x/ibcbreaker provides an operator-controlled IBC breaker with one global ibc_available flag, a whitelist of operator accounts that can toggle the flag, and governance-controlled whitelist updates. The practical goal is to stop selected outbound IBC initiation paths, including ICS20 transfer initiation (MsgTransfer), when the breaker is disabled.

​
Non-scope

x/ibcbreaker is not a full transfer freeze. Internal non-IBC transfers, for example bank MsgSend, remain available.

​
State and params

{
  "ibcbreaker": {
    "params": {
      "whitelist": []
    },
    "state": {
      "ibc_available": true
    }
  }
}
  • state.ibc_available is stored as a single byte and defaults to true if missing.
  • params.whitelist is a list of bech32 addresses allowed to submit MsgUpdateIbcBreaker.
  • Whitelist entries are validated for address format and duplicates.

​
Authorization model

  • MsgUpdateIbcBreaker signer must be bech32 and present in params.whitelist.
  • Repeated requests for the current ibc_available value succeed as a no-op.
  • MsgUpdateParams is authority-only and is the only path to update the whitelist.
  • MsgUpdateParams.ValidateBasic() rejects nil params before handler execution.

​
Enforcement logic

Enforcement is implemented in the Cosmos ante decorator IbcAvailableDecorator and in transfer keeper execution for MsgTransfer. When ibc_available=false:
  • Cosmos ante scans transaction messages and rejects restricted IBC message types with ErrUnauthorized.
  • Ante errors include the offending restricted message type URL.
  • authz.MsgExec contents are recursively scanned.
  • Recursion depth >= 7 is rejected as unauthorized.
  • Transfer keeper rejects MsgTransfer with ErrUnauthorized and ibc unavailable.
Restricted message types include:
  • /ibc.core.client.v1.MsgCreateClient
  • /ibc.core.connection.v1.MsgConnectionOpenInit
  • /ibc.core.channel.v1.MsgChannelOpenInit
  • /ibc.applications.transfer.v1.MsgTransfer
  • /ibc.applications.interchain_accounts.controller.v1.MsgRegisterInterchainAccount
  • /ibc.applications.interchain_accounts.controller.v1.MsgSendTx
  • /ibc.core.client.v2.MsgRegisterCounterparty
  • /ibc.core.client.v2.MsgUpdateClientConfig
  • /ibc.core.channel.v2.MsgSendPacket

​
EVM and ICS20 scope

Cosmos IBC ante decoration is not applied to the EVM extension transaction route. However, ICS20 precompile transfer still routes into the transfer keeper, so MsgTransfer is blocked when ibc_available=false. Non-restricted IBC messages can still pass this decorator.

​
Exposed methods

ctmd query ibcbreaker ibc-available
ctmd query ibcbreaker whitelist
ctmd tx ibcbreaker update-ibcbreaker <true|false>
Cosmos SDK messages:
  • MsgUpdateIbcBreaker(signer, ibc_available)
  • MsgUpdateParams(authority, params)
Queries:
  • Query/IbcAvailable
  • Query/Whitelist