fix(tokenfactory): add pagination to DenomsFromCreator query (PLT-410)

[amir-deris]

Summary

• DenomsFromCreator performed an unbounded full prefix scan with no limit, making it unsafe.
• Added pagination field to QueryDenomsFromCreatorRequest and QueryDenomsFromCreatorResponse, routing the handler through query.Paginate which enforces the MaxLimit/MaxOffset bounds being added in PLT-361 (fix(sei-cosmos): harden paginated RPC queries against DoS via limit, offset, and count_total caps (PLT-361) #3494)
• Updated the REST gateway, CLI, and wasm test accordingly

Changes

• proto/tokenfactory/query.proto — added PageRequest/PageResponse pagination fields to DenomsFromCreator request and response
• x/tokenfactory/types/query.pb.go — regenerated via scripts/protoc.sh
• x/tokenfactory/types/query.pb.gw.go — regenerated; REST gateway now reads ?pagination.* query parameters
• x/tokenfactory/keeper/creators.go — replaced raw unbounded iterator with query.Paginate
• x/tokenfactory/keeper/grpc_query.go — threads pagination through the handler
• x/tokenfactory/client/cli/query.go — exposes --page-* flags on the denoms-from-creator command
• x/tokenfactory/keeper/grpc_query_test.go — added pagination tests (no pagination, limit, key-based cursor, offset)
• wasmbinding/test/query_test.go — fixed assertions to compare only Denoms field since Pagination is now always non-nil in the response

Notes

• Pagination is optional and backward-compatible — callers that omit it get DefaultLimit = 100 results
• Hard limits (MaxLimit = 1000, MaxOffset = 10000) are enforced by query.Paginate once PLT-361 lands; this PR depends on that for the cap to be in effect

🤖 Generated with Claude Code

[cursor]

PR Summary

Low Risk
Read-only query API extension using standard Cosmos pagination; behavior without pagination params should still return full lists, with additive response fields for clients.

Overview
Adds Cosmos SDK pagination to the tokenfactory DenomsFromCreator query so clients can page through a creator’s denoms instead of loading the full list in one response.

The query request/response proto now includes standard PageRequest / PageResponse fields; the keeper replaces a full-store scan with query.Paginate, and the gRPC handler returns pagination alongside denoms. The denoms-from-creator CLI reads pagination flags, and the REST gateway binds query-string pagination params on the existing HTTP route. New keeper tests cover default (all results), limit/key paging, and offset paging; wasm binding tests were adjusted for the response shape.

Also fixes a proto comment typo (QueryDenomsFromCreatorResponse).

^{Reviewed by Cursor Bugbot for commit 7a6849e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	May 29, 2026, 10:53 PM

[codecov]

Codecov Report

❌ Patch coverage is 47.36842% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.30%. Comparing base (3d3df7e) to head (7a6849e).

Files with missing lines	Patch %	Lines
x/tokenfactory/client/cli/query.go	0.00%	6 Missing ⚠️
x/tokenfactory/keeper/creators.go	77.77%	1 Missing and 1 partial ⚠️
x/tokenfactory/keeper/grpc_query.go	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3524      +/-   ##
==========================================
- Coverage   59.15%   58.30%   -0.85%     
==========================================
  Files        2213     2140      -73     
  Lines      182710   174350    -8360     
==========================================
- Hits       108077   101650    -6427     
+ Misses      64930    63674    -1256     
+ Partials     9703     9026     -677     

Flag	Coverage Δ
sei-chain-pr	65.04% <47.36%> (?)
sei-db	70.41% <ø> (-0.22%)	⬇️
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
x/tokenfactory/keeper/creators.go	86.66% <77.77%> (-13.34%)	⬇️
x/tokenfactory/keeper/grpc_query.go	84.21% <50.00%> (-4.68%)	⬇️
x/tokenfactory/client/cli/query.go	0.00% <0.00%> (ø)

... and 74 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7a6849e. Configure here.}

[cursor]

Default pagination silently truncates results to 100

Medium Severity

Previously getDenomsFromCreator iterated all entries and returned every denom. Now it delegates to query.Paginate, which applies DefaultLimit = 100 when no PageRequest is supplied. Existing callers that pass nil pagination — notably the wasm binding via GetDenomsFromCreator — will silently receive at most 100 denoms instead of all. Any creator with more than 100 denoms gets truncated results without the caller knowing, which is a breaking behavior change for the wasm query path where smart contracts may rely on a complete list.

Additional Locations (1)

• x/tokenfactory/keeper/grpc_query.go#L32-L39

 

^{Reviewed by Cursor Bugbot for commit 7a6849e. Configure here.}