git.delta.rocks / unique-network / refs/commits / bfab6035a123

difftreelog

Merge pull request #1044 from UniqueNetwork/fix/forbid-relay-as-root

Yaroslav Bolyukin2023-11-27parents: #425f6c1 #5bf7ef4.patch.diff
in: master
Forbid relay as root

5 files changed

addedjs-packages/tests/sub/governance/electsudo.test.tsdiffbeforeafterboth
--- /dev/null
+++ b/js-packages/tests/sub/governance/electsudo.test.ts
@@ -0,0 +1,99 @@
+import type {IKeyringPair} from '@polkadot/types/types';
+import {usingPlaygrounds, itSub, expect, Pallets, requirePalletsOrSkip, describeGov} from '../../util/index.js';
+import {Event} from '@unique/playgrounds/unique.dev.js';
+import {initCouncil, democracyLaunchPeriod, democracyVotingPeriod, democracyEnactmentPeriod, clearCouncil, clearTechComm, initTechComm, ITechComms} from './util.js';
+import type {ICounselors} from './util.js';
+
+describeGov('Governance: Elect Sudo', () => {
+  let sudoer: IKeyringPair;
+  let donor: IKeyringPair;
+  let counselors: ICounselors;
+  let techComm: ITechComms;
+
+  const moreThanHalfCouncilThreshold = 3;
+
+  before(async function() {
+    await usingPlaygrounds(async (helper, privateKey) => {
+      requirePalletsOrSkip(this, helper, [Pallets.Council]);
+
+      sudoer = await privateKey('//Alice');
+      donor = await privateKey({url: import.meta.url});
+      counselors = await initCouncil(donor, sudoer);
+      techComm = await initTechComm(donor, sudoer);
+    });
+  });
+
+  after(async () => {
+    await clearCouncil(sudoer);
+    await clearTechComm(sudoer);
+  });
+
+  itSub('Democracy can elect a sudo account', async ({helper}) => {
+    const [newAccount] = await helper.arrange.createAccounts([1000n], donor);
+    const newSudoKey = newAccount.address;
+
+    // Have to use `afterEach` here instead of `after` to ensure it will be executed before `describe.after`.
+    afterEach(async () => {
+      // For some reason, the outer helper API is not initialized inside `afterEach`.
+      await usingPlaygrounds(async (helper) => {
+        await helper.executeExtrinsic(
+          newAccount,
+          'api.tx.sudo.setKey',
+          [sudoer.address],
+          false,
+        );
+      });
+    });
+
+    const democracyProposal = helper.constructApiCall('api.tx.utility.dispatchAs', [
+      {
+        system: {
+          Signed: sudoer.address,
+        },
+      },
+      helper.constructApiCall('api.tx.sudo.setKey', [newSudoKey]),
+    ]);
+
+    const councilProposal = await helper.democracy.externalProposeDefaultCall(democracyProposal);
+
+    const proposeResult = await helper.council.collective.propose(
+      counselors.filip,
+      councilProposal,
+      moreThanHalfCouncilThreshold,
+    );
+
+    const councilProposedEvent = Event.Council.Proposed.expect(proposeResult);
+    const proposalIndex = councilProposedEvent.proposalIndex;
+    const proposalHash = councilProposedEvent.proposalHash;
+
+    await helper.council.collective.vote(counselors.alex, proposalHash, proposalIndex, true);
+    await helper.council.collective.vote(counselors.charu, proposalHash, proposalIndex, true);
+    await helper.council.collective.vote(counselors.filip, proposalHash, proposalIndex, true);
+
+    await helper.council.collective.close(counselors.filip, proposalHash, proposalIndex);
+
+    const democracyStartedEvent = await helper.wait.expectEvent(democracyLaunchPeriod, Event.Democracy.Started);
+    const democracyReferendumIndex = democracyStartedEvent.referendumIndex;
+    const democracyThreshold = democracyStartedEvent.threshold;
+
+    expect(democracyThreshold).to.be.equal('SuperMajorityAgainst');
+
+    await helper.democracy.vote(newAccount, democracyReferendumIndex, {
+      Standard: {
+        vote: {
+          aye: true,
+          conviction: 1,
+        },
+        balance: 800n,
+      },
+    });
+
