feat: daily bridge transfer limits (#1198)

# Related Github tickets

- Closes VolumeFi#1711

# Background

Add a limit to the amount of tokens transferred out from paloma within a
specified window, per token. This is defined by a new governance vote.

- Add governance vote. Can define token, window size, token limit and
list of exempt addresses.
- Keep a counter of the number of tokens transferred and the block
height at the start of the limiting window.
- Before accepting a transfer, update the counters and check the limits.
- Transfers are refused if over the transfer limit.

# Testing completed

- [x] test coverage exists or has been added/updated
- [x] tested in a private testnet

# Breaking changes

- [x] I have checked my code for breaking changes
- [x] If there are breaking changes, there is a supporting migration.

Author: maharifu

proto/palomachain/paloma/gravity/bridge_transfer_limit.proto

@@ -0,0 +1,44 @@
+syntax = "proto3";
+package palomachain.paloma.gravity;
+
+import "gogoproto/gogo.proto";
+
+option go_package = "github.com/palomachain/paloma/x/gravity/types";
+
+enum LimitPeriod {
+  NONE = 0;
+  DAILY = 1;
+  WEEKLY = 2;
+  MONTHLY = 3;
+  YEARLY = 4;
+}
+
+// Allow at most `limit` tokens of `token` to be transferred within a
+// `limit_period` window. `limit_period` will be converted to blocks.
+// If more than `limit` tokens are attempted to be transferred between those
+// block heights, the transfer is not allowed.
+// If the sender is in `exempt_addresses`, the limits are not checked nor
+// updated.
+message BridgeTransferLimit {
+  string token = 1;
+  string limit = 2 [
+    (gogoproto.customtype) = "cosmossdk.io/math.Int",
+    (gogoproto.nullable) = false
+  ];
+  LimitPeriod limit_period = 3;
+  repeated bytes exempt_addresses = 4 [
+    (gogoproto.casttype) = "github.com/cosmos/cosmos-sdk/types.AccAddress"
+  ];
+}
+
+// Transfer usage counters used to check for transfer limits for a single denom.
+// `total` maintains the total amount transferred during the current window.
+// `start_block_height` maintains the block height of the first transfer in the
+// current window.
+message BridgeTransferUsage {
+  string total = 1 [
+    (gogoproto.customtype) = "cosmossdk.io/math.Int",
+    (gogoproto.nullable) = false
+  ];
+  int64 start_block_height = 2;
+}

proto/palomachain/paloma/gravity/bridge_transfer_limit_proposal.proto

@@ -0,0 +1,19 @@
+syntax = "proto3";
+package palomachain.paloma.gravity;
+
+import "gogoproto/gogo.proto";
+import "palomachain/paloma/gravity/bridge_transfer_limit.proto";
+
+option go_package = "github.com/palomachain/paloma/x/gravity/types";
+
+message SetBridgeTransferLimitProposal {
+  string title = 1;
+  string description = 2;
+  string token = 3;
+  string limit = 4 [
+    (gogoproto.customtype) = "cosmossdk.io/math.Int",
+    (gogoproto.nullable) = false
+  ];
+  LimitPeriod limit_period = 5;
+  repeated string exempt_addresses = 6;
+}

proto/palomachain/paloma/gravity/genesis.proto

@@ -6,6 +6,7 @@ import "palomachain/paloma/gravity/types.proto";
 import "palomachain/paloma/gravity/msgs.proto";
 import "palomachain/paloma/gravity/batch.proto";
 import "palomachain/paloma/gravity/bridge_tax.proto";
+import "palomachain/paloma/gravity/bridge_transfer_limit.proto";
 import "palomachain/paloma/gravity/attestation.proto";
 import "cosmos/base/v1beta1/coin.proto";
 import "palomachain/paloma/gravity/params.proto";
@@ -22,7 +23,8 @@ message GenesisState {
   repeated ERC20ToDenom erc20_to_denoms = 9 [ (gogoproto.nullable) = false ];
   repeated OutgoingTransferTx unbatched_transfers = 10
       [ (gogoproto.nullable) = false ];
-  BridgeTax BridgeTax = 11;
+  BridgeTax bridge_tax = 11;
+  repeated BridgeTransferLimit bridge_transfer_limits = 12;
 }
 
