validate role metadata during initialization

x/fbridge/keeper/auth.go

@@ -218,6 +218,44 @@ func (k Keeper) SetRoleMetadata(ctx sdk.Context, data types.RoleMetadata) {
 	store.Set(types.KeyRoleMetadata, bz)
 }
 
+func (k Keeper) UpdateRole(ctx sdk.Context, role types.Role, addr sdk.AccAddress) error {
+	previousRole := k.GetRole(ctx, addr)
+	if previousRole == role {
+		return sdkerrors.ErrUnauthorized.Wrap("target already has same role")
+	}
+
+	metadata := k.GetRoleMetadata(ctx)
+
+	switch previousRole {
+	case types.RoleGuardian:
+		metadata.Guardian--
+	case types.RoleOperator:
+		metadata.Operator--
+	case types.RoleJudge:
+		metadata.Judge--
+	}
+
+	if role == types.RoleEmpty {
+		k.DeleteRole(ctx, addr)
+		return nil
+	} else {
+		k.SetRole(ctx, role, addr)
+	}
+
+	switch role {
+	case types.RoleGuardian:
+		metadata.Guardian++
+	case types.RoleOperator:
+		metadata.Operator++
+	case types.RoleJudge:
+		metadata.Judge++
+	}
+
+	k.SetRoleMetadata(ctx, metadata)
+
+	return nil
+}
+
 func (k Keeper) GetRoleMetadata(ctx sdk.Context) types.RoleMetadata {
 	store := ctx.KVStore(k.storeKey)
 

x/fbridge/keeper/genesis.go

@@ -19,11 +19,26 @@ func (k Keeper) InitGenesis(ctx sdk.Context, gs *types.GenesisState) error {
 		k.setVote(ctx, vote.ProposalId, sdk.MustAccAddressFromBech32(vote.Voter), vote.Option)
 	}
 
-	k.SetRoleMetadata(ctx, gs.RoleMetadata)
+	expectedRoleMeta := types.RoleMetadata{}
 	for _, pair := range gs.Roles {
 		k.SetRole(ctx, pair.Role, sdk.MustAccAddressFromBech32(pair.Address))
+		switch pair.Role {
+		case types.RoleGuardian:
+			expectedRoleMeta.Guardian++
+		case types.RoleOperator:
+			expectedRoleMeta.Operator++
+		case types.RoleJudge:
+			expectedRoleMeta.Judge++
+		}
 	}
 
+	if expectedRoleMeta.Guardian != gs.RoleMetadata.Guardian ||
+		expectedRoleMeta.Operator != gs.RoleMetadata.Operator ||
+		expectedRoleMeta.Judge != gs.RoleMetadata.Judge {
+		panic("role metadata does not match the number of roles")
+	}
+	k.SetRoleMetadata(ctx, gs.RoleMetadata)
+
 	// TODO: we initialize the appropriate genesis parameters whenever the feature is added
 
 	return nil