Rename Palette to FRAME (#4182)

* palette -> frame

* PALETTE, Palette -> FRAME

* Move folder pallete -> frame

* Update docs/Structure.adoc

Co-Authored-By: Benjamin Kampmann <ben.kampmann@googlemail.com>

* Update docs/README.adoc

Co-Authored-By: Benjamin Kampmann <ben.kampmann@googlemail.com>

* Update README.adoc

substrate/frame/assets/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "pallet-assets"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false }
+# Needed for various traits. In our case, `OnFinalize`.
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+# Needed for type-safe access to storage DB.
+support = { package = "frame-support", path = "../support", default-features = false }
+# `system` module provides us with all sorts of useful stuff and macros depend on it being around.
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+rstd = { package = "sr-std", path = "../../primitives/sr-std" }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"sr-primitives/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/assets/src/lib.rs

@@ -0,0 +1,379 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Assets Module
+//!
+//! A simple, secure module for dealing with fungible assets.
+//!
+//! ## Overview
+//!
+//! The Assets module provides functionality for asset management of fungible asset classes
+//! with a fixed supply, including:
+//!
+//! * Asset Issuance
+//! * Asset Transfer
+//! * Asset Destruction
+//!
+//! To use it in your runtime, you need to implement the assets [`Trait`](./trait.Trait.html).
+//!
+//! The supported dispatchable functions are documented in the [`Call`](./enum.Call.html) enum.
+//!
+//! ### Terminology
+//!
+//! * **Asset issuance:** The creation of a new asset, whose total supply will belong to the
+//!   account that issues the asset.
+//! * **Asset transfer:** The action of transferring assets from one account to another.
+//! * **Asset destruction:** The process of an account removing its entire holding of an asset.
+//! * **Fungible asset:** An asset whose units are interchangeable.
+//! * **Non-fungible asset:** An asset for which each unit has unique characteristics.
+//!
+//! ### Goals
+//!
+//! The assets system in Substrate is designed to make the following possible:
+//!
+//! * Issue a unique asset to its creator's account.
+//! * Move assets between accounts.
+//! * Remove an account's balance of an asset when requested by that account's owner and update
+//!   the asset's total supply.
+//!
+//! ## Interface
+//!
+//! ### Dispatchable Functions
+//!
+//! * `issue` - Issues the total supply of a new fungible asset to the account of the caller of the function.
+//! * `transfer` - Transfers an `amount` of units of fungible asset `id` from the balance of
+//! the function caller's account (`origin`) to a `target` account.
+//! * `destroy` - Destroys the entire holding of a fungible asset `id` associated with the account
+//! that called the function.
+//!
+//! Please refer to the [`Call`](./enum.Call.html) enum and its associated variants for documentation on each function.
+//!
+//! ### Public Functions
+//! <!-- Original author of descriptions: @gavofyork -->
+//!
+//! * `balance` - Get the asset `id` balance of `who`.
+//! * `total_supply` - Get the total supply of an asset `id`.
+//!
+//! Please refer to the [`Module`](./struct.Module.html) struct for details on publicly available functions.
+//!
+//! ## Usage
+//!
+//! The following example shows how to use the Assets module in your runtime by exposing public functions to:
+//!
+//! * Issue a new fungible asset for a token distribution event (airdrop).
+//! * Query the fungible asset holding balance of an account.
+//! * Query the total supply of a fungible asset that has been issued.
+//!
+//! ### Prerequisites
+//!
+//! Import the Assets module and types and derive your runtime's configuration traits from the Assets module trait.
+//!
+//! ### Simple Code Snippet
+//!
+//! ```rust,ignore
+//! use support::{decl_module, dispatch::Result};
+//! use system::ensure_signed;
+//!
+//! pub trait Trait: assets::Trait { }
+//!
+//! decl_module! {
+//! 	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+//! 		pub fn issue_token_airdrop(origin) -> Result {
+//! 			const ACCOUNT_ALICE: u64 = 1;
+//! 			const ACCOUNT_BOB: u64 = 2;
+//! 			const COUNT_AIRDROP_RECIPIENTS = 2;
+//! 			const TOKENS_FIXED_SUPPLY: u64 = 100;
+//!
+//! 			ensure!(!COUNT_AIRDROP_RECIPIENTS.is_zero(), "Divide by zero error.");
+//!
+//! 			let sender = ensure_signed(origin)?;
+//! 			let asset_id = Self::next_asset_id();
+//!
+//! 			<NextAssetId<T>>::mutate(|asset_id| *asset_id += 1);
+//! 			<Balances<T>>::insert((asset_id, &ACCOUNT_ALICE), TOKENS_FIXED_SUPPLY / COUNT_AIRDROP_RECIPIENTS);
+//! 			<Balances<T>>::insert((asset_id, &ACCOUNT_BOB), TOKENS_FIXED_SUPPLY / COUNT_AIRDROP_RECIPIENTS);
+//! 			<TotalSupply<T>>::insert(asset_id, TOKENS_FIXED_SUPPLY);
+//!
+//! 			Self::deposit_event(RawEvent::Issued(asset_id, sender, TOKENS_FIXED_SUPPLY));
+//! 			Ok(())
+//! 		}
+//! 	}
+//! }
+//! ```
+//!
+//! ## Assumptions
+//!
+//! Below are assumptions that must be held when using this module.  If any of
+//! them are violated, the behavior of this module is undefined.
+//!
+//! * The total count of assets should be less than
+//!   `Trait::AssetId::max_value()`.
+//!
+//! ## Related Modules
+//!
+//! * [`System`](../frame_system/index.html)
+//! * [`Support`](../frame_support/index.html)
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use support::{Parameter, decl_module, decl_event, decl_storage, ensure};
+use sr_primitives::traits::{Member, SimpleArithmetic, Zero, StaticLookup};
+use system::ensure_signed;
+use sr_primitives::traits::One;
+
+/// The module configuration trait.
+pub trait Trait: system::Trait {
+	/// The overarching event type.
+	type Event: From<Event<Self>> + Into<<Self as system::Trait>::Event>;
+
+	/// The units in which we record balances.
+	type Balance: Member + Parameter + SimpleArithmetic + Default + Copy;
+
+	/// The arithmetic type of asset identifier.
+	type AssetId: Parameter + SimpleArithmetic + Default + Copy;
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+		/// Issue a new class of fungible assets. There are, and will only ever be, `total`
+		/// such assets and they'll all belong to the `origin` initially. It will have an