 // GravityCounters contains the many noces and counters required to maintain the

proto/palomachain/paloma/gravity/query.proto

@@ -11,6 +11,7 @@ import "palomachain/paloma/gravity/types.proto";
 import "palomachain/paloma/gravity/msgs.proto";
 import "palomachain/paloma/gravity/params.proto";
 import "palomachain/paloma/gravity/bridge_tax.proto";
+import "palomachain/paloma/gravity/bridge_transfer_limit.proto";
 import "google/protobuf/empty.proto";
 
 option go_package = "github.com/palomachain/paloma/x/gravity/types";
@@ -48,6 +49,12 @@ service Query {
   rpc GetBridgeTax(google.protobuf.Empty) returns (QueryBridgeTaxResponse) {
     option (google.api.http).get = "/palomachain/paloma/gravity/bridge_tax";
   }
+
+  rpc GetBridgeTransferLimits(google.protobuf.Empty)
+      returns (QueryBridgeTransferLimitsResponse) {
+    option (google.api.http).get =
+      "/palomachain/paloma/gravity/all_bridge_transfer_limits";
+  }
 }
 
 message QueryParamsRequest {}
@@ -157,3 +164,12 @@ message QueryPendingSendToEthResponse {
 message QueryBridgeTaxResponse {
   BridgeTax bridge_tax = 1;
 }
+
+message QueryBridgeTransferLimitsResponse {
+  message LimitUsage {
+    BridgeTransferLimit limit = 1;
+    BridgeTransferUsage usage = 2;
+  }
+
+  repeated LimitUsage limits = 1;
+}

x/gravity/client/cli/query.go

@@ -37,6 +37,7 @@ func GetQueryCmd() *cobra.Command {
 		CmdGetLastObservedEthNonce(),
 		GetCmdQueryParams(),
 		GetCmdQueryBridgeTax(),
+		GetCmdQueryBridgeTransferLimits(),
 	}...)
 
 	return gravityQueryCmd
@@ -366,3 +367,33 @@ func GetCmdQueryBridgeTax() *cobra.Command {
 
 	return cmd
 }
+
+// GetCmdQueryBridgeTransferLimits fetches transfer limits for all tokens
+func GetCmdQueryBridgeTransferLimits() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "bridge-transfer-limits",
+		Short: "Query bridge transfer limits for all tokens",
+		Args:  cobra.ExactArgs(0),
+		RunE: func(cmd *cobra.Command, args []string) (err error) {
+			clientCtx, err := client.GetClientTxContext(cmd)
+			if err != nil {
+				return err
+			}
+
+			queryClient := types.NewQueryClient(clientCtx)
+
+			params := &emptypb.Empty{}
+
+			res, err := queryClient.GetBridgeTransferLimits(cmd.Context(), params)
+			if err != nil {
+				return err
+			}
+
+			return clientCtx.PrintProto(res)
+		},
+	}
+
+	flags.AddQueryFlagsToCmd(cmd)
+
+	return cmd
+}

x/gravity/client/cli/tx_proposal.go

@@ -3,7 +3,9 @@ package cli
 import (
 	"fmt"
 	"math/big"
+	"strings"
 
+	"cosmossdk.io/math"
 	"github.com/VolumeFi/whoops"
 	"github.com/cosmos/cosmos-sdk/client"
 	"github.com/cosmos/cosmos-sdk/client/flags"
@@ -28,6 +30,7 @@ func CmdGravityProposalHandler() *cobra.Command {
 	cmd.AddCommand([]*cobra.Command{
 		CmdSetErc20ToDenom(),
 		CmdSetBridgeTax(),
+		CmdSetBridgeTransferLimit(),
 	}...)
 
