Repository: initia-labs/initia
Pull request #399: feat: add hashed address check to hook receiver validation
Author: login: sh-cha
Created: 2025-05-08T05:07:08Z | Merged: 2025-05-08T05:30:12Z

close #396

allow to execute hook receiver as both `receiver == functionIdentifier` and `receiver == bech32("init", sha256(functionIdentifier))`

```go
        functionIdentifier := fmt.Sprintf("%s::%s::%s", msg.ModuleAddress, msg.ModuleName, msg.FunctionName)
 	if receiver == functionIdentifier {
 		return nil
 	}

 	hashedFunctionIdentifier := sha256.Sum256([]byte(functionIdentifier))
 	hashedFunctionIdentifierString, err := ac.BytesToString(hashedFunctionIdentifier[:])
```

Linked issue #396: feat: allow to put only contract address as receiver
## Problem

Currently we have found noble is doing address validation when it create IBC transfer message, and it is not working out with initia ibc-hooks  current receiver validation logics.

https://github.com/initia-labs/initia/blob/8f1271e98dc3457d985c5688aa3b6a7c2fe3257b/x/ibc-hooks/move-hooks/util.go#L77-L87

Error from noble site

![Image](https://github.com/user-attachments/assets/4be1e709-52ad-4702-af6c-e90805e96c30)


## Proposal

Convert address validation logic to allow both function identifier and `bech32(hash(function identifier))`






Diff:
diff --git a/x/ibc-hooks/move-hooks/receive.go b/x/ibc-hooks/move-hooks/receive.go
index ffe5fbe33..b9536da73 100644
--- a/x/ibc-hooks/move-hooks/receive.go
+++ b/x/ibc-hooks/move-hooks/receive.go
@@ -37,7 +37,7 @@ func (h MoveHooks) onRecvIcs20Packet(
 	}
 
 	// Validate whether the receiver is correctly specified or not.
-	if err := validateReceiver(msg, data.Receiver); err != nil {
+	if err := validateReceiver(msg, data.Receiver, h.ac); err != nil {
 		return newEmitErrorAcknowledgement(err)
 	}
 
@@ -89,7 +89,7 @@ func (h MoveHooks) onRecvIcs721Packet(
 	}
 
 	// Validate whether the receiver is correctly specified or not.
-	if err := validateReceiver(msg, data.Receiver); err != nil {
+	if err := validateReceiver(msg, data.Receiver, h.ac); err != nil {
 		return newEmitErrorAcknowledgement(err)
 	}
 
diff --git a/x/ibc-hooks/move-hooks/receive_test.go b/x/ibc-hooks/move-hooks/receive_test.go
index e6fb08ee9..952f20bad 100644
--- a/x/ibc-hooks/move-hooks/receive_test.go
+++ b/x/ibc-hooks/move-hooks/receive_test.go
@@ -92,6 +92,57 @@ func Test_onReceiveIcs20Packet_memo(t *testing.T) {
 	require.Equal(t, "\"1\"", queryRes.Ret)
 }
 