+		/// identifier `AssetId` instance: this will be specified in the `Issued` event.
+		fn issue(origin, #[compact] total: T::Balance) {
+			let origin = ensure_signed(origin)?;
+
+			let id = Self::next_asset_id();
+			<NextAssetId<T>>::mutate(|id| *id += One::one());
+
+			<Balances<T>>::insert((id, &origin), total);
+			<TotalSupply<T>>::insert(id, total);
+
+			Self::deposit_event(RawEvent::Issued(id, origin, total));
+		}
+
+		/// Move some assets from one holder to another.
+		fn transfer(origin,
+			#[compact] id: T::AssetId,
+			target: <T::Lookup as StaticLookup>::Source,
+			#[compact] amount: T::Balance
+		) {
+			let origin = ensure_signed(origin)?;
+			let origin_account = (id, origin.clone());
+			let origin_balance = <Balances<T>>::get(&origin_account);
+			let target = T::Lookup::lookup(target)?;
+			ensure!(!amount.is_zero(), "transfer amount should be non-zero");
+			ensure!(origin_balance >= amount, "origin account balance must be greater than or equal to the transfer amount");
+
+			Self::deposit_event(RawEvent::Transferred(id, origin, target.clone(), amount));
+			<Balances<T>>::insert(origin_account, origin_balance - amount);
+			<Balances<T>>::mutate((id, target), |balance| *balance += amount);
+		}
+
+		/// Destroy any assets of `id` owned by `origin`.
+		fn destroy(origin, #[compact] id: T::AssetId) {
+			let origin = ensure_signed(origin)?;
+			let balance = <Balances<T>>::take((id, &origin));
+			ensure!(!balance.is_zero(), "origin balance should be non-zero");
+
+			<TotalSupply<T>>::mutate(id, |total_supply| *total_supply -= balance);
+			Self::deposit_event(RawEvent::Destroyed(id, origin, balance));
+		}
+	}
+}
+
+decl_event!(
+	pub enum Event<T> where
+		<T as system::Trait>::AccountId,
+		<T as Trait>::Balance,
+		<T as Trait>::AssetId,
+	{
+		/// Some assets were issued.
+		Issued(AssetId, AccountId, Balance),
+		/// Some assets were transferred.
+		Transferred(AssetId, AccountId, AccountId, Balance),
+		/// Some assets were destroyed.
+		Destroyed(AssetId, AccountId, Balance),
+	}
+);
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Assets {
+		/// The number of units of assets held by any given account.
+		Balances: map (T::AssetId, T::AccountId) => T::Balance;
+		/// The next asset identifier up for grabs.
+		NextAssetId get(fn next_asset_id): T::AssetId;
+		/// The total unit supply of an asset.
+		TotalSupply: map T::AssetId => T::Balance;
+	}
+}
+
+// The main implementation block for the module.
+impl<T: Trait> Module<T> {
+	// Public immutables
+
+	/// Get the asset `id` balance of `who`.
+	pub fn balance(id: T::AssetId, who: T::AccountId) -> T::Balance {
+		<Balances<T>>::get((id, who))
+	}
+
+	/// Get the total supply of an asset `id`.
+	pub fn total_supply(id: T::AssetId) -> T::Balance {
+		<TotalSupply<T>>::get(id)
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	use support::{impl_outer_origin, assert_ok, assert_noop, parameter_types};
+	use primitives::H256;
+	// The testing primitives are very useful for avoiding having to work with signatures
+	// or public keys. `u64` is used as the `AccountId` and no `Signature`s are required.
+	use sr_primitives::{Perbill, traits::{BlakeTwo256, IdentityLookup}, testing::Header};
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	// For testing the module, we construct most of a mock runtime. This means
+	// first constructing a configuration type (`Test`) which `impl`s each of the
+	// configuration traits of modules we want to use.
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type Call = ();
+		type BlockNumber = u64;
+		type Hash = H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+	impl Trait for Test {
+		type Event = ();
+		type Balance = u64;
+		type AssetId = u32;
+	}
+	type Assets = Module<Test>;
+
+	// This function basically just builds a genesis storage key/value store according to
+	// our desired mockup.
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		system::GenesisConfig::default().build_storage::<Test>().unwrap().into()
+	}
+
+	#[test]
+	fn issuing_asset_units_to_issuer_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+		});
+	}
+
+	#[test]
+	fn querying_total_supply_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_ok!(Assets::transfer(Origin::signed(1), 0, 2, 50));
+			assert_eq!(Assets::balance(0, 1), 50);
+			assert_eq!(Assets::balance(0, 2), 50);
+			assert_ok!(Assets::transfer(Origin::signed(2), 0, 3, 31));
+			assert_eq!(Assets::balance(0, 1), 50);
+			assert_eq!(Assets::balance(0, 2), 19);
+			assert_eq!(Assets::balance(0, 3), 31);
+			assert_ok!(Assets::destroy(Origin::signed(3), 0));
+			assert_eq!(Assets::total_supply(0), 69);
+		});
+	}
+
+	#[test]
+	fn transferring_amount_above_available_balance_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_ok!(Assets::transfer(Origin::signed(1), 0, 2, 50));
+			assert_eq!(Assets::balance(0, 1), 50);
+			assert_eq!(Assets::balance(0, 2), 50);
+		});
+	}
+
+	#[test]
+	fn transferring_amount_more_than_available_balance_should_not_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_ok!(Assets::transfer(Origin::signed(1), 0, 2, 50));
+			assert_eq!(Assets::balance(0, 1), 50);
+			assert_eq!(Assets::balance(0, 2), 50);
+			assert_ok!(Assets::destroy(Origin::signed(1), 0));
+			assert_eq!(Assets::balance(0, 1), 0);
+			assert_noop!(Assets::transfer(Origin::signed(1), 0, 1, 50), "origin account balance must be greater than or equal to the transfer amount");
+		});
+	}
+
+	#[test]
+	fn transferring_less_than_one_unit_should_not_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_noop!(Assets::transfer(Origin::signed(1), 0, 2, 0), "transfer amount should be non-zero");
+		});
+	}
+
+	#[test]
+	fn transferring_more_units_than_total_supply_should_not_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_noop!(Assets::transfer(Origin::signed(1), 0, 2, 101), "origin account balance must be greater than or equal to the transfer amount");
+		});
+	}
+
+	#[test]
+	fn destroying_asset_balance_with_positive_balance_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 1), 100);
+			assert_ok!(Assets::destroy(Origin::signed(1), 0));
+		});
+	}
+
+	#[test]
+	fn destroying_asset_balance_with_zero_balance_should_not_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Assets::issue(Origin::signed(1), 100));
+			assert_eq!(Assets::balance(0, 2), 0);
+			assert_noop!(Assets::destroy(Origin::signed(2), 0), "origin balance should be non-zero");
+		});
+	}
+}

