feat!: add protection against accidental downgrades

x/upgrade/abci.go

@@ -22,6 +22,15 @@ import (
 // skipUpgradeHeightArray is a set of block heights for which the upgrade must be skipped
 func BeginBlocker(k keeper.Keeper, ctx sdk.Context, _ abci.RequestBeginBlock) {
 	defer telemetry.ModuleMeasureSince(types.ModuleName, time.Now(), telemetry.MetricKeyBeginBlocker)
+
+	k.IterateDoneUpgrades(ctx, func(name string, height int64) bool {
+		if !k.HasHandler(name) {
+			panic(fmt.Sprintf("upgrade handler is missing for %s upgrade plan", name))
+		}
+
+		return false
+	})
+
 	plan, found := k.GetUpgradePlan(ctx)
 	if !found {
 		return

x/upgrade/keeper/keeper.go

@@ -227,6 +227,19 @@ func (k Keeper) GetUpgradedConsensusState(ctx sdk.Context, lastHeight int64) ([]
 	return bz, true
 }
 
+// IterateDoneUpgrades iterate over all the applied upgrades.
+// Callback to get all data, returns true to stop, false to keep reading
+func (k Keeper) IterateDoneUpgrades(ctx sdk.Context, cb func(name string, height int64) bool) {
+	iter := sdk.KVStorePrefixIterator(ctx.KVStore(k.storeKey), []byte{types.DoneByte})
+	defer iter.Close()
+
+	stop := false
+	for ; iter.Valid() && !stop; iter.Next() {
+		bz := iter.Value()
+		stop = cb(string(iter.Key()), int64(binary.BigEndian.Uint64(bz)))
+	}
+}
+
 // GetDoneHeight returns the height at which the given upgrade was executed
 func (k Keeper) GetDoneHeight(ctx sdk.Context, name string) int64 {
 	store := prefix.NewStore(ctx.KVStore(k.storeKey), []byte{types.DoneByte})