 	return cmd
@@ -111,7 +114,7 @@ func CmdSetBridgeTax() *cobra.Command {
 				return err
 			}
 
-			description, err := cmd.Flags().GetString(cli.FlagTitle)
+			description, err := cmd.Flags().GetString(cli.FlagSummary)
 			if err != nil {
 				return err
 			}
@@ -158,3 +161,78 @@ func CmdSetBridgeTax() *cobra.Command {
 	applyFlags(cmd)
 	return cmd
 }
+
+func CmdSetBridgeTransferLimit() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "set-bridge-transfer-limit [token] [limit] [limit-period]",
+		Short: "Sets the bridge transfer limit, and optionally exempt addresses",
+		Long: `Set the bridge transfer limit for the specified token.
+[limit-period] must be one of: NONE, DAILY, WEEKLY, MONTHLY, YEARLY. Setting it to NONE effectively disables the limit.
+[limit-period] will be converted to a block window. At most, [limit] tokens can be transferred within each block window. After that transfers will fail.`,
+		Example: "set-bridge-transfer-limit ugrain 1000000 DAILY",
+		Args:    cobra.ExactArgs(3),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			cliCtx, err := client.GetClientTxContext(cmd)
+			if err != nil {
+				return err
+			}
+
+			token, limitRaw, limitPeriodRaw := args[0], args[1], args[2]
+
+			limit, ok := math.NewIntFromString(limitRaw)
+			if !ok {
+				return fmt.Errorf("invalid limit: %v", limitRaw)
+			}
+
+			// Accept both lower case and upper case limit period strings
+			limitPeriod, ok := types.LimitPeriod_value[strings.ToUpper(limitPeriodRaw)]
+			if !ok {
+				return fmt.Errorf("invalid limit period: %v", limitPeriodRaw)
+			}
+
+			title, err := cmd.Flags().GetString(cli.FlagTitle)
+			if err != nil {
+				return err
+			}
+
+			description, err := cmd.Flags().GetString(cli.FlagSummary)
+			if err != nil {
+				return err
+			}
+
+			exemptAddresses, err := cmd.Flags().GetStringSlice(flagExemptAddresses)
+			if err != nil {
+				return err
+			}
+
+			prop := &types.SetBridgeTransferLimitProposal{
+				Title:           title,
+				Description:     description,
+				Token:           token,
+				Limit:           limit,
+				LimitPeriod:     types.LimitPeriod(limitPeriod),
+				ExemptAddresses: exemptAddresses,
+			}
+
+			from := cliCtx.GetFromAddress()
+
+			deposit, err := getDeposit(cmd)
+			if err != nil {
+				return err
+			}
+
+			msg, err := govv1beta1types.NewMsgSubmitProposal(prop, deposit, from)
+			if err != nil {
+				return err
+			}
+
+			return tx.GenerateOrBroadcastTxCLI(cliCtx, cmd.Flags(), msg)
+		},
+	}
+
+	cmd.Flags().StringSlice(flagExemptAddresses, []string{},
+		"Comma separated list of addresses exempt from the bridge tax. Can be passed multiple times.")
+
+	applyFlags(cmd)
+	return cmd
+}

x/gravity/keeper/genesis.go

@@ -142,6 +142,14 @@ func InitGenesis(ctx context.Context, k Keeper, data types.GenesisState) {
 			panic(err)
 		}
 	}
+
+	if data.BridgeTransferLimits != nil {
+		for _, limit := range data.BridgeTransferLimits {
+			if err := k.SetBridgeTransferLimit(ctx, limit); err != nil {
+				panic(err)
+			}
+		}
+	}
 }
 
 // ExportGenesis exports all the state needed to restart the chain
@@ -236,14 +244,20 @@ func ExportGenesis(ctx context.Context, k Keeper) types.GenesisState {
 		panic(err)
 	}
 