+    const passedReferendumEvent = await helper.wait.expectEvent(democracyVotingPeriod, Event.Democracy.Passed);
+    expect(passedReferendumEvent.referendumIndex).to.be.equal(democracyReferendumIndex);
+
+    await helper.wait.expectEvent(democracyEnactmentPeriod, Event.Scheduler.Dispatched);
+    const currentSudoKey = await helper.callRpc('api.query.sudo.key', [])
+      .then(k => k.toString());
+    expect(currentSudoKey).to.be.equal(newSudoKey);
+  });
+});
modifiedjs-packages/tests/xcm/lowLevelXcmQuartz.test.tsdiffbeforeafterboth
--- a/js-packages/tests/xcm/lowLevelXcmQuartz.test.ts
+++ b/js-packages/tests/xcm/lowLevelXcmQuartz.test.ts
@@ -298,67 +298,3 @@
     await testHelper.rejectReserveTransferUNQfrom('shiden', alice);
   });
 });
-
-describeXCM('[XCMLL] Integration test: The relay can do some root ops', () => {
-  let sudoer: IKeyringPair;
-
-  before(async function () {
-    await usingRelayPlaygrounds(relayUrl, async (_, privateKey) => {
-      sudoer = await privateKey('//Alice');
-    });
-  });
-
-  // At the moment there is no reliable way
-  // to establish the correspondence between the `ExecutedDownward` event
-  // and the relay's sent message due to `SetTopic` instruction
-  // containing an unpredictable topic silently added by the relay's messages on the router level.
-  // This changes the message hash on arrival to our chain.
-  //
-  // See:
-  // * The relay's router: https://github.com/paritytech/polkadot-sdk/blob/f60318f68687e601c47de5ad5ca88e2c3f8139a7/polkadot/runtime/westend/src/xcm_config.rs#L83
-  // * The `WithUniqueTopic` helper: https://github.com/paritytech/polkadot-sdk/blob/945ebbbcf66646be13d5b1d1bc26c8b0d3296d9e/polkadot/xcm/xcm-builder/src/routing.rs#L36
-  //
-  // Because of this, we insert time gaps between tests so
-  // different `ExecutedDownward` events won't interfere with each other.
-  afterEach(async () => {
-    await usingPlaygrounds(async (helper) => {
-      await helper.wait.newBlocks(3);
-    });
-  });
-
-  itSub('The relay can set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'plain');
-  });
-
-  itSub('The relay can batch set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'batch');
-  });
-
-  itSub('The relay can batchAll set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'batchAll');
-  });
-
-  itSub('The relay can forceBatch set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'forceBatch');
-  });
-
-  itSub('[negative] The relay cannot set balance', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'plain');
-  });
-
-  itSub('[negative] The relay cannot set balance via batch', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batch');
-  });
-
-  itSub('[negative] The relay cannot set balance via batchAll', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batchAll');
-  });
-
-  itSub('[negative] The relay cannot set balance via forceBatch', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'forceBatch');
-  });
-
-  itSub('[negative] The relay cannot set balance via dispatchAs', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'dispatchAs');
-  });
-});
modifiedjs-packages/tests/xcm/lowLevelXcmUnique.test.tsdiffbeforeafterboth
--- a/js-packages/tests/xcm/lowLevelXcmUnique.test.ts
+++ b/js-packages/tests/xcm/lowLevelXcmUnique.test.ts
@@ -364,67 +364,3 @@
     await testHelper.rejectReserveTransferUNQfrom('astar', alice);
   });
 });
-
-describeXCM('[XCMLL] Integration test: The relay can do some root ops', () => {
-  let sudoer: IKeyringPair;
-
-  before(async function () {
-    await usingRelayPlaygrounds(relayUrl, async (_, privateKey) => {
-      sudoer = await privateKey('//Alice');
-    });
-  });
-
-  // At the moment there is no reliable way
-  // to establish the correspondence between the `ExecutedDownward` event
-  // and the relay's sent message due to `SetTopic` instruction
-  // containing an unpredictable topic silently added by the relay's messages on the router level.