+func Test_onReceiveIcs20Packet_memo_with_hashed_receiver(t *testing.T) {
+	ctx, input := createDefaultTestInput(t)
+	_, _, addr := keyPubAddr()
+
+	data := transfertypes.FungibleTokenPacketData{
+		Denom:    "foo",
+		Amount:   "10000",
+		Sender:   addr.String(),
+		Receiver: "cosmos1w53w03gsuvwazjx7jkq530q2l4e496m00hcx2rkj43gvl4vx9zrs65nfw5",
+		Memo: `{
+			"move": {
+				"message": {
+					"module_address": "0x1",
+					"module_name": "Counter",
+					"function_name": "increase"
+				}
+			}
+		}`,
+	}
+
+	dataBz, err := json.Marshal(&data)
+	require.NoError(t, err)
+
+	// failed to due to acl
+	ack := input.IBCHooksMiddleware.OnRecvPacket(ctx, channeltypes.Packet{
+		Data: dataBz,
+	}, addr)
+	require.False(t, ack.Success())
+
+	// set acl
+	require.NoError(t, input.IBCHooksKeeper.SetAllowed(ctx, movetypes.ConvertVMAddressToSDKAddress(vmtypes.StdAddress), true))
+
+	// success
+	ack = input.IBCHooksMiddleware.OnRecvPacket(ctx, channeltypes.Packet{
+		Data: dataBz,
+	}, addr)
+	require.True(t, ack.Success())
+
+	// check the contract state
+	queryRes, _, err := input.MoveKeeper.ExecuteViewFunction(
+		ctx,
+		vmtypes.StdAddress,
+		"Counter",
+		"get",
+		[]vmtypes.TypeTag{},
+		[][]byte{},
+	)
+	require.NoError(t, err)
+	require.Equal(t, "\"1\"", queryRes.Ret)
+}
+
 func Test_OnReceivePacket_ICS721(t *testing.T) {
 	ctx, input := createDefaultTestInput(t)
 	_, _, addr := keyPubAddr()
diff --git a/x/ibc-hooks/move-hooks/util.go b/x/ibc-hooks/move-hooks/util.go
index f99125dea..d8d8df4f0 100644
--- a/x/ibc-hooks/move-hooks/util.go
+++ b/x/ibc-hooks/move-hooks/util.go
@@ -1,6 +1,7 @@
 package move_hooks
 
 import (
+	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"strings"
@@ -16,6 +17,8 @@ import (
 
 	nfttransfertypes "github.com/initia-labs/initia/x/ibc/nft-transfer/types"
 	movetypes "github.com/initia-labs/initia/x/move/types"
+
+	coreaddress "cosmossdk.io/core/address"
 )
 
 const senderPrefix = "ibc-move-hook-intermediary"
@@ -74,12 +77,17 @@ func validateAndParseMemo(memo string) (
 	return
 }
 
-func validateReceiver(msg *movetypes.MsgExecute, receiver string) error {
+func validateReceiver(msg *movetypes.MsgExecute, receiver string, ac coreaddress.Codec) error {
 	functionIdentifier := fmt.Sprintf("%s::%s::%s", msg.ModuleAddress, msg.ModuleName, msg.FunctionName)
-	if receiver != functionIdentifier {
-		return errors.Wrap(channeltypes.ErrInvalidPacket, "receiver is not properly set")
+	if receiver == functionIdentifier {
+		return nil
 	}
 
+	hashedFunctionIdentifier := sha256.Sum256([]byte(functionIdentifier))
+	hashedFunctionIdentifierString, err := ac.BytesToString(hashedFunctionIdentifier[:])
+	if err != nil || receiver != hashedFunctionIdentifierString {
+		return errors.Wrap(channeltypes.ErrInvalidPacket, "receiver is not properly set")
+	}
 	return nil
 }
 
diff --git a/x/ibc-hooks/move-hooks/util_test.go b/x/ibc-hooks/move-hooks/util_test.go
index 2e9611fff..49af252fa 100644
--- a/x/ibc-hooks/move-hooks/util_test.go
+++ b/x/ibc-hooks/move-hooks/util_test.go
@@ -10,6 +10,8 @@ import (
 	movetypes "github.com/initia-labs/initia/x/move/types"
 	vmtypes "github.com/initia-labs/movevm/types"
 
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	authcodec "github.com/cosmos/cosmos-sdk/x/auth/codec"
 	transfertypes "github.com/cosmos/ibc-go/v8/modules/apps/transfer/types"
 
 	"github.com/stretchr/testify/require"
@@ -45,6 +47,7 @@ func Test_isIcs721Packet(t *testing.T) {
 }
 
 func Test_validateAndParseMemo_without_callback(t *testing.T) {
+	ac := authcodec.NewBech32Codec(sdk.GetConfig().GetBech32AccountAddrPrefix())
 
 	argBz, err := vmtypes.SerializeUint64(100)
 	require.NoError(t, err)
@@ -74,11 +77,11 @@ func Test_validateAndParseMemo_without_callback(t *testing.T) {
 		},
 		AsyncCallback: nil,
 	}, hookData)
-	require.NoError(t, validateReceiver(hookData.Message, "0x1::dex::swap"))
+	require.NoError(t, validateReceiver(hookData.Message, "0x1::dex::swap", ac))
 