substrate/frame/aura/Cargo.toml

@@ -0,0 +1,44 @@
+[package]
+name = "pallet-aura"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+app-crypto = { package = "substrate-application-crypto",  path = "../../primitives/application-crypto", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+inherents = { package = "substrate-inherents", path = "../../primitives/inherents", default-features = false }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+serde = { version = "1.0.101", optional = true }
+session = { package = "pallet-session", path = "../session", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+substrate-consensus-aura-primitives = { path = "../../primitives/consensus/aura", default-features = false}
+system = { package = "frame-system", path = "../system", default-features = false }
+sp-timestamp = { package = "sp-timestamp", path = "../../primitives/timestamp", default-features = false }
+pallet-timestamp = { package = "pallet-timestamp", path = "../timestamp", default-features = false }
+
+
+[dev-dependencies]
+lazy_static = "1.4.0"
+parking_lot = "0.9.0"
+
+[features]
+default = ["std"]
+std = [
+	"app-crypto/std",
+	"codec/std",
+	"inherents/std",
+	"runtime-io/std",
+	"primitives/std",
+	"rstd/std",
+	"serde",
+	"sr-primitives/std",
+	"support/std",
+	"substrate-consensus-aura-primitives/std",
+	"system/std",
+	"sp-timestamp/std",
+	"pallet-timestamp/std",
+]

