – CVE-2026-26315: summary + fixed version (1.16.9). (advisories.gitlab.com)

Citations:

🌐 Web query:

go-ethereum latest stable version 2024 2025

💡 Result:

  • Latest stable in 2024: Geth (go-ethereum) v1.14.12 — released Nov 19, 2024. [1]
  • Latest stable in 2025: Geth (go-ethereum) v1.16.7 — released Nov 4, 2025 (marked “Latest” on the repo). [2]

Notes (useful context):

  • v1.14.13 is a security release (CVE-2025-24883) and was released Jan 30, 2025. [3][4]
  • The v1.16 series began with v1.16.0 on Jun 26, 2025. [5]

Sources: [1] [2] [3] [4] [5]

🏁 Script executed:

# Check the go.mod file to see the exact current state
cat -n go.mod | grep -A 2 -B 2 "go-ethereum"

Repository: bitsongofficial/go-bitsong

Length of output: 379

Indirect dependency go-ethereum v1.14.12 has a HIGH-severity vulnerability (GHSA-m6j8-rg6r-7mv8 / CVE-2026-26315).

This version is affected by improper ECIES public key validation in the RLPx handshake, allowing a remote peer to extract bits of the node's p2p private key. The vulnerability is fixed in go-ethereum v1.16.9+. Since v1.14.12 is an older branch, a backport security release (v1.14.13) is also available as of January 30, 2025.

Upgrade to v1.14.13 (minimum security patch) or v1.16.7 (latest stable). After upgrading, rotate your node key (GitHub recommends deleting <datadir>/geth/nodekey before restart).

Since this is an indirect dependency pulled in by hyperlane-cosmos v1.1.0, check whether a newer release of hyperlane-cosmos uses a patched version, or add a go.mod replace directive to pin a patched go-ethereum.

🧰 Tools
🪛 OSV Scanner (2.3.3)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: Go Ethereum vulnerable to DoS via malicious p2p message in github.com/ethereum/go-ethereum

(GO-2025-3436)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: High CPU usage leading to DoS via malicious p2p message in github.com/ethereum/go-ethereum

(GO-2026-4314)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: DoS via malicious p2p message affecting a vulnerable node in github.com/ethereum/go-ethereum

(GO-2026-4315)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: Go Ethereum Improperly Validates the ECIES Public Key in RLPx Handshake

(GHSA-m6j8-rg6r-7mv8)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: go-ethereum is vulnerable to high CPU usage leading to DoS via malicious p2p message

(GHSA-mq3p-rrmp-79jg)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: go-ethereum is vulnerable to DoS via malicious p2p message affecting a vulnerable node

(GHSA-mr7q-c9w9-wh4h)

[HIGH] 111-111: github.com/ethereum/go-ethereum 1.14.12: Go Ethereum vulnerable to DoS via malicious p2p message

(GHSA-q26p-9cq4-7fc2)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 111, Your go.mod references an indirect dependency
github.com/ethereum/go-ethereum v1.14.12 which has a HIGH-severity
vulnerability; update to a patched release by either updating the upstream
consumer (hyperlane-cosmos v1.1.0) to a version that depends on go-ethereum
v1.14.13 or v1.16.7+, or add a go.mod replace directive to pin
github.com/ethereum/go-ethereum to v1.14.13 (or v1.16.7+) to override the
indirect version; after upgrading, ensure any Ethereum node key is rotated
(delete <datadir>/geth/nodekey before restart) as recommended.

