Review untrusted wasm code validation

[grarco]

The Tx struct supports including the transaction code either as the hash of the code to execute (to be retrieved from storage or from cache if already compiled) or as the entire code. This is to support the execution of governance proposal that cannot be limited to the set of allowlisted transactions and need to provide custom wasm codes.

In the fetch_or_compile function, if the transaction specifies the code itself instead of its hash, we validate the code to look for unwanted wasm features and we charge the gas for this operation:

namada/crates/vm/src/wasm/run.rs

Lines 760 to 769 in ee5140a

	Commitment::Id(code) => {
	let tx_len = code.len() as u64;
	gas_meter
	.borrow_mut()
	.add_wasm_validation_gas(tx_len)
	.map_err(|e| Error::GasError(e.to_string()))?;
	// Validation is only needed for governance proposals. The other
	// transactions are subject to the allowlist and are guaranteed to
	// not contain invalid opcodes.
	validate_untrusted_wasm(code).map_err(Error::ValidationError)?;

The validation though, is only required for governance proposals, cause normal transactions are still subject to the allowlist: allowlisted transactions are already validated (programmatically at genesis or manually for governance transactions, even though in this case it would be better to implement the suggestion of #3061) and we don't need to run this validation again.

If we could pass a flag to fetch_or_compile to specify if the transaction about to be executed is a governance proposal or not we could conditionally validate the wasm code (and charge the relative gas).

A better approach could be to just reject in mempool and process proposal all the transactions that carry the wasm code instead of its commitment: there's no real reason why someone should prefer the former over the latter (given also the higher gas cost), and the bigger size of these transactions is a burden on validators/full nodes. If we did this we could keep the snippet above as it is and just remove the call to the gas meter (for both validation and compilation) since this branch could now be taken only by governance proposal which are not subject to gas fees.