fix: Check for sender in internal calls

contracts/hub/router/src/execute.rs

@@ -408,7 +408,7 @@ pub fn execute_release_escrow(
 
     ensure!(
         transfer_amount.checked_add(remaining_withdraw_amount)? == amount,
-        ContractError::new("Amount mismatch after trasnfer calculations")
+        ContractError::new("Amount mismatch after transfer calculations")
     );
 
     if !transfer_amount.is_zero() {

contracts/hub/router/src/ibc/receive.rs

@@ -74,6 +74,10 @@ pub fn ibc_receive_internal_call(
     info: MessageInfo,
     msg: IbcPacketReceiveMsg,
 ) -> Result<Response, ContractError> {
+    ensure!(
+        info.sender == env.contract.address,
+        ContractError::Unauthorized {}
+    );
     // Get the chain data from current channel received
     let channel = msg.packet.dest.channel_id;
     let chain_uid = CHANNEL_TO_CHAIN_UID.load(deps.storage, channel)?;

contracts/liquidity/factory/src/contract.rs

@@ -225,7 +225,7 @@ pub fn execute(
             ibc::ack_and_timeout::ibc_ack_packet_internal_call(deps, info, env, ack)
         }
         ExecuteMsg::IbcCallbackReceive { receive_msg } => {
-            ibc::receive::ibc_receive_internal_call(deps, env, receive_msg)
+            ibc::receive::ibc_receive_internal_call(deps, env, info, receive_msg)
         }
         ExecuteMsg::NativeReceiveCallback { msg } => {
             execute_native_receive_callback(deps, env, info, msg)

contracts/liquidity/factory/src/ibc/receive.rs

@@ -2,7 +2,7 @@
 use cosmwasm_std::entry_point;
 use cosmwasm_std::{
     ensure, from_json, to_json_binary, CosmosMsg, DepsMut, Env, IbcPacketReceiveMsg,
-    IbcReceiveResponse, Response, StdError, SubMsg, Uint128, WasmMsg,
+    IbcReceiveResponse, MessageInfo, Response, StdError, SubMsg, Uint128, WasmMsg,
 };
 use euclid::{
     chain::{ChainUid, CrossChainUserWithLimit},
@@ -54,8 +54,14 @@ pub fn ibc_packet_receive(
 pub fn ibc_receive_internal_call(
     deps: DepsMut,
     env: Env,
+    info: MessageInfo,
     msg: IbcPacketReceiveMsg,
 ) -> Result<Response, ContractError> {
+    ensure!(
+        info.sender == env.contract.address,
+        ContractError::Unauthorized {}
+    );
+
     let router = msg.packet.src.port_id.replace("wasm.", "");
     let state = STATE.load(deps.storage)?;
     ensure!(