Keys are declared as var and exposed

[mossid]

https://github.com/cosmos/cosmos-sdk/blob/develop/x/stake/keeper_keys.go#L15

Other code can modify this values to cause unexpected behavior

[cwgoes]

cc @rigelrozanski

[rigelrozanski]

Yeah need to be constants and modified to a different type

[ValarDragon]

Closes by #1119

[ValarDragon]

My bad, I misread what this issue was for. Relevant keys have been moved to /x/stake/stake.go

[jackzampolin]

Pretty sure this has been addressed. Going to close this issue. Please reopen and send any 🔥 -> @jackzampolin

[ValarDragon]

This is not addressed. https://github.com/cosmos/cosmos-sdk/blob/develop/x/stake/keeper/key.go#L15

[jackzampolin]

Pretty sure this has been addressed. Going to go ahead and close. Please reopen if I'm wrong.

[cwgoes]

It has not been addressed, e.g. https://github.com/cosmos/cosmos-sdk/blob/master/x/staking/types/key.go#L13

[jackzampolin]

We should expose some of these for querying from the store.

[cwgoes]

(I'm not sure if this is a serious security concern, but the original state of affairs has not changed)

[alexanderbez]

Indeed, string constants should remain exported (eg. for use in queriers). Any keys used for persistent in stores should be constants and private if possible.

[jackzampolin]

Closing this issue as addressed.