+	limits, err := k.AllBridgeTransferLimits(ctx)
+	if err != nil && !errors.Is(err, keeperutil.ErrNotFound) {
+		panic(err)
+	}
+
 	return types.GenesisState{
-		Params:             &p,
-		GravityNonces:      nonces,
-		Batches:            extBatches,
-		BatchConfirms:      batchconfs,
-		Attestations:       attestations,
-		Erc20ToDenoms:      erc20ToDenoms,
-		UnbatchedTransfers: unbatchedTxs,
-		BridgeTax:          tax,
+		Params:               &p,
+		GravityNonces:        nonces,
+		Batches:              extBatches,
+		BatchConfirms:        batchconfs,
+		Attestations:         attestations,
+		Erc20ToDenoms:        erc20ToDenoms,
+		UnbatchedTransfers:   unbatchedTxs,
+		BridgeTax:            tax,
+		BridgeTransferLimits: limits,
 	}
 }

x/gravity/keeper/genesis_test.go

@@ -7,7 +7,6 @@ import (
 
 	"cosmossdk.io/math"
 	sdk "github.com/cosmos/cosmos-sdk/types"
-	"github.com/palomachain/paloma/testutil/nullify"
 	"github.com/palomachain/paloma/x/gravity/types"
 	"github.com/stretchr/testify/require"
 )
@@ -152,6 +151,14 @@ func TestGenesis(t *testing.T) {
 			ExcludedTokens:  []string{"test"},
 			ExemptAddresses: addresses,
 		},
+		BridgeTransferLimits: []*types.BridgeTransferLimit{
+			{
+				Token:           "test",
+				Limit:           math.NewInt(1000),
+				LimitPeriod:     types.LimitPeriod_DAILY,
+				ExemptAddresses: addresses,
+			},
+		},
 	}
 
 	input := CreateTestEnv(t)
@@ -160,13 +167,11 @@ func TestGenesis(t *testing.T) {
 	got := ExportGenesis(input.Context, input.GravityKeeper)
 	require.NotNil(t, got)
 
-	nullify.Fill(&genesisState)
-	nullify.Fill(got)
-
 	require.Equal(t, genesisState.BridgeTax, got.BridgeTax)
+	require.Equal(t, genesisState.BridgeTransferLimits, got.BridgeTransferLimits)
 }
 
-func TestGenesisEmptyBridgeTax(t *testing.T) {
+func TestGenesisEmptyOptionalValues(t *testing.T) {
 	genesisState := types.GenesisState{
 		Params: types.DefaultParams(),
 	}
@@ -177,8 +182,6 @@ func TestGenesisEmptyBridgeTax(t *testing.T) {
 	got := ExportGenesis(input.Context, input.GravityKeeper)
 	require.NotNil(t, got)
 
-	nullify.Fill(&genesisState)
-	nullify.Fill(got)
-
 	require.Nil(t, got.BridgeTax)
+	require.Empty(t, got.BridgeTransferLimits)
 }

x/gravity/keeper/governance_proposals.go

@@ -34,6 +34,25 @@ func NewGravityProposalHandler(k Keeper) govv1beta1types.Handler {
 			}
 
 			return k.SetBridgeTax(ctx, bridgeTax)
+		case *types.SetBridgeTransferLimitProposal:
+			addresses := make([]sdk.AccAddress, 0, len(c.ExemptAddresses))
+			for _, addr := range c.ExemptAddresses {
+				address, err := sdk.AccAddressFromBech32(addr)
+				if err != nil {
+					return err
+				}
+
+				addresses = append(addresses, address)
+			}
+
+			limit := &types.BridgeTransferLimit{
+				Token:           c.Token,
+				Limit:           c.Limit,
+				LimitPeriod:     c.LimitPeriod,
+				ExemptAddresses: addresses,
+			}
+
+			return k.SetBridgeTransferLimit(ctx, limit)
 		}
 
 		return sdkerrors.ErrUnknownRequest