fix(router): adds caller verification when the swap callback

[jinoosss]

Descriptions

This PR adds caller verification to the SwapCallback function in the router v1 contract to enhance security and prevent unauthorized callback invocations.

Problem

The SwapCallback function, which handles token transfers during pool swaps, did not verify that it was being called from the authorized router v1 contract. This could potentially allow malicious actors to invoke the callback directly and manipulate the swap flow.

Solution

Added caller verification to ensure that only the router v1 contract can invoke the swap callback:

1. New Assertion Function: Added assertIsRouterV1() in assert.gno to verify the caller's address matches the router v1 contract address
2. Router V1 Address Constant: Added routerV1Addr constant in consts.gno to store the router v1 package address
3. Caller Verification in SwapCallback:
   • Added halt state check using halt.AssertIsNotHaltedRouter()
   • Retrieve the previous realm's address using runtime.PreviousRealm().Address()
   • Verify the caller is router v1 before proceeding with the callback logic

[notJoon]

although I left a comment, but the changes seems good.

[dongwon8247]

can you also confirm PreviousRealm(Address) == routerV1Addr?

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud