Create or integrate linter to check time.Now use

[robert-zaremba]

Summary

time.Now is not deterministic in the network and must not be used.

Problem Definition

Using time.Now in a context of protobuf Msg service causes consensus problems and must not be used.

Proposal

Create (or find) and integrate a linter to check that we don't use time.Now in all Go code which is related to the state transition. We can use time.Now, in:

• **/cli/**
• Query service (there can be a trap if Msg service will use Query service)
• *_test.go files
• telemetry

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[ValarDragon]

It should also exempt telemetry, and then we should move all time.Now() calls for telemetry into a method within telemetry. (A good idea separately, for #10245 ). e.g. doing telemetry.StartTimer() instead of time.Now() as one of the args.

[waggonerjake]

Just to be extra clear here, time.Now() calls can exist in the above mentioned places (i.e. **/cli/**, *_test.go and the Query Service)?

You say "DONT use time.Now() in all Go code which is NOT in ..." which sounds like do use them in those 3 pieces... would like some clarification.

[alexanderbez]

Yes, subjective time can be used anywhere except the state-machine, i.e. module business logic.

[robert-zaremba]

I rephrase the description to make it easier to read.

[tomtau]

This pattern should be captured in https://github.com/crypto-com/cosmos-sdk-codeql/blob/main/src/system-time.ql -- it will ignore CLI, tests and telemetry.
It doesn't ignore those in query services, because msg services may use query services -- the false positives could be then individually dismissed in GitHub UI: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/managing-code-scanning-alerts-for-your-repository#dismissing-or-deleting-alerts

This issue can be closed after #10488 is merged.

[robert-zaremba]

Thank you @tomtau
Closed by #10488