substrate/frame/aura/src/lib.rs

@@ -0,0 +1,233 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Aura Module
+//!
+//! - [`aura::Trait`](./trait.Trait.html)
+//! - [`Module`](./struct.Module.html)
+//!
+//! ## Overview
+//!
+//! The Aura module extends Aura consensus by managing offline reporting.
+//!
+//! ## Interface
+//!
+//! ### Public Functions
+//!
+//! - `slot_duration` - Determine the Aura slot-duration based on the Timestamp module configuration.
+//!
+//! ## Related Modules
+//!
+//! - [Timestamp](../pallet_timestamp/index.html): The Timestamp module is used in Aura to track
+//! consensus rounds (via `slots`).
+//! - [Consensus](../frame_consensus/index.html): The Consensus module does not relate directly to Aura,
+//!  but serves to manage offline reporting by implementing `ProvideInherent` in a similar way.
+//!
+//! ## References
+//!
+//! If you're interested in hacking on this module, it is useful to understand the interaction with
+//! `substrate/primitives/inherents/src/lib.rs` and, specifically, the required implementation of
+//! [`ProvideInherent`](../substrate_inherents/trait.ProvideInherent.html) and
+//! [`ProvideInherentData`](../substrate_inherents/trait.ProvideInherentData.html) to create and check inherents.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use pallet_timestamp;
+
+use rstd::{result, prelude::*};
+use codec::{Encode, Decode};
+use support::{
+	decl_storage, decl_module, Parameter, traits::{Get, FindAuthor},
+	ConsensusEngineId,
+};
+use sr_primitives::{
+	RuntimeAppPublic,
+	traits::{SaturatedConversion, Saturating, Zero, Member, IsMember}, generic::DigestItem,
+};
+use sp_timestamp::OnTimestampSet;
+use inherents::{InherentIdentifier, InherentData, ProvideInherent, MakeFatalError};
+use substrate_consensus_aura_primitives::{
+	AURA_ENGINE_ID, ConsensusLog, AuthorityIndex,
+	inherents::{INHERENT_IDENTIFIER, AuraInherentData},
+};
+
+mod mock;
+mod tests;
+
+pub trait Trait: pallet_timestamp::Trait {
+	/// The identifier type for an authority.
+	type AuthorityId: Member + Parameter + RuntimeAppPublic + Default;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Aura {
+		/// The last timestamp.
+		LastTimestamp get(fn last) build(|_| 0.into()): T::Moment;
+
+		/// The current authorities
+		pub Authorities get(fn authorities): Vec<T::AuthorityId>;
+	}
+	add_extra_genesis {
+		config(authorities): Vec<T::AuthorityId>;
+		build(|config| Module::<T>::initialize_authorities(&config.authorities))
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin { }
+}
+
+impl<T: Trait> Module<T> {
+	fn change_authorities(new: Vec<T::AuthorityId>) {
+		<Authorities<T>>::put(&new);
+
+		let log: DigestItem<T::Hash> = DigestItem::Consensus(
+			AURA_ENGINE_ID,
+			ConsensusLog::AuthoritiesChange(new).encode()
+		);
+		<system::Module<T>>::deposit_log(log.into());
+	}
+
+	fn initialize_authorities(authorities: &[T::AuthorityId]) {
+		if !authorities.is_empty() {
+			assert!(<Authorities<T>>::get().is_empty(), "Authorities are already initialized!");
+			<Authorities<T>>::put(authorities);
+		}
+	}
+}
+
+impl<T: Trait> sr_primitives::BoundToRuntimeAppPublic for Module<T> {
+	type Public = T::AuthorityId;
+}
+
+impl<T: Trait> session::OneSessionHandler<T::AccountId> for Module<T> {
+	type Key = T::AuthorityId;
+
+	fn on_genesis_session<'a, I: 'a>(validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, T::AuthorityId)>
+	{
+		let authorities = validators.map(|(_, k)| k).collect::<Vec<_>>();
+		Self::initialize_authorities(&authorities);
+	}
+
+	fn on_new_session<'a, I: 'a>(changed: bool, validators: I, _queued_validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, T::AuthorityId)>
+	{
+		// instant changes
+		if changed {
+			let next_authorities = validators.map(|(_, k)| k).collect::<Vec<_>>();
+			let last_authorities = <Module<T>>::authorities();
+			if next_authorities != last_authorities {
+				Self::change_authorities(next_authorities);
+			}
+		}
+	}
+
+	fn on_disabled(i: usize) {
+		let log: DigestItem<T::Hash> = DigestItem::Consensus(
+			AURA_ENGINE_ID,
+			ConsensusLog::<T::AuthorityId>::OnDisabled(i as AuthorityIndex).encode(),
+		);
+
+		<system::Module<T>>::deposit_log(log.into());
+	}
+}
+
+impl<T: Trait> FindAuthor<u32> for Module<T> {
+	fn find_author<'a, I>(digests: I) -> Option<u32> where
+		I: 'a + IntoIterator<Item=(ConsensusEngineId, &'a [u8])>
+	{
+		for (id, mut data) in digests.into_iter() {
+			if id == AURA_ENGINE_ID {
+				if let Ok(slot_num) = u64::decode(&mut data) {
+					let author_index = slot_num % Self::authorities().len() as u64;
+					return Some(author_index as u32)
+				}
+			}
+		}
+
+		None
+	}
+}
+
+impl<T: Trait> IsMember<T::AuthorityId> for Module<T> {
+	fn is_member(authority_id: &T::AuthorityId) -> bool {
+		Self::authorities()
+			.iter()
+			.any(|id| id == authority_id)
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Determine the Aura slot-duration based on the Timestamp module configuration.
+	pub fn slot_duration() -> T::Moment {
+		// we double the minimum block-period so each author can always propose within
+		// the majority of its slot.
+		<T as pallet_timestamp::Trait>::MinimumPeriod::get().saturating_mul(2.into())
+	}
+
+	fn on_timestamp_set(now: T::Moment, slot_duration: T::Moment) {
+		let last = Self::last();
+		<Self as Store>::LastTimestamp::put(now);
+
+		if last.is_zero() {
+			return;
+		}
+
+		assert!(!slot_duration.is_zero(), "Aura slot duration cannot be zero.");
+
+		let last_slot = last / slot_duration;
+		let cur_slot = now / slot_duration;
+
+		assert!(last_slot < cur_slot, "Only one block may be authored per slot.");
+
+		// TODO [#3398] Generate offence report for all authorities that skipped their slots.
+	}
+}
+
+impl<T: Trait> OnTimestampSet<T::Moment> for Module<T> {
+	fn on_timestamp_set(moment: T::Moment) {
+		Self::on_timestamp_set(moment, Self::slot_duration())
+	}
+}
+
+impl<T: Trait> ProvideInherent for Module<T> {
+	type Call = pallet_timestamp::Call<T>;
+	type Error = MakeFatalError<inherents::Error>;
+	const INHERENT_IDENTIFIER: InherentIdentifier = INHERENT_IDENTIFIER;
+
+	fn create_inherent(_: &InherentData) -> Option<Self::Call> {
+		None
+	}
+
+	/// Verify the validity of the inherent using the timestamp.
+	fn check_inherent(call: &Self::Call, data: &InherentData) -> result::Result<(), Self::Error> {
+		let timestamp = match call {
+			pallet_timestamp::Call::set(ref timestamp) => timestamp.clone(),
+			_ => return Ok(()),
+		};
+
+		let timestamp_based_slot = timestamp / Self::slot_duration();
+
+		let seal_slot = data.aura_inherent_data()?.saturated_into();
+
+		if timestamp_based_slot == seal_slot {
+			Ok(())
+		} else {
+			Err(inherents::Error::from("timestamp set in block doesn't match slot in seal").into())
+		}
+	}
+}

substrate/frame/aura/src/mock.rs

@@ -0,0 +1,83 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+#![cfg(test)]
+
+use crate::{Trait, Module, GenesisConfig};
+use substrate_consensus_aura_primitives::ed25519::AuthorityId;
+use sr_primitives::{
+	traits::IdentityLookup, Perbill,
+	testing::{Header, UintAuthorityId},
+};
+use support::{impl_outer_origin, parameter_types};
+use runtime_io;
+use primitives::H256;
+
+impl_outer_origin!{
+	pub enum Origin for Test {}
+}
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Test;
+
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+	pub const MinimumPeriod: u64 = 1;
+}
+
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = ::sr_primitives::traits::BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type MaximumBlockLength = MaximumBlockLength;
+	type Version = ();
+}
+
+impl pallet_timestamp::Trait for Test {
+	type Moment = u64;
+	type OnTimestampSet = Aura;
+	type MinimumPeriod = MinimumPeriod;
+}
+
+impl Trait for Test {
+	type AuthorityId = AuthorityId;
+}
+
+pub fn new_test_ext(authorities: Vec<u64>) -> runtime_io::TestExternalities {
+	let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+	GenesisConfig::<Test>{
+		authorities: authorities.into_iter().map(|a| UintAuthorityId(a).to_public_key()).collect(),
+	}.assimilate_storage(&mut t).unwrap();
+	t.into()
+}
+
+pub type Aura = Module<Test>;

substrate/frame/aura/src/tests.rs

@@ -0,0 +1,29 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the module.
+
+#![cfg(test)]
+
+use crate::mock::{Aura, new_test_ext};
+
+#[test]
+fn initial_values() {
+	new_test_ext(vec![0, 1, 2, 3]).execute_with(|| {
+		assert_eq!(Aura::last(), 0u64);
+		assert_eq!(Aura::authorities().len(), 4);
+	});
+}

substrate/frame/authority-discovery/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "pallet-authority-discovery"
+version = "0.1.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+authority-discovery-primitives = { package = "substrate-authority-discovery-primitives", path = "../../primitives/authority-discovery", default-features = false }
+app-crypto = { package = "substrate-application-crypto", path = "../../primitives/application-crypto", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+serde = { version = "1.0.101", optional = true }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+session = { package = "pallet-session", path = "../session", default-features = false, features = [ "historical" ] }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"app-crypto/std",
+	"authority-discovery-primitives/std",
+	"codec/std",
+	"primitives/std",
+	"rstd/std",
+	"runtime-io/std",
+	"serde",
+	"session/std",
+	"sr-primitives/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/authority-discovery/src/lib.rs

