Audit Fixes 3: Concurrent admin_execute calls may lead to unexpected behavior

framework/contracts/account/src/error.rs

@@ -106,6 +106,9 @@ pub enum AccountError {
     #[error("The caller ({caller}) is not the owner account's account ({account}). Only account can create sub-accounts for itself.", )]
     SubAccountCreatorNotAccount { caller: String, account: String },
 
+    #[error("You can't chain admin calls")]
+    CantChainAdminCalls {},
+
     #[error("Abstract Account Address don't match to the Contract address")]
     AbsAccInvalidAddr {
         abstract_account: String,

framework/contracts/account/src/execution.rs

@@ -92,6 +92,9 @@
 ) -> AccountResult {
     ownership::assert_nested_owner(deps.storage, &deps.querier, &info.sender)?;
 
+    if CALLING_TO_AS_ADMIN.exists(deps.storage) {
+        return Err(AccountError::CantChainAdminCalls {});
+    }
     CALLING_TO_AS_ADMIN.save(deps.storage, &addr)?;
 
     let msg = SubMsg::reply_on_success(