--- a/runtime/common/config/xcm.rs
+++ b/runtime/common/config/xcm.rs
@@ -34,6 +34,7 @@
 	AssetId::{Concrete},
 	Fungibility::Fungible as XcmFungible,
 	MultiAsset, Error as XcmError,
+	Instruction, Xcm,
 };
 use xcm_builder::{
 	AccountId32Aliases, AllowTopLevelPaidExecutionFrom, CurrencyAdapter, EnsureXcmOrigin,
@@ -45,6 +46,7 @@
 use xcm_executor::{Config, XcmExecutor, Assets};
 use xcm_executor::traits::{
 	Convert as ConvertXcm, JustTry, MatchesFungible, WeightTrader, FilterAssetLocation,
+	ShouldExecute,
 };
 use pallet_foreing_assets::{
 	AssetIds, AssetIdMapping, XcmForeignAssetIdMapping, CurrencyId, NativeCurrency, FreeForAll,
@@ -171,13 +173,53 @@
 	};
 }
 
-/*
-pub type Barrier = (
-	TakeWeightCredit,
-	AllowTopLevelPaidExecutionFrom<Everything>,
-	// ^^^ Parent & its unit plurality gets free execution
-);
- */
+pub struct DenyTransact;
+impl ShouldExecute for DenyTransact {
+	fn should_execute<Call>(
+		_origin: &MultiLocation,
+		message: &mut Xcm<Call>,
+		_max_weight: Weight,
+		_weight_credit: &mut Weight,
+	) -> Result<(), ()> {
+		let transact_inst = message.0.iter()
+			.find(|inst| matches![inst, Instruction::Transact { .. }]);
+
+		match transact_inst {
+			Some(_) => {
+				log::warn!(
+					target: "xcm::barrier",
+					"transact XCM rejected"
+				);
+
+				Err(())
+			},
+			None => Ok(())
+		}
+	}
+}
+
+/// Deny executing the XCM if it matches any of the Deny filter regardless of anything else.
+/// If it passes the Deny, and matches one of the Allow cases then it is let through.
+pub struct DenyThenTry<Deny, Allow>(PhantomData<Deny>, PhantomData<Allow>)
+    where
+        Deny: ShouldExecute,
+        Allow: ShouldExecute;
+
+impl<Deny, Allow> ShouldExecute for DenyThenTry<Deny, Allow>
+    where
+        Deny: ShouldExecute,
+        Allow: ShouldExecute,
+{
+    fn should_execute<Call>(
+        origin: &MultiLocation,
+        message: &mut Xcm<Call>,
+        max_weight: Weight,
+        weight_credit: &mut Weight,
+    ) -> Result<(), ()> {
+        Deny::should_execute(origin, message, max_weight, weight_credit)?;
+        Allow::should_execute(origin, message, max_weight, weight_credit)
+    }
+}
 
 pub struct UsingOnlySelfCurrencyComponents<
 	WeightToFee: WeightToFeePolynomial<Balance = Currency::Balance>,
--- a/runtime/opal/src/xcm_config.rs
+++ b/runtime/opal/src/xcm_config.rs
@@ -301,13 +301,16 @@
 	}
 }
 
-pub type Barrier = (
-	TakeWeightCredit,
-	AllowTopLevelPaidExecutionFrom<Everything>,
-	AllowUnpaidExecutionFrom<ParentOrParentsUnitPlurality>,
-	// ^^^ Parent & its unit plurality gets free execution
-	AllowAllDebug,
-);
+pub type Barrier = DenyThenTry<
+	DenyTransact,
+	(
+		TakeWeightCredit,
+		AllowTopLevelPaidExecutionFrom<Everything>,
+		AllowUnpaidExecutionFrom<ParentOrParentsUnitPlurality>,
+		// ^^^ Parent & its unit plurality gets free execution
+		AllowAllDebug,
+	)
+>;
 
 pub struct AllAsset;
 impl FilterAssetLocation for AllAsset {
--- a/runtime/quartz/src/xcm_config.rs
+++ b/runtime/quartz/src/xcm_config.rs
@@ -76,29 +76,6 @@
 	};
 }
 
-/// Deny executing the XCM if it matches any of the Deny filter regardless of anything else.
-/// If it passes the Deny, and matches one of the Allow cases then it is let through.
-pub struct DenyThenTry<Deny, Allow>(PhantomData<Deny>, PhantomData<Allow>)
-    where
-        Deny: ShouldExecute,
-        Allow: ShouldExecute;
-
-impl<Deny, Allow> ShouldExecute for DenyThenTry<Deny, Allow>
-    where
-        Deny: ShouldExecute,
-        Allow: ShouldExecute,
-{
-    fn should_execute<Call>(
-        origin: &MultiLocation,
-        message: &mut Xcm<Call>,
-        max_weight: Weight,
-        weight_credit: &mut Weight,
-    ) -> Result<(), ()> {
-        Deny::should_execute(origin, message, max_weight, weight_credit)?;
-        Allow::should_execute(origin, message, max_weight, weight_credit)
-    }
-}
-
 pub fn get_allowed_locations() -> Vec<MultiLocation> {
     vec![
         // Self location
@@ -151,6 +128,7 @@
 pub type Barrier = DenyThenTry<
     DenyExchangeWithUnknownLocation,
     (
+        DenyTransact,
         TakeWeightCredit,
         AllowTopLevelPaidExecutionFrom<Everything>,
         // Parent and its exec plurality get free execution
--- a/runtime/unique/src/xcm_config.rs
+++ b/runtime/unique/src/xcm_config.rs
@@ -69,6 +69,7 @@
 pub type Barrier = DenyThenTry<
     DenyExchangeWithUnknownLocation,
     (
+        DenyTransact,
         TakeWeightCredit,
         AllowTopLevelPaidExecutionFrom<Everything>,
         // Parent and its exec plurality get free execution
@@ -93,27 +94,6 @@
         // Self parachain address
         MultiLocation { parents: 1, interior: X1(Parachain(ParachainInfo::get().into())) },
     ]
-}
-
-pub struct DenyThenTry<Deny, Allow>(PhantomData<Deny>, PhantomData<Allow>)
-    where
-        Deny: ShouldExecute,
-        Allow: ShouldExecute;
-
-impl<Deny, Allow> ShouldExecute for DenyThenTry<Deny, Allow>
-    where
-        Deny: ShouldExecute,
-        Allow: ShouldExecute,
-{
-    fn should_execute<Call>(
-        origin: &MultiLocation,
-        message: &mut Xcm<Call>,
-        max_weight: Weight,
-        weight_credit: &mut Weight,
-    ) -> Result<(), ()> {
-        Deny::should_execute(origin, message, max_weight, weight_credit)?;
-        Allow::should_execute(origin, message, max_weight, weight_credit)
-    }
 }
 
 // Allow xcm exchange only with locations in list