Summary of Bug

When going through the authorization logic of the staking module (staking/types/authz.go, function Accept), I was confused by the parameters allowed and denied of the function NewStakeAuthorization.
Quoting from the documentation:

Additionally, this Msg takes an AllowList and a DenyList, which allows you to select which validators you allow grantees to stake with.

However, it seems that it is never possible to have a non-empty DenyList with a successful authorization.

1. exactly one of allowList and denyList may be given, not both (this follows from the function validateAndBech32fy)
2. delegation will be accepted if the validator is both in the allowList and not in the denyList (this follows from the function Accept of authz.go: the boolean value isValidatorExists has to be set to true, or otherwise an error is raised)

Thus, if the authorization is to ever be successfully used, denyList must always be empty.

Is this intended behavior? If so, why not removing denyList?

Version

e0f812d

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned