fix: Expedited Governance Proposal Whitelist Bypass via authz Wrapping (#353)

# Description

The `GovExpeditedProposalsDecorator` only inspected top level messages,
so a non-whitelisted `MsgSubmitProposal` marked as expedited could slip
through by being wrapped inside an `authz.MsgExec`. That let
non-whitelisted proposal types use the shortened expedited voting window
that governance policy intended to reserve for the standard timeline.

The fix unwraps `authz.MsgExec` recursively and applies the same
expedited whitelist validation to the wrapped proposals, matching the
pattern already used by `GovVoteDecorator`.

No new dependencies.

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)

# How Has This Been Tested?

```bash
go test -tags=test ./ante/ -run TestGovExpeditedProposalsDecorator -v
```

- [x] A non-whitelisted expedited proposal wrapped in `authz.MsgExec`
(and nested `exec(exec(...))`) is now rejected
- [x] A whitelisted expedited proposal in authz still passes, and
non-expedited proposals in authz are unaffected

# PR Checklist:

- [x] Updated changelog with PR's intent
- [x] Lint with `make lint-fix`

Author: mattkii

CHANGELOG.md

@@ -11,6 +11,7 @@
 
 ### Fixed
 
+- Close an expedited-governance whitelist bypass in `GovExpeditedProposalsDecorator` where the check only inspected top-level messages: a non-whitelisted `MsgSubmitProposal` wrapped in `authz.MsgExec` could enter the expedited voting path. The decorator now recurses into `authz.MsgExec` (including nested execs) and applies the expedited whitelist validation to wrapped proposals
 - Compute the oracle ballot `StandardDeviation` as a stake-weighted variance (weight each squared deviation by the vote's power and divide by total voting power) instead of an unweighted average divided by the vote count, aligning the reward-band width with the stake-weighted median and preventing a group of low-stake validators from inflating the deviation to widen the accepted vote window
 - Close an oracle slashing bypass in the `EndBlocker` where validators were scored against the post-filtered `voteTargets` map: a denom that received votes but was pushed below the vote threshold (e.g. by a coordinated group abstaining) was dropped from the scoring denominator, letting the abstainers avoid miss penalties. Participation is now scored against the configured targets that received votes (passing targets plus below-threshold targets), crediting validators that voted on a below-threshold target while counting abstention on it as a miss; targets that received no votes at all are still excluded so a legitimately unpriceable denom cannot mass-slash the validator set
 - Allow EIP-7702 delegated EOAs to send direct EVM transactions by exempting delegation-designator code from the externally-owned-account-only check in `VerifyIfAccountExists`, so accounts that delegate via `SetCodeTx` can still manage (and revoke) their own delegation without a sponsored transaction

ante/gov_expedited_ante.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/cosmos/cosmos-sdk/codec"
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/cosmos/cosmos-sdk/x/authz"
 	govv1 "github.com/cosmos/cosmos-sdk/x/gov/types/v1"
 
 	xerrors "github.com/kiichain/kiichain/v7/x/types/errors"
@@ -23,11 +24,12 @@ var expeditedPropsWhitelist = map[string]struct{}{
 	"/cosmos.upgrade.v1beta1.MsgCancelUpgrade":   {},
 }
 
-// Check if the proposal is whitelisted for expedited voting.
+// GovExpeditedProposalsDecorator rejects expedited proposals whose messages are not whitelisted.
 type GovExpeditedProposalsDecorator struct {
 	cdc codec.BinaryCodec
 }
 
+// NewGovExpeditedProposalsDecorator returns a new GovExpeditedProposalsDecorator.
 func NewGovExpeditedProposalsDecorator(cdc codec.BinaryCodec) GovExpeditedProposalsDecorator {
 	return GovExpeditedProposalsDecorator{
 		cdc: cdc,
@@ -39,26 +41,56 @@ func NewGovExpeditedProposalsDecorator(cdc codec.BinaryCodec) GovExpeditedPropos
 // Legacy proposals submitted using "kiichaind tx gov submit-legacy-proposal" cannot be marked as expedited.
 func (g GovExpeditedProposalsDecorator) AnteHandle(ctx sdk.Context, tx sdk.Tx, simulate bool, next sdk.AnteHandler) (newCtx sdk.Context, err error) {
 	if expeditedPropDecoratorEnabled {
-		for _, msg := range tx.GetMsgs() {
-			prop, ok := msg.(*govv1.MsgSubmitProposal)
-			if !ok {
-				continue
+		if err := g.validateMsgs(tx.GetMsgs()); err != nil {
+			return ctx, err
+		}
+	}
+	return next(ctx, tx, simulate)
+}
+
+// validateMsgs validates each message, unwrapping authz.MsgExec to prevent whitelist bypass.
+func (g GovExpeditedProposalsDecorator) validateMsgs(msgs []sdk.Msg) error {
+	for _, msg := range msgs {
+		if execMsg, ok := msg.(*authz.MsgExec); ok {
+			if err := g.validateAuthzExec(execMsg); err != nil {
+				return err
 			}
-			if prop.Expedited {
-				if err := g.validateExpeditedGovProp(prop); err != nil {
-					return ctx, err
-				}
+			continue
+		}
+
+		prop, ok := msg.(*govv1.MsgSubmitProposal)
+		if !ok {
+			continue
+		}
+		if prop.Expedited {
+			if err := g.validateExpeditedGovProp(prop); err != nil {
+				return err
 			}
 		}
 	}
-	return next(ctx, tx, simulate)
+	return nil
+}
+
+// validateAuthzExec unpacks the inner messages of an authz.MsgExec and validates them.
+func (g GovExpeditedProposalsDecorator) validateAuthzExec(execMsg *authz.MsgExec) error {
+	innerMsgs := make([]sdk.Msg, 0, len(execMsg.Msgs))
+	for _, v := range execMsg.Msgs {
+		var innerMsg sdk.Msg
+		if err := g.cdc.UnpackAny(v, &innerMsg); err != nil {
+			return errorsmod.Wrapf(xerrors.ErrInvalidExpeditedProposal, "cannot unmarshal authz exec msg (type %s): %v", v.TypeUrl, err)
+		}
+		innerMsgs = append(innerMsgs, innerMsg)
+	}
+	return g.validateMsgs(innerMsgs)
 }
 
