Merge pull request from GHSA-3v7p-4x7p-4rx7

Co-authored-by: Carlos Rodriguez <[email protected]>

go.mod

@@ -4,6 +4,13 @@ module github.com/cosmos/ibc-go/v4
 
 retract [v4.0.0, v4.1.0] // depends on SDK version without dragonberry fix
 
+retract (
+	[v4.0.0, v4.1.0] // depends on SDK version without dragonberry fix
+	v4.1.1 // contains huckleberry vulnerability
+	v4.2.0 // contains huckleberry vulnerability
+	v4.3.0 // contains huckleberry vulnerability
+)
+
 require (
 	github.com/Finschia/finschia-sdk v0.47.1-0.20230725074611-f8840edecbaa
 	github.com/Finschia/ostracon v1.1.0

modules/core/keeper/msg_server.go

@@ -411,12 +411,11 @@ func (k Keeper) RecvPacket(goCtx context.Context, msg *channeltypes.MsgRecvPacke
 	// Cache context so that we may discard state changes from callback if the acknowledgement is unsuccessful.
 	cacheCtx, writeFn = ctx.CacheContext()
 	ack := cbs.OnRecvPacket(cacheCtx, msg.Packet, relayer)
-	// NOTE: The context returned by CacheContext() refers to a new EventManager, so it needs to explicitly set events to the original context.
-	// Events from callback are emitted regardless of acknowledgement success
-	ctx.EventManager().EmitEvents(cacheCtx.EventManager().Events())
 	if ack == nil || ack.Success() {
 		// write application state changes for asynchronous and successful acknowledgements
 		writeFn()
+		// NOTE: The context returned by CacheContext() refers to a new EventManager, so it needs to explicitly set events to the original context.
+		ctx.EventManager().EmitEvents(cacheCtx.EventManager().Events())
 	}
 
 	// Set packet acknowledgement only if the acknowledgement is not nil.