 	// invalid receiver
 	require.NoError(t, err)
-	require.Error(t, validateReceiver(hookData.Message, "0x2::dex::swap"))
+	require.Error(t, validateReceiver(hookData.Message, "0x2::dex::swap", ac))
 
 	isMoveRouted, _, err = validateAndParseMemo("hihi")
 	require.False(t, isMoveRouted)
@@ -86,6 +89,7 @@ func Test_validateAndParseMemo_without_callback(t *testing.T) {
 }
 
 func Test_validateAndParseMemo_with_callback(t *testing.T) {
+	ac := authcodec.NewBech32Codec(sdk.GetConfig().GetBech32AccountAddrPrefix())
 
 	argBz, err := vmtypes.SerializeUint64(100)
 	require.NoError(t, err)
@@ -124,5 +128,22 @@ func Test_validateAndParseMemo_with_callback(t *testing.T) {
 			ModuleName:    "dex",
 		},
 	}, hookData)
-	require.NoError(t, validateReceiver(hookData.Message, "0x1::dex::swap"))
+	require.NoError(t, validateReceiver(hookData.Message, "0x1::dex::swap", ac))
+}
+
+func Test_validateReceiver(t *testing.T) {
+	ac := authcodec.NewBech32Codec(sdk.GetConfig().GetBech32AccountAddrPrefix())
+
+	hookData := HookData{
+		Message: &movetypes.MsgExecute{
+			ModuleAddress: "0x1",
+			ModuleName:    "dex",
+			FunctionName:  "swap",
+			TypeArgs:      []string{},
+			Args:          [][]byte{},
+		},
+	}
+
+	require.NoError(t, validateReceiver(hookData.Message, "cosmos14ve5y0rgh6aaa45k0g99ctj4la0hw3prr6h7e57mzqx86eg63r6s9yz06a", ac))
+	require.NoError(t, validateReceiver(hookData.Message, "0x1::dex::swap", ac))
 }


Reviews:
user: login: beer-1
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-05-08T05:15:45Z
user: login: sh-cha
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-08T05:25:16Z
user: login: beer-1
body: LGTM
state: APPROVED
author_association: MEMBER
submitted_at: 2025-05-08T05:30:11Z

Review comments:
diff_hunk: @@ -76,10 +77,10 @@ func validateAndParseMemo(memo string) (
 
 func validateReceiver(msg *movetypes.MsgExecute, receiver string) error {
 	functionIdentifier := fmt.Sprintf("%s::%s::%s", msg.ModuleAddress, msg.ModuleName, msg.FunctionName)
-	if receiver != functionIdentifier {
+	hashedFunctionIdentifier := sha256.Sum256([]byte(functionIdentifier))
+	if receiver != functionIdentifier && receiver != sdk.AccAddress(hashedFunctionIdentifier[:]).String() {
path: x/ibc-hooks/move-hooks/util.go
user: login: beer-1
body: can we use `h.ac` instead of AccAddress.String()?
created_at: 2025-05-08T05:15:45Z
author_association: MEMBER
diff_hunk: @@ -76,10 +77,10 @@ func validateAndParseMemo(memo string) (
 
 func validateReceiver(msg *movetypes.MsgExecute, receiver string) error {
 	functionIdentifier := fmt.Sprintf("%s::%s::%s", msg.ModuleAddress, msg.ModuleName, msg.FunctionName)
-	if receiver != functionIdentifier {
+	hashedFunctionIdentifier := sha256.Sum256([]byte(functionIdentifier))
+	if receiver != functionIdentifier && receiver != sdk.AccAddress(hashedFunctionIdentifier[:]).String() {
path: x/ibc-hooks/move-hooks/util.go
user: login: sh-cha
body: fixed
created_at: 2025-05-08T05:25:16Z
author_association: CONTRIBUTOR

PR comments:
user: login: coderabbitai[bot]
created_at: 2025-05-08T05:07:16Z
body: <!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- This is an auto-generated comment: failure by coderabbit.ai -->

> [!CAUTION]
> ## Review failed
> 
> The pull request is closed.