+// isWhitelisted reports whether the given message type may be expedited.
 func (g GovExpeditedProposalsDecorator) isWhitelisted(msgType string) bool {
 	_, ok := expeditedPropsWhitelist[msgType]
 	return ok
 }
 
+// validateExpeditedGovProp ensures every message in an expedited proposal is whitelisted.
 func (g GovExpeditedProposalsDecorator) validateExpeditedGovProp(prop *govv1.MsgSubmitProposal) error {
 	msgs := prop.GetMessages()
 	if len(msgs) == 0 {

ante/gov_expedited_ante_test.go

@@ -11,6 +11,7 @@ import (
 	upgradetypes "cosmossdk.io/x/upgrade/types"
 
 	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/cosmos/cosmos-sdk/x/authz"
 	banktypes "github.com/cosmos/cosmos-sdk/x/bank/types"
 	distrtypes "github.com/cosmos/cosmos-sdk/x/distribution/types"
 	govv1 "github.com/cosmos/cosmos-sdk/x/gov/types/v1"
@@ -163,6 +164,57 @@ func TestGovExpeditedProposalsDecorator(t *testing.T) {
 			},
 			expectErr: true,
 		},
+		{
+			name: "authz - expedited whitelisted - MsgSoftwareUpgrade",
+			ctx:  sdk.Context{},
+			msgs: []sdk.Msg{
+				newAuthzExec(newGovProp([]sdk.Msg{&upgradetypes.MsgSoftwareUpgrade{
+					Authority: "kii10d07y265gmmuvt4z0w9aw880jnsr700jrff0qv",
+					Plan: upgradetypes.Plan{
+						Name:   "upgrade plan-plan",
+						Info:   "some text here",
+						Height: 123456789,
+					},
+				}}, true)),
+			},
+			expectErr: false,
+		},
+		{
+			name: "authz - normal non-whitelisted - MsgCommunityPoolSpend",
+			ctx:  sdk.Context{},
+			msgs: []sdk.Msg{
+				newAuthzExec(newGovProp([]sdk.Msg{&distrtypes.MsgCommunityPoolSpend{
+					Authority: "kii10d07y265gmmuvt4z0w9aw880jnsr700jrff0qv",
+					Recipient: sdk.AccAddress{}.String(),
+					Amount:    sdk.NewCoins(sdk.NewCoin("stake", math.NewInt(100))),
+				}}, false)),
+			},
+			expectErr: false,
+		},
+		{
+			name: "fail - authz - expedited non-whitelisted - MsgCommunityPoolSpend",
+			ctx:  sdk.Context{},
+			msgs: []sdk.Msg{
+				newAuthzExec(newGovProp([]sdk.Msg{&distrtypes.MsgCommunityPoolSpend{
+					Authority: "kii10d07y265gmmuvt4z0w9aw880jnsr700jrff0qv",
+					Recipient: sdk.AccAddress{}.String(),
+					Amount:    sdk.NewCoins(sdk.NewCoin("stake", math.NewInt(100))),
+				}}, true)),
+			},
+			expectErr: true,
+		},
+		{
+			name: "fail - nested authz - expedited non-whitelisted - MsgSend",
+			ctx:  sdk.Context{},
+			msgs: []sdk.Msg{
+				newAuthzExec(newAuthzExec(newGovProp([]sdk.Msg{&banktypes.MsgSend{
+					FromAddress: "kii10d07y265gmmuvt4z0w9aw880jnsr700jrff0qv",
+					ToAddress:   "kii10d07y265gmmuvt4z0w9aw880jnsr700jrff0qv",
+					Amount:      sdk.NewCoins(sdk.NewCoin("stake", math.NewInt(100))),
+				}}, true))),
+			},
+			expectErr: true,
+		},
 	}
 
 	for _, tc := range testCases {
@@ -218,3 +270,8 @@ func newGovProp(msgs []sdk.Msg, expedite bool) *govv1.MsgSubmitProposal {
 	// fmt.Println("### msg ###", msg, "err", err)
 	return msg
 }
+
+func newAuthzExec(msgs ...sdk.Msg) sdk.Msg {
+	m := authz.NewMsgExec(sdk.AccAddress("expedited-authz-grantee"), msgs)
+	return &m
+}