EPIC: Circuit Breaker

[aaronc]

Summary

Implement a small module which allows some authorized addresses to shut down module execution paths when security vulnerabilities are discovered.

Problem Definition

Circuit breakers have been discussed before #926 but never implemented. Essentially, we need a way to shut down critical exploit paths of security vulnerabilities ASAP before they can be exploited.

Proposal

I propose a very minimum viable circuit breaker module with the following features:

• a list of approved circuit tripper/reset addresses (optionally scoped to specific Msg execution paths)
• a method to trip the circuit breaker and disable a list of Msg execution paths in the ante handle, or even disable all Msgs
• a method to reset tripped circuit breaker paths
• methods for governance to add and remove circuit tripper addresses
• standalone go module that works with v0.45.x+ so this can be integrated ASAP

In the future, we can iterate and add more advanced features, but what is proposed above can be implemented and released relatively quickly.

[tac0turtle]

@aaronc how did you envision this working with checktx or the ante handler?

[alexanderbez]

Per offline discussions we agreed that AnteHandlers will be utilized in conjunction with the circuit breaker's logic. Feel free to add more detailed notes @aaronc.

[aaronc]

Per offline discussions we agreed that AnteHandlers will be utilized in conjunction with the circuit breaker's logic. Feel free to add more detailed notes @aaronc.

How about this interface:

type CircuitBreaker interface {
  IsBlocked(context.Context, sdk.Tx) bool
}

with a new optional field CircuitBreaker on ante.HandlerOptions?

[alexanderbez]

LGTM 👍

[tac0turtle]

closing this for now, we will make sure to include it in 0.50 and later backport to others