-  // This changes the message hash on arrival to our chain.
-  //
-  // See:
-  // * The relay's router: https://github.com/paritytech/polkadot-sdk/blob/f60318f68687e601c47de5ad5ca88e2c3f8139a7/polkadot/runtime/westend/src/xcm_config.rs#L83
-  // * The `WithUniqueTopic` helper: https://github.com/paritytech/polkadot-sdk/blob/945ebbbcf66646be13d5b1d1bc26c8b0d3296d9e/polkadot/xcm/xcm-builder/src/routing.rs#L36
-  //
-  // Because of this, we insert time gaps between tests so
-  // different `ExecutedDownward` events won't interfere with each other.
-  afterEach(async () => {
-    await usingPlaygrounds(async (helper) => {
-      await helper.wait.newBlocks(3);
-    });
-  });
-
-  itSub('The relay can set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'plain');
-  });
-
-  itSub('The relay can batch set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'batch');
-  });
-
-  itSub('The relay can batchAll set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'batchAll');
-  });
-
-  itSub('The relay can forceBatch set storage', async () => {
-    await testHelper.relayIsPermittedToSetStorage(sudoer, 'forceBatch');
-  });
-
-  itSub('[negative] The relay cannot set balance', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'plain');
-  });
-
-  itSub('[negative] The relay cannot set balance via batch', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batch');
-  });
-
-  itSub('[negative] The relay cannot set balance via batchAll', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'batchAll');
-  });
-
-  itSub('[negative] The relay cannot set balance via forceBatch', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'forceBatch');
-  });
-
-  itSub('[negative] The relay cannot set balance via dispatchAs', async () => {
-    await testHelper.relayIsNotPermittedToSetBalance(sudoer, 'dispatchAs');
-  });
-});
modifiedjs-packages/tests/xcm/xcm.types.tsdiffbeforeafterboth
--- a/js-packages/tests/xcm/xcm.types.ts
+++ b/js-packages/tests/xcm/xcm.types.ts
@@ -505,117 +505,4 @@
       await expectFailedToTransact(helper, messageSent);
     });
   }
-
-  private async _relayXcmTransactSetStorage(variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch') {
-    // eslint-disable-next-line require-await
-    return await usingPlaygrounds(async (helper) => {
-      const relayForceKV = () => {
-        const random = Math.random();
-        const key = `relay-forced-key (instance: ${random})`;
-        const val = `relay-forced-value (instance: ${random})`;
-        const call = helper.constructApiCall('api.tx.system.setStorage', [[[key, val]]]).method.toHex();
-
-        return {
-          call,
-          key,
-          val,
-        };
-      };
-
-      if(variant == 'plain') {
-        const kv = relayForceKV();
-        return {
-          program: helper.arrange.makeUnpaidSudoTransactProgram({
-            weightMultiplier: 1,
-            call: kv.call,
-          }),
-          kvs: [kv],
-        };
-      } else {
-        const kv0 = relayForceKV();
-        const kv1 = relayForceKV();
-
-        const batchCall = helper.constructApiCall(`api.tx.utility.${variant}`, [[kv0.call, kv1.call]]).method.toHex();
-        return {
-          program: helper.arrange.makeUnpaidSudoTransactProgram({
-            weightMultiplier: 2,
-            call: batchCall,
-          }),
-          kvs: [kv0, kv1],
-        };
-      }
-    });
-  }
-
-  async relayIsPermittedToSetStorage(relaySudoer: IKeyringPair, variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch') {
-    const {program, kvs} = await this._relayXcmTransactSetStorage(variant);
