wormchain: tokenbridge: Reject transfers with negative fee

wormhole_chain/x/tokenbridge/keeper/msg_server_execute_vaa.go

@@ -118,6 +118,9 @@ func (k msgServer) ExecuteVAA(goCtx context.Context, msg *types.MsgExecuteVAA) (
 		if err != nil {
 			return nil, err
 		}
+		if fee.Sign() == -1 {
+			return nil, types.ErrNegativeFee
+		}
 
 		if wrapped {
 			err = k.bankKeeper.MintCoins(ctx, types.ModuleName, sdk.Coins{

wormhole_chain/x/tokenbridge/types/errors.go

@@ -37,4 +37,5 @@ var (
 	ErrFeeTooHigh                     = sdkerrors.Register(ModuleName, 1132, "fee must be < amount")
 	ErrAmountTooHigh                  = sdkerrors.Register(ModuleName, 1133, "the amount would exceed the bridges capacity of u64")
 	ErrAssetMetaRollback              = sdkerrors.Register(ModuleName, 1134, "asset meta must have a higher sequence than the last update")
+	ErrNegativeFee                    = sdkerrors.Register(ModuleName, 1135, "fee cannot be negative")
 )