<!-- end of auto-generated comment: failure by coderabbit.ai -->
<!-- walkthrough_start -->

<details>
<summary>📝 Walkthrough</summary>

## Walkthrough

A new test was added to verify ICS20 packet handling when the receiver uses a hashed Cosmos SDK address. The `validateReceiver` function was updated to accept both Move VM address strings and their hashed forms. Corresponding unit tests were introduced to ensure correct validation of both receiver formats. Calls to `validateReceiver` were updated to include an account codec parameter.

## Changes

| File(s)                                            | Change Summary                                                                                                              |
|----------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------|
| x/ibc-hooks/move-hooks/receive_test.go             | Added `Test_onReceiveIcs20Packet_memo_with_hashed_receiver` to test ICS20 packet handling with hashed receiver addresses.   |
| x/ibc-hooks/move-hooks/util.go                      | Modified `validateReceiver` signature to include codec; updated logic to accept both Move VM address strings and SHA-256 hashed addresses. |
| x/ibc-hooks/move-hooks/util_test.go                 | Added `Test_validateReceiver` to verify `validateReceiver` accepts both string and hashed receiver formats; updated existing tests to pass codec argument. |
| x/ibc-hooks/move-hooks/receive.go                   | Updated calls to `validateReceiver` to pass the `ac` codec parameter in `onRecvIcs20Packet` and `onRecvIcs721Packet`.       |

## Sequence Diagram(s)

```mermaid
sequenceDiagram
    participant Test as Test Suite
    participant Handler as ICS20 Packet Handler
    participant Validator as validateReceiver
    participant Contract as Move Contract

    Test->>Handler: Send ICS20 packet with hashed receiver
    Handler->>Validator: validateReceiver(msg, receiver, ac)
    Validator-->>Handler: Return error (if ACL not set)
    Test->>Handler: Set ACL, resend packet
    Handler->>Validator: validateReceiver(msg, receiver, ac)
    Validator-->>Handler: Success
    Handler->>Contract: Execute Move function
    Contract-->>Handler: State updated
    Handler-->>Test: Confirm contract state incremented
```

## Poem

> In the warren of code, a new path appears,  
> Where hashed and stringed receivers calm our fears.  
> Packets hop safely, both forms now allowed,  
> With tests to ensure the logic stands proud.  
> The rabbits rejoice as validation grows—  
> Address or hash, the contract still knows! 🐇✨

