Validate MerklePathPrefix and Path

modules/core/02-client/types/client.go

@@ -79,8 +79,8 @@ func (c Counterparty) Validate() error {
 		return err
 	}
 
-	if c.MerklePathPrefix.Empty() {
-		return errorsmod.Wrap(ErrInvalidCounterparty, "prefix cannot be empty")
+	if err := c.MerklePathPrefix.ValidateAsPrefix(); err != nil {
+		return errorsmod.Wrap(ErrInvalidCounterparty, err.Error())
 	}
 
 	return nil

modules/core/02-client/types/client_test.go

@@ -102,6 +102,24 @@ func TestValidateCounterparty(t *testing.T) {
 			commitmenttypes.NewMerklePath([]byte("ibc")),
 			nil,
 		},
+		{
+			"success with multiple element prefix",
+			ibctesting.FirstClientID,
+			commitmenttypes.NewMerklePath([]byte("ibc"), []byte("address")),
+			nil,
+		},
+		{
+			"success with multiple element prefix, last prefix empty",
+			ibctesting.FirstClientID,
+			commitmenttypes.NewMerklePath([]byte("ibc"), []byte("")),
+			nil,
+		},
+		{
+			"success with single empty key prefix",
+			ibctesting.FirstClientID,
+			commitmenttypes.NewMerklePath([]byte("")),
+			nil,
+		},
 		{
 			"failure: invalid client id",
 			"",
@@ -114,6 +132,12 @@ func TestValidateCounterparty(t *testing.T) {
 			commitmenttypes.NewMerklePath(),
 			types.ErrInvalidCounterparty,
 		},
+		{
+			"failure: empty key in merkle path prefix first element",
+			ibctesting.FirstClientID,
+			commitmenttypes.NewMerklePath([]byte(""), []byte("ibc")),
+			types.ErrInvalidCounterparty,
+		},
 	}
 
 	for _, tc := range testCases {

modules/core/23-commitment/types/v2/merkle.go

@@ -1,6 +1,7 @@
 package v2
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/cosmos/ibc-go/v9/modules/core/exported"
@@ -28,3 +29,36 @@ func (mp MerklePath) GetKey(i uint64) ([]byte, error) {
 func (mp MerklePath) Empty() bool {
 	return len(mp.KeyPath) == 0
 }
+
+// ValidateAsPrefix validates the MerklePath to ensure it is a valid prefix
+// Thus every element of the merkle path must be non-empty except for the last element
+// which may be empty. In this case, the ICS24 path will be appended to the last element
+// to form the full path.
+func (mp MerklePath) ValidateAsPrefix() error {
+	if mp.Empty() {
+		return errors.New("path cannot have length 0")
+	}
+
+	for i, key := range mp.KeyPath {
+		if len(key) == 0 && i != len(mp.KeyPath)-1 {
+			return fmt.Errorf("key at index %d cannot be empty", i)
+		}
+	}
+	return nil
+}
+
+// ValidateAsPath validates the MerklePath as a fully constructed path.
+// Here every element must be non-empty since the MerklePath is no longer
+// acting as a prefix but is instead the full path intended for verification.
+func (mp MerklePath) ValidateAsPath() error {
+	if mp.Empty() {
+		return errors.New("path cannot have length 0")
+	}
+
+	for i, key := range mp.KeyPath {
+		if len(key) == 0 {
+			return fmt.Errorf("key at index %d cannot be empty", i)
+		}
+	}
+	return nil
+}

modules/core/23-commitment/types/v2/merkle_test.go

@@ -0,0 +1,64 @@
+package v2
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMerklePathValidation(t *testing.T) {
+	cases := []struct {
+		name         string
+		path         MerklePath
+		expPrefixErr error
+		expPathErr   error
+	}{
+		{
+			"success: prefix and path",
+			NewMerklePath([]byte("key1"), []byte("key2")),
+			nil,
+			nil,
+		},
+		{
+			"prefix with empty last key",
+			NewMerklePath([]byte("key1"), []byte("")),
+			nil,
+			errors.New("key at index 1 cannot be empty"),
+		},
+		{
+			"prefix with single empty key",
+			NewMerklePath([]byte("")),
+			nil,
+			errors.New("key at index 0 cannot be empty"),
+		},
+		{
+			"failure: empty path",
+			NewMerklePath(),
+			errors.New("path cannot have length 0"),
+			errors.New("path cannot have length 0"),
+		},
+		{
+			"failure: prefix with empty first key",
+			NewMerklePath([]byte(""), []byte("key2")),
+			errors.New("key at index 0 cannot be empty"),
+			errors.New("key at index 0 cannot be empty"),
+		},
+	}
+
+	for _, tc := range cases {
+		err := tc.path.ValidateAsPrefix()
+		if tc.expPrefixErr == nil {
+			require.NoError(t, err, tc.name)
+		} else {
+			require.ErrorContains(t, err, tc.expPrefixErr.Error(), tc.name)
+		}
+
+		err = tc.path.ValidateAsPath()
+		if tc.expPathErr == nil {
+			require.NoError(t, err, tc.name)
+		} else {
+			require.ErrorContains(t, err, tc.expPathErr.Error(), tc.name)
+		}
+	}
+}