github.com/fatih/color v1.18.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
Expand All @@ -121,7 +123,7 @@ require (
github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
github.com/gogo/googleapis v1.4.1 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb // indirect
github.com/google/btree v1.1.3 // indirect
github.com/google/flatbuffers v25.2.10+incompatible // indirect
github.com/google/go-cmp v0.7.0 // indirect
Expand All @@ -146,6 +148,7 @@ require (
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
github.com/hashicorp/yamux v0.1.2 // indirect
github.com/hdevalence/ed25519consensus v0.2.0 // indirect
github.com/holiman/uint256 v1.3.1 // indirect
github.com/huandu/skiplist v1.2.1 // indirect
github.com/iancoleman/orderedmap v0.3.0 // indirect
github.com/iancoleman/strcase v0.3.0 // indirect
Expand Down
19 changes: 14 additions & 5 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,8 +616,8 @@ cloud.google.com/go/workflows v1.9.0/go.mod h1:ZGkj1aFIOd9c8Gerkjjq7OW7I5+l6cSvT
cloud.google.com/go/workflows v1.10.0/go.mod h1:fZ8LmRmZQWacon9UCX1r/g/DfAXx5VcPALq2CxzdePw=
cosmossdk.io/api v0.9.2 h1:9i9ptOBdmoIEVEVWLtYYHjxZonlF/aOVODLFaxpmNtg=
cosmossdk.io/api v0.9.2/go.mod h1:CWt31nVohvoPMTlPv+mMNCtC0a7BqRdESjCsstHcTkU=
cosmossdk.io/client/v2 v2.0.0-beta.3 h1:+TTuH0DwQYsUq2JFAl3fDZzKq5gQG7nt3dAattkjFDU=
cosmossdk.io/client/v2 v2.0.0-beta.3/go.mod h1:CZcL41HpJPOOayTCO28j8weNBQprG+SRiKX39votypo=
cosmossdk.io/client/v2 v2.0.0-beta.8 h1:RXMJdA4V9H1H3/3BfMD6dAW3lF8W9DpNPPYnKD+ArxY=
cosmossdk.io/client/v2 v2.0.0-beta.8/go.mod h1:x+E2eji+ToMtUIqKzoJ5mJIhat+Zak47xZ8jOYjJQBA=
cosmossdk.io/collections v1.2.0 h1:IesfVG8G/+FYCMVMP01frS/Cw99Omk5vBh3cHbO01Gg=
cosmossdk.io/collections v1.2.0/go.mod h1:4NkMoYw6qRA8fnSH/yn1D/MOutr8qyQnwsO50Mz9ItU=
cosmossdk.io/core v0.11.3 h1:mei+MVDJOwIjIniaKelE3jPDqShCc/F4LkNNHh+4yfo=
Expand Down Expand Up @@ -715,6 +715,8 @@ github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX
github.com/aws/aws-sdk-go v1.55.6 h1:cSg4pvZ3m8dgYcgqB97MrcdjUmZ1BeMYKUxMMB89IPk=
github.com/aws/aws-sdk-go v1.55.6/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
github.com/bcp-innovations/hyperlane-cosmos v1.1.0 h1:WXt+WrKv2DG/xVIkLvggDRbi/2law104Vj6AWZGxHNw=
github.com/bcp-innovations/hyperlane-cosmos v1.1.0/go.mod h1:NP59yKAk2qFaT7+FSCh7kkoKKLlTxXNdIlxMstAJ5no=
github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
Expand All @@ -729,8 +731,8 @@ github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCk
github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
github.com/btcsuite/btcd/btcec/v2 v2.3.2 h1:5n0X6hX0Zk+6omWcihdYvdAlGf2DfasC0GMf7DClJ3U=
github.com/btcsuite/btcd/btcec/v2 v2.3.2/go.mod h1:zYzJ8etWJQIv1Ogk7OzpWjowwOdXY1W/17j2MW85J04=
github.com/btcsuite/btcd/btcec/v2 v2.3.4 h1:3EJjcN70HCu/mwqlUsGK8GcNVyLVxFDlWurTXGPFfiQ=
github.com/btcsuite/btcd/btcec/v2 v2.3.4/go.mod h1:zYzJ8etWJQIv1Ogk7OzpWjowwOdXY1W/17j2MW85J04=
github.com/btcsuite/btcd/btcutil v1.1.6 h1:zFL2+c3Lb9gEgqKNzowKUPQNb8jV7v5Oaodi/AYFd6c=
github.com/btcsuite/btcd/btcutil v1.1.6/go.mod h1:9dFymx8HpuLqBnsPELrImQeTQfKBQqzqGbbV3jK55aE=
github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
Expand Down Expand Up @@ -917,6 +919,8 @@ github.com/envoyproxy/protoc-gen-validate v0.9.1/go.mod h1:OKNgG7TCp5pF4d6XftA0+
github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6NiRwroiAU2PaFuvk/vjgh61ss=
github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
github.com/ethereum/go-ethereum v1.14.12 h1:8hl57x77HSUo+cXExrURjU/w1VhL+ShCTJrTwcCQSe4=
github.com/ethereum/go-ethereum v1.14.12/go.mod h1:RAC2gVMWJ6FkxSPESfbshrcKpIokgQKsVKmAuqdekDY=
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
Expand Down Expand Up @@ -1045,8 +1049,9 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb h1:PBC98N2aIaM3XXiurYmW7fx4GZkL8feAMVq7nEjURHk=
github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
Expand Down Expand Up @@ -1204,6 +1209,8 @@ github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8
github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
github.com/hdevalence/ed25519consensus v0.2.0 h1:37ICyZqdyj0lAZ8P4D1d1id3HqbbG1N3iBb1Tb4rdcU=
github.com/hdevalence/ed25519consensus v0.2.0/go.mod h1:w3BHWjwJbFU29IRHL1Iqkw3sus+7FctEyM4RqDxYNzo=
github.com/holiman/uint256 v1.3.1 h1:JfTzmih28bittyHM8z360dCjIA9dbPIBlcTI6lmctQs=
github.com/holiman/uint256 v1.3.1/go.mod h1:EOMSn4q6Nyt9P6efbI3bueV4e1b3dGlUCXeiRV4ng7E=
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
github.com/huandu/go-assert v1.1.5 h1:fjemmA7sSfYHJD7CUqs9qTwwfdNAx7/j2/ZlHXzNB3c=
github.com/huandu/go-assert v1.1.5/go.mod h1:yOLvuqZwmcHIC5rIzrBhT7D3Q9c3GFnd0JrPVhn/06U=
Expand Down Expand Up @@ -1367,6 +1374,8 @@ github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108
github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
github.com/onsi/ginkgo/v2 v2.7.0 h1:/XxtEV3I3Eif/HobnVx9YmJgk8ENdRsuUmM+fLCFNow=
github.com/onsi/ginkgo/v2 v2.7.0/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
Expand Down
Loading
Loading