@@ -0,0 +1,251 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Authority discovery module.
+//!
+//! This module is used by the `core/authority-discovery` to retrieve the
+//! current set of authorities.
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::prelude::*;
+use support::{decl_module, decl_storage};
+use authority_discovery_primitives::AuthorityId;
+
+/// The module's config trait.
+pub trait Trait: system::Trait + session::Trait {}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as AuthorityDiscovery {
+		/// Keys of the current authority set.
+		Keys get(fn keys): Vec<AuthorityId>;
+	}
+	add_extra_genesis {
+		config(keys): Vec<AuthorityId>;
+		build(|config| Module::<T>::initialize_keys(&config.keys))
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Retrieve authority identifiers of the current authority set.
+	pub fn authorities() -> Vec<AuthorityId> {
+		Keys::get()
+	}
+
+	fn initialize_keys(keys: &[AuthorityId]) {
+		if !keys.is_empty() {
+			assert!(Keys::get().is_empty(), "Keys are already initialized!");
+			Keys::put(keys);
+		}
+	}
+}
+
+impl<T: Trait> sr_primitives::BoundToRuntimeAppPublic for Module<T> {
+	type Public = AuthorityId;
+}
+
+impl<T: Trait> session::OneSessionHandler<T::AccountId> for Module<T> {
+	type Key = AuthorityId;
+
+	fn on_genesis_session<'a, I: 'a>(authorities: I)
+	where
+		I: Iterator<Item = (&'a T::AccountId, Self::Key)>,
+	{
+		let keys = authorities.map(|x| x.1).collect::<Vec<_>>();
+		Self::initialize_keys(&keys);
+	}
+
+	fn on_new_session<'a, I: 'a>(changed: bool, validators: I, _queued_validators: I)
+	where
+		I: Iterator<Item = (&'a T::AccountId, Self::Key)>,
+	{
+		// Remember who the authorities are for the new session.
+		if changed {
+			Keys::put(validators.map(|x| x.1).collect::<Vec<_>>());
+		}
+	}
+
+	fn on_disabled(_i: usize) {
+		// ignore
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use authority_discovery_primitives::{AuthorityPair};
+	use app_crypto::Pair;
+	use primitives::{crypto::key_types, H256};
+	use runtime_io::TestExternalities;
+	use sr_primitives::{
+		testing::{Header, UintAuthorityId}, traits::{ConvertInto, IdentityLookup, OpaqueKeys},
+		Perbill, KeyTypeId,
+	};
+	use support::{impl_outer_origin, parameter_types};
+
+	type AuthorityDiscovery = Module<Test>;
+	type SessionIndex = u32;
+
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+	impl Trait for Test {}
+
+	pub struct TestOnSessionEnding;
+	impl session::OnSessionEnding<AuthorityId> for TestOnSessionEnding {
+		fn on_session_ending(_: SessionIndex, _: SessionIndex) -> Option<Vec<AuthorityId>> {
+			None
+		}
+	}
+
+	parameter_types! {
+		pub const DisabledValidatorsThreshold: Perbill = Perbill::from_percent(33);
+	}
+
+	impl session::Trait for Test {
+		type OnSessionEnding = TestOnSessionEnding;
+		type Keys = UintAuthorityId;
+		type ShouldEndSession = session::PeriodicSessions<Period, Offset>;
+		type SessionHandler = TestSessionHandler;
+		type Event = ();
+		type ValidatorId = AuthorityId;
+		type ValidatorIdOf = ConvertInto;
+		type SelectInitialValidators = ();
+		type DisabledValidatorsThreshold = DisabledValidatorsThreshold;
+	}
+
+	impl session::historical::Trait for Test {
+		type FullIdentification = ();
+		type FullIdentificationOf = ();
+	}
+
+	pub type BlockNumber = u64;
+
+	parameter_types! {
+		pub const Period: BlockNumber = 1;
+		pub const Offset: BlockNumber = 0;
+		pub const UncleGenerations: u64 = 0;
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = BlockNumber;
+		type Call = ();
+		type Hash = H256;
+		type Hashing = ::sr_primitives::traits::BlakeTwo256;
+		type AccountId = AuthorityId;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	pub struct TestSessionHandler;
+	impl session::SessionHandler<AuthorityId> for TestSessionHandler {
+		const KEY_TYPE_IDS: &'static [KeyTypeId] = &[key_types::DUMMY];
+
+		fn on_new_session<Ks: OpaqueKeys>(
+			_changed: bool,
+			_validators: &[(AuthorityId, Ks)],
+			_queued_validators: &[(AuthorityId, Ks)],
+		) {
+		}
+
+		fn on_disabled(_validator_index: usize) {}
+
+		fn on_genesis_session<Ks: OpaqueKeys>(_validators: &[(AuthorityId, Ks)]) {}
+	}
+
+	#[test]
+	fn authorities_returns_current_authority_set() {
+		// The whole authority discovery module ignores account ids, but we still need it for
+		// `session::OneSessionHandler::on_new_session`, thus its safe to use the same value everywhere.
+		let account_id = AuthorityPair::from_seed_slice(vec![10; 32].as_ref()).unwrap().public();
+
+		let first_authorities: Vec<AuthorityId> = vec![0, 1].into_iter()
+			.map(|i| AuthorityPair::from_seed_slice(vec![i; 32].as_ref()).unwrap().public())
+			.map(AuthorityId::from)
+			.collect();
+
+		let second_authorities: Vec<AuthorityId> = vec![2, 3].into_iter()
+			.map(|i| AuthorityPair::from_seed_slice(vec![i; 32].as_ref()).unwrap().public())
+			.map(AuthorityId::from)
+			.collect();
+
+		// Needed for `session::OneSessionHandler::on_new_session`.
+		let second_authorities_and_account_ids: Vec<(&AuthorityId, AuthorityId)> = second_authorities.clone()
+			.into_iter()
+			.map(|id| (&account_id, id))
+			.collect();
+
+		// Build genesis.
+		let mut t = system::GenesisConfig::default()
+			.build_storage::<Test>()
+			.unwrap();
+
+		GenesisConfig {
+			keys: vec![],
+		}
+		.assimilate_storage::<Test>(&mut t)
+		.unwrap();
+
+		// Create externalities.
+		let mut externalities = TestExternalities::new(t);
+
+		externalities.execute_with(|| {
+			use session::OneSessionHandler;
+
+			AuthorityDiscovery::on_genesis_session(
+				first_authorities.iter().map(|id| (id, id.clone()))
+			);
+			assert_eq!(first_authorities, AuthorityDiscovery::authorities());
+
+			// When `changed` set to false, the authority set should not be updated.
+			AuthorityDiscovery::on_new_session(
+				false,
+				second_authorities_and_account_ids.clone().into_iter(),
+				vec![].into_iter(),
+			);
+			assert_eq!(first_authorities, AuthorityDiscovery::authorities());
+
+			// When `changed` set to true, the authority set should be updated.
+			AuthorityDiscovery::on_new_session(
+				true,
+				second_authorities_and_account_ids.into_iter(),
+				vec![].into_iter(),
+			);
+			assert_eq!(second_authorities, AuthorityDiscovery::authorities());
+		});
+	}
+}

