From 6b8613b3e77de0711a4f646a55ef795e571e7d69 Mon Sep 17 00:00:00 2001
From: Ethan Buchman <ethan@coinculture.info>
Date: Wed, 6 Jun 2018 16:12:14 -0700
Subject: [PATCH] ResponseEndBlock: ensure Address matches PubKey if provided

---
 state/execution.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/state/execution.go b/state/execution.go
index 435b29ee6..ec37e0d13 100644
--- a/state/execution.go
+++ b/state/execution.go
@@ -1,6 +1,7 @@
 package state
 
 import (
+	"bytes"
 	"fmt"
 
 	fail "github.com/ebuchman/fail-test"
@@ -278,6 +279,16 @@ func updateValidators(currentSet *types.ValidatorSet, updates []abci.Validator)
 		}
 
 		address := pubkey.Address()
+
+		// If the app provided an address too, it must match.
+		// This is just a sanity check.
+		if len(v.Address) > 0 {
+			if !bytes.Equal(address, v.Address) {
+				return fmt.Errorf("Validator.Address (%X) does not match PubKey.Address (%X)",
+					v.Address, address)
+			}
+		}
+
 		power := int64(v.Power)
 		// mind the overflow from int64
 		if power < 0 {