</details>

<!-- walkthrough_end -->
<!-- internal state start -->


<!-- DwQgtGAEAqAWCWBnSTIEMB26CuAXA9mAOYCmGJATmriQCaQDG+Ats2bgFyQAOFk+AIwBWJBrngA3EsgEBPRvlqU0AgfFwA6NPEgQAfACgjoCEYDEZyAAUASpETZWaCrKNwSPbABsvkCiQBHbGlcSHFcLzpIACI0WnpYNERYKLjaf0RkBhSGAGsw/EhYfHx8/wYSSUpICTQveFpqeHwMaMgAdyT7bAFmdRp6OTCUyGxEauSwbLR0ZG5vX38gkMgMRwFqgGYATm2ULFwR/258RHV8Fw0YEaVEBgp4bnEWvxIAM0oyCuQkBw8Lzw+V7LRChNbMDZ8HYANkgAjwkFo+Gkq3woV4+AkDQ8aXUzQwdURJFw2i8iCu7kYiQwpH2EnwXikyFxNPQRSSKXoaQyWRy+S63GcoXwb2GHlq9UazywGO+yDeAOKpVeFSqFHJ1w8tkYmDhHn8WJI7VSoUOHgAqjYADJcWC4XDcRAcAD0zqI6lgPQ0TGYzvgGDxaDAXhUiD9AfEaGd8x8zp22w0Rn0xnAUDI9BFOAIxDIygGClY7C4vH4wlE4iZcPkTCUVFU6i0OmTJigcFQqF1aDwhFI5Co+Z9bAwnD8aHa3ScLirClrKjUmm0ujAhhTpgMAA8/QIGGAlbkw8xMSRdyV987ypUpAB9GigjREfAcAzRF8GCyQACCAEkc33qFEHEneRM2mGlpCMD9ViNMIVjebAMDEfFIAAA2gEIrxaGxREvEgvwYRAACYAAYrDQPJiSvNhDyvdoPSvRJkjoK8LzVZCOi6NIogIGpKHgN55DNPVEixAFM0Er8AGEAGViJ4MjcmJFUcPZDBaEiPh2hSA4jmwtVIDeeASC8egmGHbQMGZdlGPoCTTkPZApIAEQAaXQeIeX2UESDifhRRmABZI9IAANX8tz0mkZBQQeGkKRGW9QlM6LsDESy4JpeABEiAoFJleTFNow42QYzklL07lIvQVS2SowpEG4UQ+Nkf0iDZQKpEgQ9aG8DwGDqLwri/UIDPVUIknGChcGQQ5qDFOTyPRCh8DlFr9NJZBuo8biyLlBRhyWxYQgeRCWg1dwsHUexiWmkYdsq0zcAOyB6lBSAAAoPwkq0AEoCnQHx8HHQTQUwRoKHodqPFC8KPNB14wH9ekFJujxBQWsqOupNTKAAGkgEh1waxDWQcBg5SuAAxf1+tkPHLuWB4UUEyG9sesjQhBmg/tMkbmGGWbBOif17m88Y2nSk6sE6ZACdEPA6DxqQHn41bBIeqgxHsEkueF/wh00a5UASzr4AoJb1TmgmkHEVlUPQzDdKkPDCJI/LcEokhDzY+FQloPiPgtoYxlWmYSqiFilZhyqFQoZhZv7FI+BmrAAqC6GKsyLWYqIRMjDfSwPy8Gh+3xabCkEpQGBDEvTt8/HCYufMAXmLL4AYfHhzxcCDCgCn4Ml8K6C4ZCJZge2MCw1Unfw4jSIWj3qMK2B6I5JiI8oN7QgAKgSlqNGgb62P9FDN0ync9wPI8T1KMN15vEJ73wZDn1fHu11P7dr7PQ8pC/sM8HgANB8T4XzRHzp+H8vY8wAUcHHKcIFqSkEQG4EYyEJQNH/JPHCFA2IS2lPYeARACS4GwP4diyBsDcClFxQowsvDYCUFVcKeIWiEkFFQNgxcUJkTYmJWQDUUJMH8BncktlK7ITih4PBSEMCA30qbV62RRD7hQKKQSyF144KzqtOOuAlEoz2slMQUQR792lF+JQncDKUDYm9GOuj8xdGiF1HqH53KRQ4BwFxkQAByaA2CeOkS0PxbBoi/Thv4EhFALKrEAaolAvtkQai/KKWRuA6aJRYPMW8c0pIAAkPxgAIgAVlhCVOu6igkYAsewPihkcF41MkrKac1ylyBydtbRrJg6skEhiLESgTKKFENwhgGgABCshbzQHwFJR6LVkJ4zhj6dhTMEDIDDvQaKqty6oM0RIyAKS5oaMdjYzq1B9FQQ9NUPpIZj6mIQuYyx4hrFaNkUnEYmyqr0C+MMrZ8yaR4wBHxOaNYRlNMoGcF4kTSExN1JQc2eNBJVNeFEuFWAEXAtUm3JovSdJT2qO2ZgGIGoUC8PIcYBs2wy3XDQVSBj0FSiQl4fA7p27bTJiQJ4+NrkfNRncrAKLsRWPqfwPg6gNmry5NVX5gz9IXD5l0RlGNIW53fIXYuTRa7cQrqIauWqYmZgJicSaURm49HqO3Wp4hu69zMUhM4RDqCkI8JQ6htBh6j0ZZg05FA3rMEQK1LeP9iT8OkBofygaACi645Y0DxporpRBfqYq0YAJMIUJerqBgmgWC1T+sDZAYNR5cBhvJJGogMa40kATb6pNSz25CO8u4zIGgxGiBTWbC4R8sDIQ/ufU8l9f4X2dAAoBT8X5gLfmAIw/a/7OhDfOsd987zAMneA78v5oFbNgc4YCopQJIJQVtEIyA7agivN6mgH5VKkXVCQfynt8A0Q9PgPAV4+o+AEPJNicNz3uyvSQG9tA73jEfYvOin6vDfryGxY0ZC3X/noNxf0INO7/jZOM0QsBNgERnCMt6yEuyHDBWMnxRosPZFw+2hgyFwnVUFJnS6HEU7xBYQSXwzgiCOHYH9dRgG81K1wfal4UGzrrKpJgWkXU6lrI8I64hLq65oOzdQwTZzEbLQNcgJex8zTjBgqCMu+wq4MK2iMUjckOHEkoFcNxftpQ0yWVBIGsERO9rQhegTvq4McXiArDoCBsiMGETkmYyE8mnkctQNAPa0MVA6B6NkyEK1VoYPLNibBMhoFpHDJWsmbqzRU5KH1BKtEwuicgWR+Mu18BjmEdohRE32OoE6NktlED2T1FRvDIjvltSCt448KLtmArhGiWAclMipBZayJeoLhnt1QySBCJBJEucM6EY1lr1DkvrpQBgSAUTFZzSQdTWj5v6f1HW0tDVEB4zIA4bONRVMGoUGbcs5BM6XYs4t1mBNNDmALkXPMpc+M3D1c4bTddjWNzNXwFulqO7hEMsgnukA+6PKQpxD1mb+5jy8693NvrN5Ft3rFA+PaT5bgHTfBdV8R3LoSo/Z+oCkzvxp/OxdI716PxAa+dVkDcz9hgUBOuh7u6UglxQqhGGxPg48CdtTPn9LucS4cPTqCHYMAkM7Webtf3VWQtr3X+EADsBEACMc8FK4Ey8SYotBkBiVQZDSLN82JGINlYA0zQxjkrxkr0r2DfNZH6lES7jX0AUG4/rNrgksuIByziaqglE2jZzp+N4XC1aIJrQklAYefAR6S52NjjnfAa/BtH2P7BA+wC0LRuKqAZPWIZUT5lrK27TkY2cPFiueHyKMhmNRrujzu/3HFlbCWdX4uwS9kr+CqlXB8YUCb1QWVsoe7VlSakWpAr4OrBk+kWXjg7CD/w9BNfSA8Jwx35Igefgv9D2fHhK76ulM70UsPTUZgRxa7va1VHIwVfcgRMNnN+FcFsDuEfLMHsYXJDAsfWLgKgccQCOBeQIYMFOsecRsJcQwaAwcdQK8BoRAZiEgQ0Y0WgK8EGSafA1cKANAYpAAFgEAAA5oQ+o2C0BoQ3g3gKgiJik2DLdcMSBcMiJmCrdNhOC3hoQBBaALcCIohmxUxIBtgBBNhLdilGgBAlCCJNhNhmDoQSBoRtg5D1Dthik0A2Dth+CSAiIDCVBLdmCTCzd6CDBCCWA+h3ZSDyDKCmJ0x8CgA== -->