substrate/frame/authorship/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "pallet-authorship"
+version = "0.1.0"
+description = "Block and Uncle Author tracking for the SRML"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+inherents = { package = "substrate-inherents", path = "../../primitives/inherents", default-features = false }
+sp-authorship = { path = "../../primitives/authorship", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+impl-trait-for-tuples = "0.1.3"
+
+[features]
+default = ["std"]
+std = [
+	"codec/std",
+	"primitives/std",
+	"inherents/std",
+	"sr-primitives/std",
+	"rstd/std",
+	"support/std",
+	"system/std",
+	"runtime-io/std",
+	"sp-authorship/std",
+]

substrate/frame/authorship/src/lib.rs

@@ -0,0 +1,678 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Authorship tracking for SRML runtimes.
+//!
+//! This tracks the current author of the block and recent uncles.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::{result, prelude::*};
+use rstd::collections::btree_set::BTreeSet;
+use support::{decl_module, decl_storage};
+use support::traits::{FindAuthor, VerifySeal, Get};
+use support::dispatch::Result as DispatchResult;
+use codec::{Encode, Decode};
+use system::ensure_none;
+use sr_primitives::traits::{Header as HeaderT, One, Zero};
+use support::weights::SimpleDispatchInfo;
+use inherents::{InherentIdentifier, ProvideInherent, InherentData, MakeFatalError};
+use sp_authorship::{
+	INHERENT_IDENTIFIER, UnclesInherentData,
+};
+
+pub trait Trait: system::Trait {
+	/// Find the author of a block.
+	type FindAuthor: FindAuthor<Self::AccountId>;
+	/// The number of blocks back we should accept uncles.
+	/// This means that we will deal with uncle-parents that are
+	/// `UncleGenerations + 1` before `now`.
+	type UncleGenerations: Get<Self::BlockNumber>;
+	/// A filter for uncles within a block. This is for implementing
+	/// further constraints on what uncles can be included, other than their ancestry.
+	///
+	/// For PoW, as long as the seals are checked, there is no need to use anything
+	/// but the `VerifySeal` implementation as the filter. This is because the cost of making many equivocating
+	/// uncles is high.
+	///
+	/// For PoS, there is no such limitation, so a further constraint must be imposed
+	/// beyond a seal check in order to prevent an arbitrary number of
+	/// equivocating uncles from being included.
+	///
+	/// The `OnePerAuthorPerHeight` filter is good for many slot-based PoS
+	/// engines.
+	type FilterUncle: FilterUncle<Self::Header, Self::AccountId>;
+	/// An event handler for authored blocks.
+	type EventHandler: EventHandler<Self::AccountId, Self::BlockNumber>;
+}
+
+/// An event handler for the authorship module. There is a dummy implementation
+/// for `()`, which does nothing.
+#[impl_trait_for_tuples::impl_for_tuples(30)]
+pub trait EventHandler<Author, BlockNumber> {
+	/// Note that the given account ID is the author of the current block.
+	fn note_author(author: Author);
+
+	/// Note that the given account ID authored the given uncle, and how many
+	/// blocks older than the current block it is (age >= 0, so siblings are allowed)
+	fn note_uncle(author: Author, age: BlockNumber);
+}
+
+/// Additional filtering on uncles that pass preliminary ancestry checks.
+///
+/// This should do work such as checking seals
+pub trait FilterUncle<Header, Author> {
+	/// An accumulator of data about uncles included.
+	///
+	/// In practice, this is used to validate uncles against others in the same block.
+	type Accumulator: Default;
+
+	/// Do additional filtering on a seal-checked uncle block, with the accumulated
+	/// filter.
+	fn filter_uncle(header: &Header, acc: &mut Self::Accumulator)
+		-> Result<Option<Author>, &'static str>;
+}
+
+impl<H, A> FilterUncle<H, A> for () {
+	type Accumulator = ();
+	fn filter_uncle(_: &H, _acc: &mut Self::Accumulator)
+		-> Result<Option<A>, &'static str>
+	{
+		Ok(None)
+	}
+}
+
+/// A filter on uncles which verifies seals and does no additional checks.
+/// This is well-suited to consensus modes such as PoW where the cost of
+/// equivocating is high.
+pub struct SealVerify<T>(rstd::marker::PhantomData<T>);
+
+impl<Header, Author, T: VerifySeal<Header, Author>> FilterUncle<Header, Author>
+	for SealVerify<T>
+{
+	type Accumulator = ();
+
+	fn filter_uncle(header: &Header, _acc: &mut ())
+		-> Result<Option<Author>, &'static str>
+	{
+		T::verify_seal(header)
+	}
+}
+
+/// A filter on uncles which verifies seals and ensures that there is only
+/// one uncle included per author per height.
+///
+/// This does O(n log n) work in the number of uncles included.
+pub struct OnePerAuthorPerHeight<T, N>(rstd::marker::PhantomData<(T, N)>);
+
+impl<Header, Author, T> FilterUncle<Header, Author>
+	for OnePerAuthorPerHeight<T, Header::Number>
+where
+	Header: HeaderT + PartialEq,
+	Header::Number: Ord,
+	Author: Clone + PartialEq + Ord,
+	T: VerifySeal<Header, Author>,
+{
+	type Accumulator = BTreeSet<(Header::Number, Author)>;
+
+	fn filter_uncle(header: &Header, acc: &mut Self::Accumulator)
+		-> Result<Option<Author>, &'static str>
+	{
+		let author = T::verify_seal(header)?;
+		let number = header.number();
+
+		if let Some(ref author) = author {
+			if !acc.insert((number.clone(), author.clone())) {
+				return Err("more than one uncle per number per author included");
+			}
+		}
+
+		Ok(author)
+	}
+}
+
+#[derive(Encode, Decode, sr_primitives::RuntimeDebug)]
+#[cfg_attr(any(feature = "std", test), derive(PartialEq))]
+enum UncleEntryItem<BlockNumber, Hash, Author> {
+	InclusionHeight(BlockNumber),
+	Uncle(Hash, Option<Author>),
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Authorship {
+		/// Uncles
+		Uncles: Vec<UncleEntryItem<T::BlockNumber, T::Hash, T::AccountId>>;
+		/// Author of current block.
+		Author: Option<T::AccountId>;
+		/// Whether uncles were already set in this block.
+		DidSetUncles: bool;
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn on_initialize(now: T::BlockNumber) {
+			let uncle_generations = T::UncleGenerations::get();
+			// prune uncles that are older than the allowed number of generations.
+			if uncle_generations <= now {
+				let minimum_height = now - uncle_generations;
+				Self::prune_old_uncles(minimum_height)
+			}
+
+			<Self as Store>::DidSetUncles::put(false);
+
+			T::EventHandler::note_author(Self::author());
+		}
+
+		fn on_finalize() {
+			// ensure we never go to trie with these values.
+			<Self as Store>::Author::kill();
+			<Self as Store>::DidSetUncles::kill();
+		}
+
+		/// Provide a set of uncles.
+		#[weight = SimpleDispatchInfo::FixedOperational(10_000)]
+		fn set_uncles(origin, new_uncles: Vec<T::Header>) -> DispatchResult {
+			ensure_none(origin)?;
+
+			if <Self as Store>::DidSetUncles::get() {
+				return Err("Uncles already set in block.");
+			}
+			<Self as Store>::DidSetUncles::put(true);
+
+			Self::verify_and_import_uncles(new_uncles)
+		}
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Fetch the author of the block.
+	///
+	/// This is safe to invoke in `on_initialize` implementations, as well
+	/// as afterwards.
+	pub fn author() -> T::AccountId {
+		// Check the memoized storage value.
+		if let Some(author) = <Self as Store>::Author::get() {
