ibc: add withdrawal timestamp rounding chain rule

crates/bin/pcli/src/command/tx.rs

@@ -1052,17 +1052,20 @@ impl TxCmd {
                 };
 
                 // get the current time on the local machine
-                let current_time_u64_ms = SystemTime::now()
+                let current_time_ns = SystemTime::now()
                     .duration_since(UNIX_EPOCH)
                     .expect("Time went backwards")
                     .as_nanos() as u64;
 
                 let mut timeout_timestamp = *timeout_timestamp;
                 if timeout_timestamp == 0u64 {
                     // add 2 days to current time
-                    timeout_timestamp = current_time_u64_ms + 1.728e14 as u64;
+                    timeout_timestamp = current_time_ns + 1.728e14 as u64;
                 }
 
+                // round to the nearest 10 minutes
+                timeout_timestamp += timeout_timestamp % 600_000_000_000;
+
                 fn parse_denom_and_amount(value_str: &str) -> anyhow::Result<(Amount, Metadata)> {
                     let denom_re = Regex::new(r"^([0-9.]+)(.+)$").context("denom regex invalid")?;
                     if let Some(captures) = denom_re.captures(value_str) {

crates/core/component/shielded-pool/src/ics20_withdrawal.rs

@@ -33,7 +33,7 @@ pub struct Ics20Withdrawal {
     // prevent relayer censorship attacks. The core IBC implementation does this
     // in its handling of validation of timeouts.
     pub timeout_height: IbcHeight,
-    // the timestamp at which this transfer expires.
+    // the timestamp at which this transfer expires, in nanoseconds after unix epoch.
     pub timeout_time: u64,
     // the source channel used for the withdrawal
     pub source_channel: ChannelId,
@@ -77,6 +77,15 @@ impl Ics20Withdrawal {
             anyhow::bail!("timeout time must be non-zero");
         }
 
+        // in order to prevent clients from inadvertantly identifying themselves by their clock
+        // skew, enforce that timeout time is rounded to the nearest minute
+        if self.timeout_time % 60_000_000_000 != 0 {
+            anyhow::bail!(
+                "withdrawal timeout timestamp {} is not rounded to one minute",
+                self.timeout_time
+            );
+        }
+
         // NOTE: we could validate the destination chain address as bech32 to prevent mistyped
         // addresses, but this would preclude sending to chains that don't use bech32 addresses.