Unable to delegate multiple times on vesting account

[erikgrinaker]

Summary of Bug

I have a ContinuousVestingAccount on cosmoshub-4 with some vested ATOMs in it, as well as 1 free ATOM for fees. I wanted to delegate this to three validators in equal parts. After delegating to the first, all subsequent operations (delegations, claiming rewards, etc) return a panic via RPC:

panic message redacted to hide potentially sensitive system info: panic

After spinning up a full node and outputting the redacted panic I get this:

recovered: negative coin amount
stack:
goroutine 7529 [running]:
runtime/debug.Stack(0x18, 0x5647c40, 0xc00b539dc0)
	runtime/debug/stack.go:24 +0x9f
github.com/cosmos/cosmos-sdk/baseapp.newDefaultRecoveryMiddleware.func1(0x551ba00, 0x5bbc640, 0x0, 0xc00bd3c778)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/recovery.go:71 +0x26
github.com/cosmos/cosmos-sdk/baseapp.newRecoveryMiddleware.func1(0x551ba00, 0x5bbc640, 0x0, 0x0, 0xc000599200)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/recovery.go:39 +0x42
github.com/cosmos/cosmos-sdk/baseapp.processRecovery(0x551ba00, 0x5bbc640, 0xc000599200, 0x0, 0x0)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/recovery.go:28 +0x43
github.com/cosmos/cosmos-sdk/baseapp.processRecovery(0x551ba00, 0x5bbc640, 0xc00b539de0, 0x5c41240, 0xc00b0c4c40)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/recovery.go:33 +0x7e
github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).runTx.func1(0xc00bd4ef00, 0xc00bd4f3b0, 0xc000129a00, 0xc00bd50af8, 0xc00bd50af0, 0xc00bd50ae0)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/baseapp.go:583 +0x170
panic(0x551ba00, 0x5bbc640)
	runtime/panic.go:969 +0x1b9
github.com/cosmos/cosmos-sdk/x/auth/ante.SetUpContextDecorator.AnteHandle.func1(0x7e78e68, 0xc00b540fc0, 0xc00bd4dfa8, 0xc00bd4e1b8)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/setup.go:59 +0x236
panic(0x551ba00, 0x5bbc640)
	runtime/panic.go:969 +0x1b9
github.com/cosmos/cosmos-sdk/types.Coin.Sub(0xc00bd021aa, 0x5, 0xc00b539d80, 0xc008fcf9f4, 0x5, 0xc00b5397e0, 0x5c2b860, 0xc000126008, 0x5c41240)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/coin.go:112 +0xf1
github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseSendKeeper.SubtractCoins(0x5c418c0, 0xc000090b00, 0x5c0c4e0, 0xc000518f40, 0x5c439c0, 0xc0001446c0, 0x5c418c0, 0xc000090b00, 0x5c439c0, 0xc0001446c0, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/bank/keeper/send.go:189 +0x2d0
github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseSendKeeper.SendCoins(0x5c418c0, 0xc000090b00, 0x5c0c4e0, 0xc000518f40, 0x5c439c0, 0xc0001446c0, 0x5c418c0, 0xc000090b00, 0x5c439c0, 0xc0001446c0, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/bank/keeper/send.go:154 +0x55b
github.com/cosmos/cosmos-sdk/x/bank/keeper.BaseKeeper.SendCoinsFromAccountToModule(0x5c418c0, 0xc000090b00, 0x5c0c4e0, 0xc000518f40, 0x5c439c0, 0xc0001446c0, 0x5c418c0, 0xc000090b00, 0x5c439c0, 0xc0001446c0, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/bank/keeper/keeper.go:282 +0x193
github.com/cosmos/cosmos-sdk/x/auth/ante.DeductFees(0xfe044b8, 0xc00015ef20, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/fee.go:107 +0x138
github.com/cosmos/cosmos-sdk/x/auth/ante.DeductFeeDecorator.AnteHandle(0x5c2c620, 0xc000145710, 0xfe044b8, 0xc00015ef20, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/fee.go:92 +0x375
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.ValidateSigCountDecorator.AnteHandle(0x5c2c620, 0xc000145710, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/sigverify.go:352 +0x22f
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.SetPubKeyDecorator.AnteHandle(0x5c2c620, 0xc000145710, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/sigverify.go:93 +0x1a7
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.RejectFeeGranterDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/fee_grant.go:26 +0xef
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.ConsumeTxSizeGasDecorator.AnteHandle(0x5c2c620, 0xc000145710, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/basic.go:142 +0x20d
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.ValidateMemoDecorator.AnteHandle(0x5c2c620, 0xc000145710, 0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/basic.go:66 +0x2af
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.TxTimeoutHeightDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/basic.go:199 +0x14f
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.ValidateBasicDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/basic.go:34 +0x14f
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.MempoolFeeDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/fee.go:54 +0x188
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.RejectExtensionOptionsDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/ext.go:35 +0xef
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/x/auth/ante.SetUpContextDecorator.AnteHandle(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/x/auth/ante/setup.go:64 +0x4cf
github.com/cosmos/cosmos-sdk/types.ChainAnteDecorators.func1(0x5c2b860, 0xc000126008, 0x5c41240, 0xc00b541000, 0xb, 0x0, 0xc009034920, 0xb, 0x527955, 0x2a7b2b61, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/types/handler.go:40 +0x12c
github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).runTx(0xc000129a00, 0xc00b538d00, 0xc008bdec60, 0x151, 0x153, 0x0, 0x0, 0x0, 0x0, 0x0)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/baseapp.go:632 +0x8ab
github.com/cosmos/cosmos-sdk/baseapp.(*BaseApp).CheckTx(0xc000129a00, 0xc008bdec60, 0x151, 0x153, 0xc000000000, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
	github.com/cosmos/cosmos-sdk@v0.41.3/baseapp/abci.go:229 +0x1ac
github.com/tendermint/tendermint/abci/client.(*localClient).CheckTxAsync(0xc000e534a0, 0xc008bdec60, 0x151, 0x153, 0xc000000000, 0x0)
	github.com/tendermint/tendermint@v0.34.7/abci/client/local_client.go:98 +0xdc

