security: Upgrade CometBFT to v0.37.18 and fix nil validator panic

[zmanian]

Summary

• Upgrades CometBFT from v0.37.15 to v0.37.18 which contains security patches
• Fixes potential panic when processing scheduled corks for validators that no longer exist (e.g., fully unbonded validators)

Changes

• go.mod/go.sum: Bump github.com/cometbft/cometbft v0.37.15 → v0.37.18
• x/cork/keeper/keeper.go: Add nil check for validator in GetApprovedScheduledCorks
• x/axelarcork/keeper/keeper.go: Add nil check for validator in GetApprovedScheduledAxelarCorks

Test plan

• go build ./cmd/... compiles successfully
• go test ./x/... ./app/... -short passes

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Enhanced handling of missing validators in scheduled transaction processing. The system now properly detects and manages cases where validators have been removed or unbonded by automatically cleaning up associated pending transactions and ensuring queue consistency and data integrity.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Two keeper methods (GetApprovedScheduledCorks and GetApprovedScheduledAxelarCorks) now include nil-checks during scheduled cork iteration. When a validator no longer exists, the scheduled cork is deleted, the validator's cork count is decremented, and iteration continues. This prevents processing invalid validator entries.

Changes

Cohort / File(s)	Summary
Validator existence checks in cork keeper methods x/axelarcork/keeper/keeper.go, x/cork/keeper/keeper.go	Added nil-check in GetApprovedScheduledCorks(Axelar) to handle deleted validators. When validator == nil, deletes the scheduled cork entry, decrements cork count, and skips further processing via continue statement. Ensures state consistency by pruning references to removed validators early.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly reflects the main changes: upgrading CometBFT for security and fixing nil validator panics, which aligns perfectly with the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}