pallet-treasury: Ensure we respect max_amount for spend across batch calls (#13468)

* `pallet-treasury`: Ensure we respect `max_amount` for spend across batch calls

When calling `spend` the origin defines the `max_amount` of tokens it is allowed to spend. The
problem is that someone can send a `batch(spend, spend)` to circumvent this restriction as we don't
check across different calls that the `max_amount` is respected. This pull request fixes this
behavior by introducing a so-called dispatch context. This dispatch context is created once per
outer most `dispatch` call. For more information see the docs in this pr. The treasury then uses
this dispatch context to attach information about already spent funds per `max_amount` (we assume
that each origin has a different `max_amount` configured). So, a `batch(spend, spend)` is now
checked to stay inside the allowed spending bounds.

Fixes: https://github.com/paritytech/substrate/issues/13167

* Import `Box` for wasm

* FMT
This commit is contained in:
Bastian Köcher
2023-02-27 18:49:16 +01:00
committed by GitHub
parent 85a5a5db13
commit 6aa4127a74
9 changed files with 353 additions and 24 deletions
+2
View File
@@ -38,6 +38,7 @@ smallvec = "1.8.0"
log = { version = "0.4.17", default-features = false }
sp-core-hashing-proc-macro = { version = "5.0.0", path = "../../primitives/core/hashing/proc-macro" }
k256 = { version = "0.11.5", default-features = false, features = ["ecdsa"] }
environmental = { version = "1.1.4", default-features = false }
[dev-dependencies]
serde_json = "1.0.85"
@@ -67,6 +68,7 @@ std = [
"sp-weights/std",
"frame-support-procedural/std",
"log/std",
"environmental/std",
]
runtime-benchmarks = []
try-runtime = []