<!-- internal state end -->
<!-- announcements_start -->

> [!TIP]
> <details>
> <summary>⚡️ Faster reviews with caching</summary>
> 
> - CodeRabbit now supports caching for code and dependencies, helping speed up reviews. This means quicker feedback, reduced wait times, and a smoother review experience overall. Cached data is encrypted and stored securely. This feature will be automatically enabled for all accounts on May 16th. To opt out, configure `Review - Disable Cache` at either the organization or repository level. If you prefer to disable all data retention across your organization, simply turn off the `Data Retention` setting under your Organization Settings.
> 
> Enjoy the performance boost—your workflow just got faster.
> 
> </details>

<!-- announcements_end -->

---

<details>
<summary>📜 Recent review details</summary>

**Configuration used: CodeRabbit UI**
**Review profile: CHILL**
**Plan: Lite**

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 9b315dab2e23346e696b9b95a89fce033ab14e67 and e871f9ec3ea15e20371762eca2703828f26c3a30.

</details>

<details>
<summary>📒 Files selected for processing (1)</summary>

* `x/ibc-hooks/move-hooks/util.go` (3 hunks)

</details>

</details>
<!-- tips_start -->

---



<details>
<summary>🪧 Tips</summary>

### Chat

There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=initia-labs/initia&utm_content=399):

- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  - `I pushed a fix in commit <commit_id>, please review it.`
  - `Generate unit testing code for this file.`
  - `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
  - `@coderabbitai generate unit testing code for this file.`
  -	`@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  - `@coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.`
  - `@coderabbitai read src/utils.ts and generate unit testing code.`
  - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
  - `@coderabbitai help me debug CodeRabbit configuration file.`

### Support

Need help? Create a ticket on our [support page](https://www.coderabbit.ai/contact-us/support) for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

### CodeRabbit Commands (Invoked using PR comments)

- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai generate sequence diagram` to generate a sequence diagram of the changes in this PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.

### Other keywords and placeholders

- Add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
- Add `@coderabbitai summary` to generate the high-level summary at a specific location in the PR description.
- Add `@coderabbitai` anywhere in the PR title to generate the title automatically.

### CodeRabbit Configuration File (`.coderabbit.yaml`)

- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`

### Documentation and Community

- Visit our [Documentation](https://docs.coderabbit.ai) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](http://discord.gg/coderabbit) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

</details>

<!-- tips_end -->
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-05-08T05:08:25Z
body: <h1>Dependency Review</h1>
✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.<h2>Scanned Files</h2>
None

<!-- dependency-review-pr-comment-marker -->
author_association: CONTRIBUTOR
user: login: codecov[bot]
created_at: 2025-05-08T05:20:38Z
body: ## [Codecov](https://app.codecov.io/gh/initia-labs/initia/pull/399?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 40.18%. Comparing base [(`8f1271e`)](https://app.codecov.io/gh/initia-labs/initia/commit/8f1271e98dc3457d985c5688aa3b6a7c2fe3257b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs) to head [(`a54b86c`)](https://app.codecov.io/gh/initia-labs/initia/commit/a54b86ca8a6ffce058132e32042136cf6bd722ed?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs).

<details><summary>Additional details and impacted files</summary>


[![Impacted file tree graph](https://app.codecov.io/gh/initia-labs/initia/pull/399/graphs/tree.svg?width=650&height=150&src=pr&token=CQ8FELH3BU&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs)](https://app.codecov.io/gh/initia-labs/initia/pull/399?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs)

```diff
@@           Coverage Diff           @@
##             main     #399   +/-   ##
=======================================
  Coverage   40.18%   40.18%           
=======================================
  Files         294      294           
  Lines       27542    27543    +1     
=======================================
+ Hits        11067    11068    +1     
  Misses      14772    14772           
  Partials     1703     1703           
```

| [Files with missing lines](https://app.codecov.io/gh/initia-labs/initia/pull/399?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs) | Coverage Δ | |
|---|---|---|
| [x/ibc-hooks/move-hooks/util.go](https://app.codecov.io/gh/initia-labs/initia/pull/399?src=pr&el=tree&filepath=x%2Fibc-hooks%2Fmove-hooks%2Futil.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=initia-labs#diff-eC9pYmMtaG9va3MvbW92ZS1ob29rcy91dGlsLmdv) | `84.93% <100.00%> (+0.20%)` | :arrow_up: |

</details>
<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
author_association: NONE