I suspect it doesn't take the already-delegated amount into consideration, such that the code sees the full vested amount as locked, tries to subtract that from my balance (which is now 2/3 of the vested amount), and panics because the remainder is negative.

This may be related to #8601.

Version

Gaia 4.0.4

$ ./build/gaiad version
HEAD-b876ea4366a055e40c252ea5d441e2bea5fb3fa0

Steps to Reproduce

1. Create a ContinuousVestingAccount with 300 vested ATOM (not sure how this is done), and send 1 free ATOM for fees.

2. Delegate 100 ATOM to validator A:

gaiad tx staking delegate --from me --chain-id cosmoshub-4 --fees 6000uatom <validatorA> 100000000uatom

3. Try to delegate 100 ATOM to validator B:

gaiad tx staking delegate --from me --chain-id cosmoshub-4 --fees 6000uatom <validatorB> 100000000uatom

4. Observe panic message redacted to hide potentially sensitive system info: panic

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[alexanderbez]

Kudos for being a good steward of decentralization on the hub by supporting multiple validators!

I'm curious of this is a regression or a bug in creating of new vesting accounts on a live chain? IIRC, delegating to multiple validators wasn't an issue with the genesis vesting accounts on hub-1.

[erikgrinaker]

No idea, didn't use vesting accounts on previous versions.

Note that it's not so much a problem with delegating to multiple validators, as it is a bug in fee payments when a vesting account has a delegation. If I understand this correctly, any vesting account that has delegated a larger amount of ATOM than the amount of free (non-locked/vested) ATOMs will be unable to pay fees for any transaction, including sending ATOMs and claiming rewards.

In the example above, with 100 out of 300 vested ATOMs delegated, all fee payments will panic until I transfer 100 additional "free" (unvested) ATOMs into the account such that the amount of free ATOMs is greater than the amount of delegated ATOMs.

[aaronc]

Hmm... this seems concerning, adding it to the backlog.

[alessio]

Removing from the v0.42.0 as this is not a PR and it's a bit late to include a fix in v0.42.0 anyways. But it'd be great to see a patch coming through 🙏

[AdityaSripal]

Agreed with @alexanderbez that this is a regression. I was able to stake to multiple validators with my previous account.

[AdityaSripal]

Note that it's not so much a problem with delegating to multiple validators, as it is a bug in fee payments when a vesting account has a delegation. If I understand this correctly, any vesting account that has delegated a larger amount of ATOM than the amount of free (non-locked/vested) ATOMs will be unable to pay fees for any transaction, including sending ATOMs and claiming rewards.

In the example above, with 100 out of 300 vested ATOMs delegated, all fee payments will panic until I transfer 100 additional "free" (unvested) ATOMs into the account such that the amount of free ATOMs is greater than the amount of delegated ATOMs.

This is certainly not how it used to be, nor how the vesting account was originally designed. The vesting account was designed to first delegate its vesting atoms before trying to delegate any free atoms.

So in the case where you have 400 vesting atoms and 100 free atoms, and you choose to delegate 300 atoms. You will have 300 vesting delegated atoms, 100 vesting undelegated atoms, and 100 free atoms. If you choose to vest 450 atoms, you will still have 50 free atoms left.

I would look to see if that logic has changed at all.

[erikgrinaker]

Yeah, when I skimmed the code over the weekend it seemed like it calculated the available amount to use for fees like:

available = balance - locked

However, locked did not take into account the delegated amount (possibly due to #8601), so in my previous example it would use locked=300 (the total vested amount), but balance=200 (the undelegated amount remaining in the account). So 200-300=-100 → panic.

[boz]

Note that it's not so much a problem with delegating to multiple validators, as it is a bug in fee payments when a vesting account has a delegation. If I understand this correctly, any vesting account that has delegated a larger amount of ATOM than the amount of free (non-locked/vested) ATOMs will be unable to pay fees for any transaction, including sending ATOMs and claiming rewards.

On a v0.41.4-based chain I am able to claim rewards from a periodic vesting account whose balance is almost entirely vesting/locked tokens.