fix: cosmwasm evm query path repeatable undercharged evm exec

[mattkii]

Description

Fixes a gas-accounting vulnerability in the CosmWasm→EVM query bridge
(wasmbinding/evm/queries.go). Any CosmWasm contract could call the ERC20
information/balance/allowance queries against an arbitrary EVM contract, and each
sub-call was issued with gasCap=nil. The underlying EVM helper ignores a nil cap
and falls back to DefaultGasCap (25M), so an attacker-controlled ERC20 could force
large, repeatable internal EVM execution while the SDK gas meter was charged only the
post-refund amount — enabling sustained, undercharged validator compute.

This PR makes every internal ERC20 query sub-call pass a real gas cap bounded by the
transaction's remaining SDK gas (and DefaultGasCap), mirroring the existing
buildEthCallRequest behaviour used by the generic EthCall path.

Changes:

• Add queryGasCap(ctx) helper returning min(ctx.GasMeter().GasRemaining(), DefaultGasCap).
• Pass queryGasCap(ctx) instead of nil to all six sub-calls: decimals, name,
  symbol, totalSupply, balanceOf, allowance.

Dependencies: full mitigation also relies on the companion KiiChain/evm PR
(fix/wasm-repeatable-undercharged-internal-evm-exec) where CallEVMWithData now
honours the gas cap and bills the SDK meter for actual pre-refund EVM work. That fork
version must be published and the replace github.com/cosmos/evm => github.com/KiiChain/evm
directive in go.mod bumped for the fix to take full effect on-chain.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• go test -tags=test ./wasmbinding/evm/... — all query binding tests pass (incl. ERC20 information/balance/allowance and EthCall gas tests).
• go build ./wasmbinding/... — compiles cleanly.

PR Checklist:

• Updated changelog with PR's intent
• Lint with make lint-fix (golangci-lint v2.7.2, 0 issues)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: aaeb507f-2bd3-4d01-b273-b4731bffa09b

📥 Commits

Reviewing files that changed from the base of the PR and between 7f25e71 and 391c94b.

📒 Files selected for processing (3)

• .github/workflows/test.yml
• CHANGELOG.md
• wasmbinding/evm/queries.go

✅ Files skipped from review due to trivial changes (1)

• CHANGELOG.md

---

Walkthrough

The PR updates ERC20-related EVM query handlers to use a shared helper that passes a gas cap into internal ABI calls and charges additional SDK gas based on actual EVM work. It adds a changelog note for the fix. The test workflow also adds a wasmbinding-specific coverage run and uploads its profile to Codecov.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main fix to the CosmWasm-to-EVM query path and its gas-accounting issue.
Description check	✅ Passed	The description is directly related to the changeset and accurately describes the vulnerability fix and implementation details.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/wasm-repeatable-undercharged-internal-evm-exec

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
wasmbinding/evm/queries.go	85.71%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!