add chain rule: enforce nearest-even-second timestamps for withdrawals

crates/bin/pcli/src/command/tx.rs

@@ -1051,24 +1051,21 @@ impl TxCmd {
                     }
                 };
 
-                // get the current time on the local machine (rounded to the nearest even second)
-                let mut current_time_s = SystemTime::now()
+                // get the current time on the local machine
+                let current_time_ns = SystemTime::now()
                     .duration_since(UNIX_EPOCH)
                     .expect("Time went backwards")
-                    .as_secs() as u64;
-
-                if current_time_s % 2 != 0 {
-                    current_time_s += 1
-                }
-
-                let current_time_ns = current_time_s * 1_000_000_000;
+                    .as_nanos() as u64;
 
                 let mut timeout_timestamp = *timeout_timestamp;
                 if timeout_timestamp == 0u64 {
                     // add 2 days to current time
                     timeout_timestamp = current_time_ns + 1.728e14 as u64;
                 }
 
+                // round to the nearest even second
+                timeout_timestamp += timeout_timestamp % 2_000_000_000;
+
                 fn parse_denom_and_amount(value_str: &str) -> anyhow::Result<(Amount, Metadata)> {
                     let denom_re = Regex::new(r"^([0-9.]+)(.+)$").context("denom regex invalid")?;
                     if let Some(captures) = denom_re.captures(value_str) {

crates/core/component/shielded-pool/src/ics20_withdrawal.rs

@@ -33,7 +33,7 @@ pub struct Ics20Withdrawal {
     // prevent relayer censorship attacks. The core IBC implementation does this
     // in its handling of validation of timeouts.
     pub timeout_height: IbcHeight,
-    // the timestamp at which this transfer expires.
+    // the timestamp at which this transfer expires, in nanoseconds after unix epoch.
     pub timeout_time: u64,
     // the source channel used for the withdrawal
     pub source_channel: ChannelId,
@@ -77,6 +77,15 @@ impl Ics20Withdrawal {
             anyhow::bail!("timeout time must be non-zero");
         }
 
+        // in order to prevent clients from inadvertantly identifying themselves by their clock
+        // skew, enforce that timeout time is rounded to the nearest even second
+        if self.timeout_time % 2_000_000_000 != 0 {
+            anyhow::bail!(
+                "withdrawal timeout timestamp {} is not an even number of seconds",
+                self.timeout_time
+            );
+        }
+
         // NOTE: we could validate the destination chain address as bech32 to prevent mistyped
         // addresses, but this would preclude sending to chains that don't use bech32 addresses.