-
-    await usingRelayPlaygrounds(relayUrl, async (helper) => {
-      await helper.getSudo().executeExtrinsic(relaySudoer, 'api.tx.xcmPallet.send', [
-        this._uniqueChainMultilocationForRelay(),
-        program,
-      ]);
-    });
-
-    await usingPlaygrounds(async (helper) => {
-      await expectDownwardXcmComplete(helper);
-
-      for(const kv of kvs) {
-        const forcedValue = await helper.callRpc('api.rpc.state.getStorage', [kv.key]);
-        expect(hexToString(forcedValue.toHex())).to.be.equal(kv.val);
-      }
-    });
-  }
-
-  private async _relayXcmTransactSetBalance(variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch' | 'dispatchAs') {
-    // eslint-disable-next-line require-await
-    return await usingPlaygrounds(async (helper) => {
-      const emptyAccount = helper.arrange.createEmptyAccount().address;
-
-      const forceSetBalanceCall = helper.constructApiCall('api.tx.balances.forceSetBalance', [emptyAccount, 10_000n]).method.toHex();
-
-      let call;
-
-      if(variant == 'plain') {
-        call = forceSetBalanceCall;
-
-      } else if(variant == 'dispatchAs') {
-        call = helper.constructApiCall('api.tx.utility.dispatchAs', [
-          {
-            system: 'Root',
-          },
-          forceSetBalanceCall,
-        ]).method.toHex();
-      } else {
-        call = helper.constructApiCall(`api.tx.utility.${variant}`, [[forceSetBalanceCall]]).method.toHex();
-      }
-
-      return {
-        program: helper.arrange.makeUnpaidSudoTransactProgram({
-          weightMultiplier: 1,
-          call,
-        }),
-        emptyAccount,
-      };
-    });
-  }
-
-  async relayIsNotPermittedToSetBalance(
-    relaySudoer: IKeyringPair,
-    variant: 'plain' | 'batch' | 'batchAll' | 'forceBatch' | 'dispatchAs',
-  ) {
-    const {program, emptyAccount} = await this._relayXcmTransactSetBalance(variant);
-
-    await usingRelayPlaygrounds(relayUrl, async (helper) => {
-      await helper.getSudo().executeExtrinsic(relaySudoer, 'api.tx.xcmPallet.send', [
-        this._uniqueChainMultilocationForRelay(),
-        program,
-      ]);
-    });
-
-    await usingPlaygrounds(async (helper) => {
-      await expectDownwardXcmNoPermission(helper);
-      expect(await helper.balance.getSubstrate(emptyAccount)).to.be.equal(0n);
-    });
-  }
 }
modifiedruntime/common/config/xcm/mod.rsdiffbeforeafterboth
17use cumulus_primitives_core::ParaId;17use cumulus_primitives_core::ParaId;
18use frame_support::{18use frame_support::{
19	parameter_types,19	parameter_types,
20	traits::{ConstU32, Contains, Everything, Get, Nothing, ProcessMessageError},20	traits::{ConstU32, Everything, Get, Nothing, ProcessMessageError},
21};21};
22use frame_system::EnsureRoot;22use frame_system::EnsureRoot;
23use pallet_xcm::XcmPassthrough;23use pallet_xcm::XcmPassthrough;
29	v3::Instruction,29	v3::Instruction,
30};30};
31use staging_xcm_builder::{31use staging_xcm_builder::{
32	AccountId32Aliases, EnsureXcmOrigin, FixedWeightBounds, ParentAsSuperuser, ParentIsPreset,32	AccountId32Aliases, EnsureXcmOrigin, FixedWeightBounds, ParentIsPreset, RelayChainAsNative,
33	RelayChainAsNative, SiblingParachainAsNative, SiblingParachainConvertsVia,33	SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
34	SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation,34	SignedToAccountId32, SovereignSignedViaLocation,
35};35};
111	// Native converter for sibling Parachains; will convert to a `SiblingPara` origin when111	// Native converter for sibling Parachains; will convert to a `SiblingPara` origin when
112	// recognised.112	// recognised.
