x/gamm: Add check to ensure JoinPoolNoSwap cannot be called with arbitrary denoms

[AlpinYukseloglu]

Background

Our current implementation of JoinPoolNoSwap only checks for whether the input set of tokens includes the tokens in the pool, but does not have any check that prevents someone from putting in an arbitrary number of arbitrary tokens. Since this is a no-swap/all-asset join, there are no other immediate checks so an invalid input can make it directly to the state-changing JoinPool function.

osmosis/x/gamm/keeper/pool_service.go

Line 180 in add306e

func (k Keeper) JoinPoolNoSwap(

An example of how this could potentially be exploited for the OSMO/USDC pool (1 OSMO = 1 USDC):

1. Create arbitrary spam/poisoned token FOO
2. Create a JoinPoolNoSwap tx and send in a set of [1 OSMO, 1 USDC, 1 FOO] as your input
3. The following check doesn't catch the existence of FOO, since we only check if the input includes 1 OSMO and 1 USDC:
   

   osmosis/x/gamm/keeper/pool_service.go

   Line 203 in add306e

   if !(neededLpLiquidity.DenomsSubsetOf(tokenInMaxs) && tokenInMaxs.IsAllGTE(neededLpLiquidity)) {

Suggested Design

• Add && tokenInMaxs.DenomSubsetOf(neededLpLiquidity) to x/gamm/keeper/pool_service.go/L203 so that input tokens for a no-swap pool join don’t include denoms that aren’t in the pool:
  

  osmosis/x/gamm/keeper/pool_service.go

  Line 203 in add306e

  if !(neededLpLiquidity.DenomsSubsetOf(tokenInMaxs) && tokenInMaxs.IsAllGTE(neededLpLiquidity)) {

Acceptance Criteria

• All existing and new tests pass