Incorrect header validation during tendermint client update

[rnbguy]

Bug Summary

This check inside Header::validate_basic is not correct

ibc-rs/crates/ibc/src/clients/ics07_tendermint/header.rs

Line 129 in a2d10f1

if self.trusted_next_validator_set.hash() != self.signed_header.header.next_validators_hash

Because trusted_next_validator_set is the next_validator_set of the header at the trusted height stored in the client state on the host. Semantically it is different than the submitted header's next_validator_set.

Details

We need to remove this condition. The correct condition is checked after validate_basic() in ClientState::verify_header().

ibc-rs/crates/ibc/src/clients/ics07_tendermint/client_state/update_client.rs

Lines 35 to 42 in ccd6a97

	let trusted_client_cons_state_path =
	ClientConsensusStatePath::new(client_id, &header.trusted_height);
	let trusted_consensus_state = downcast_tm_consensus_state(
	ctx.consensus_state(&trusted_client_cons_state_path)?
	.as_ref(),
	)?;
	check_header_trusted_next_validator_set(&header, &trusted_consensus_state)?;

ibc-rs/crates/ibc/src/clients/ics07_tendermint/client_state.rs

Lines 769 to 775 in a2d10f1

	fn check_header_trusted_next_validator_set(
	header: &TmHeader,
	trusted_consensus_state: &TmConsensusState,
	) -> Result<(), ClientError> {
	if header.trusted_next_validator_set.hash() == trusted_consensus_state.next_validators_hash {
	Ok(())
	} else {

Version

>=0.40.0