113	SiblingParachainAsNative<cumulus_pallet_xcm::Origin, RuntimeOrigin>,113	SiblingParachainAsNative<cumulus_pallet_xcm::Origin, RuntimeOrigin>,
114	// Superuser converter for the Relay-chain (Parent) location. This will allow it to issue a
115	// transaction from the Root origin.
116	ParentAsSuperuser<RuntimeOrigin>,
117	// Native signed account converter; this just converts an `AccountId32` origin into a normal114	// Native signed account converter; this just converts an `AccountId32` origin into a normal
118	// `Origin::Signed` origin of the same 32-byte value.115	// `Origin::Signed` origin of the same 32-byte value.
119	SignedAccountId32AsNative<RelayNetwork, RuntimeOrigin>,116	SignedAccountId32AsNative<RelayNetwork, RuntimeOrigin>,
167164
168pub type Weigher = FixedWeightBounds<UnitWeightCost, RuntimeCall, MaxInstructions>;165pub type Weigher = FixedWeightBounds<UnitWeightCost, RuntimeCall, MaxInstructions>;
169
170pub struct XcmCallFilter;
171impl XcmCallFilter {
172	fn allow_gov_and_sys_call(call: &RuntimeCall) -> bool {
173		match call {
174			RuntimeCall::System(..) => true,
175
176			#[cfg(feature = "governance")]
177			RuntimeCall::Identity(..)
178			| RuntimeCall::Preimage(..)
179			| RuntimeCall::Democracy(..)
180			| RuntimeCall::Council(..)
181			| RuntimeCall::TechnicalCommittee(..)
182			| RuntimeCall::CouncilMembership(..)
183			| RuntimeCall::TechnicalCommitteeMembership(..)
184			| RuntimeCall::FellowshipCollective(..)
185			| RuntimeCall::FellowshipReferenda(..) => true,
186			_ => false,
187		}
188	}
189
190	fn allow_utility_call(call: &RuntimeCall) -> bool {
191		match call {
192			RuntimeCall::Utility(pallet_utility::Call::batch { calls, .. }) => {
193				calls.iter().all(Self::allow_gov_and_sys_call)
194			}
195			RuntimeCall::Utility(pallet_utility::Call::batch_all { calls, .. }) => {
196				calls.iter().all(Self::allow_gov_and_sys_call)
197			}
198			RuntimeCall::Utility(pallet_utility::Call::as_derivative { call, .. }) => {
199				Self::allow_gov_and_sys_call(call)
200			}
201			RuntimeCall::Utility(pallet_utility::Call::dispatch_as { call, .. }) => {
202				Self::allow_gov_and_sys_call(call)
203			}
204			RuntimeCall::Utility(pallet_utility::Call::force_batch { calls, .. }) => {
205				calls.iter().all(Self::allow_gov_and_sys_call)
206			}
207			_ => false,
208		}
209	}
210}
211
212impl Contains<RuntimeCall> for XcmCallFilter {
213	fn contains(call: &RuntimeCall) -> bool {
214		Self::allow_gov_and_sys_call(call) || Self::allow_utility_call(call)
215	}
216}
217166
218pub struct XcmExecutorConfig<T>(PhantomData<T>);167pub struct XcmExecutorConfig<T>(PhantomData<T>);
219impl<T> staging_xcm_executor::Config for XcmExecutorConfig<T>168impl<T> staging_xcm_executor::Config for XcmExecutorConfig<T>
244	type MessageExporter = ();193	type MessageExporter = ();
245	type UniversalAliases = Nothing;194	type UniversalAliases = Nothing;
246	type CallDispatcher = RuntimeCall;195	type CallDispatcher = RuntimeCall;
247	type SafeCallFilter = XcmCallFilter;196	type SafeCallFilter = Nothing;
248	type Aliasers = Nothing;197	type Aliasers = Nothing;
249}198}
250199