Description

The RefundPacketKey function does not include a prefix that disambiguates it from other possible store paths.

Impact

While there are currently no other slash-separated store paths in Packet Forward Middleware's Keeper than RefundPacketKey, if one is added in the future, values stored under RefundPacketKey may collide with it.

Recommendations

We suggest adding a prefix that disambiguates RefundPacketKey.

 func RefundPacketKey(channelID, portID string, sequence uint64) []byte {
-    return []byte(fmt.Sprintf("%s/%s/%d", channelID, portID, sequence))
+    return []byte(fmt.Sprintf("refund_packet/%s/%s/%d", channelID, portID, sequence))
 }

Remediation