+			return author;
+		}
+
+		let digest = <system::Module<T>>::digest();
+		let pre_runtime_digests = digest.logs.iter().filter_map(|d| d.as_pre_runtime());
+		if let Some(author) = T::FindAuthor::find_author(pre_runtime_digests) {
+			<Self as Store>::Author::put(&author);
+			author
+		} else {
+			Default::default()
+		}
+	}
+
+	fn verify_and_import_uncles(new_uncles: Vec<T::Header>) -> DispatchResult {
+		let now = <system::Module<T>>::block_number();
+
+		let mut uncles = <Self as Store>::Uncles::get();
+		uncles.push(UncleEntryItem::InclusionHeight(now));
+
+		let mut acc: <T::FilterUncle as FilterUncle<_, _>>::Accumulator = Default::default();
+
+		for uncle in new_uncles {
+			let prev_uncles = uncles.iter().filter_map(|entry|
+				match entry {
+					UncleEntryItem::InclusionHeight(_) => None,
+					UncleEntryItem::Uncle(h, _) => Some(h),
+				});
+			let author = Self::verify_uncle(&uncle, prev_uncles, &mut acc)?;
+			let hash = uncle.hash();
+
+			T::EventHandler::note_uncle(
+				author.clone().unwrap_or_default(),
+				now - uncle.number().clone(),
+			);
+			uncles.push(UncleEntryItem::Uncle(hash, author));
+		}
+
+		<Self as Store>::Uncles::put(&uncles);
+		Ok(())
+	}
+
+	fn verify_uncle<'a, I: IntoIterator<Item=&'a T::Hash>>(
+		uncle: &T::Header,
+		existing_uncles: I,
+		accumulator: &mut <T::FilterUncle as FilterUncle<T::Header, T::AccountId>>::Accumulator,
+	) -> Result<Option<T::AccountId>, &'static str>
+	{
+		let now = <system::Module<T>>::block_number();
+
+		let (minimum_height, maximum_height) = {
+			let uncle_generations = T::UncleGenerations::get();
+			let min = if now >= uncle_generations {
+				now - uncle_generations
+			} else {
+				Zero::zero()
+			};
+
+			(min, now)
+		};
+
+		let hash = uncle.hash();
+
+		if uncle.number() < &One::one() {
+			return Err("uncle is genesis");
+		}
+
+		if uncle.number() > &maximum_height {
+			return Err("uncle is too high in chain");
+		}
+
+		{
+			let parent_number = uncle.number().clone() - One::one();
+			let parent_hash = <system::Module<T>>::block_hash(&parent_number);
+			if &parent_hash != uncle.parent_hash() {
+				return Err("uncle parent not in chain");
+			}
+		}
+
+		if uncle.number() < &minimum_height {
+			return Err("uncle not recent enough to be included");
+		}
+
+		let duplicate = existing_uncles.into_iter().find(|h| **h == hash).is_some();
+		let in_chain = <system::Module<T>>::block_hash(uncle.number()) == hash;
+
+		if duplicate || in_chain {
+			return Err("uncle already included")
+		}
+
+		// check uncle validity.
+		T::FilterUncle::filter_uncle(&uncle, accumulator)
+	}
+
+	fn prune_old_uncles(minimum_height: T::BlockNumber) {
+		let mut uncles = <Self as Store>::Uncles::get();
+		let prune_entries = uncles.iter().take_while(|item| match item {
+			UncleEntryItem::Uncle(_, _) => true,
+			UncleEntryItem::InclusionHeight(height) => height < &minimum_height,
+		});
+		let prune_index = prune_entries.count();
+
+		let _ = uncles.drain(..prune_index);
+		<Self as Store>::Uncles::put(uncles);
+	}
+}
+
+impl<T: Trait> ProvideInherent for Module<T> {
+	type Call = Call<T>;
+	type Error = MakeFatalError<()>;
+	const INHERENT_IDENTIFIER: InherentIdentifier = INHERENT_IDENTIFIER;
+
+	fn create_inherent(data: &InherentData) -> Option<Self::Call> {
+		let uncles = data.uncles().unwrap_or_default();
+		let mut set_uncles = Vec::new();
+
+		if !uncles.is_empty() {
+			let prev_uncles = <Self as Store>::Uncles::get();
+			let mut existing_hashes: Vec<_> = prev_uncles.into_iter().filter_map(|entry|
+				match entry {
+					UncleEntryItem::InclusionHeight(_) => None,
+					UncleEntryItem::Uncle(h, _) => Some(h),
+				}
+			).collect();
+
+			let mut acc: <T::FilterUncle as FilterUncle<_, _>>::Accumulator = Default::default();
+
+			for uncle in uncles {
+				match Self::verify_uncle(&uncle, &existing_hashes, &mut acc) {
+					Ok(_) => {
+						let hash = uncle.hash();
+						set_uncles.push(uncle);
+						existing_hashes.push(hash);
+					}
+					Err(_) => {
+						// skip this uncle
+					}
+				}
+			}
+		}
+
+		if set_uncles.is_empty() {
+			None
+		} else {
+			Some(Call::set_uncles(set_uncles))
+		}
+	}
+
+	fn check_inherent(_call: &Self::Call, _data: &InherentData) -> result::Result<(), Self::Error> {
+		Ok(())
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use primitives::H256;
+	use sr_primitives::{
+		traits::{BlakeTwo256, IdentityLookup}, testing::Header, generic::DigestItem, Perbill,
+	};
+	use support::{parameter_types, impl_outer_origin, ConsensusEngineId};
+
+	impl_outer_origin!{
+		pub enum Origin for Test {}
+	}
+
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Call = ();
+		type Hash = H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+
+	parameter_types! {
+		pub const UncleGenerations: u64 = 5;
+	}
+
+	impl Trait for Test {
+		type FindAuthor = AuthorGiven;
+		type UncleGenerations = UncleGenerations;
+		type FilterUncle = SealVerify<VerifyBlock>;
+		type EventHandler = ();
+	}
+
+	type System = system::Module<Test>;
+	type Authorship = Module<Test>;
+
+	const TEST_ID: ConsensusEngineId = [1, 2, 3, 4];
+
+	pub struct AuthorGiven;
+
+	impl FindAuthor<u64> for AuthorGiven {
+		fn find_author<'a, I>(digests: I) -> Option<u64>
+			where I: 'a + IntoIterator<Item=(ConsensusEngineId, &'a [u8])>
+		{
+			for (id, data) in digests {
+				if id == TEST_ID {
+					return u64::decode(&mut &data[..]).ok();
+				}
+			}
+
+			None
+		}
+	}
+
+	pub struct VerifyBlock;
+
+	impl VerifySeal<Header, u64> for VerifyBlock {
+		fn verify_seal(header: &Header) -> Result<Option<u64>, &'static str> {
+			let pre_runtime_digests = header.digest.logs.iter().filter_map(|d| d.as_pre_runtime());
+			let seals = header.digest.logs.iter().filter_map(|d| d.as_seal());
+
+			let author = match AuthorGiven::find_author(pre_runtime_digests) {
+				None => return Err("no author"),
+				Some(author) => author,
+			};
+
+			for (id, seal) in seals {
+				if id == TEST_ID {
+					match u64::decode(&mut &seal[..]) {
+						Err(_) => return Err("wrong seal"),
+						Ok(a) => {
+							if a != author {
+								return Err("wrong author in seal");
+							}
+							break
+						}
+					}
+				}
+			}
+
+			Ok(Some(author))
+		}
+	}
+
+	fn seal_header(mut header: Header, author: u64) -> Header {
+		{
+			let digest = header.digest_mut();
+			digest.logs.push(DigestItem::PreRuntime(TEST_ID, author.encode()));
+			digest.logs.push(DigestItem::Seal(TEST_ID, author.encode()));
+		}
+
+		header
+	}
+
+	fn create_header(number: u64, parent_hash: H256, state_root: H256) -> Header {
+		Header::new(
+			number,
+			Default::default(),
+			state_root,
+			parent_hash,
+			Default::default(),
+		)
+	}
+
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn prune_old_uncles_works() {
+		use UncleEntryItem::*;
+		new_test_ext().execute_with(|| {
+			let hash = Default::default();
+			let author = Default::default();
+			let uncles = vec![
+				InclusionHeight(1u64), Uncle(hash, Some(author)), Uncle(hash, None), Uncle(hash, None),
+				InclusionHeight(2u64), Uncle(hash, None),
+				InclusionHeight(3u64), Uncle(hash, None),
+			];
+
+			<Authorship as Store>::Uncles::put(uncles);
+			Authorship::prune_old_uncles(3);
+
+			let uncles = <Authorship as Store>::Uncles::get();
+			assert_eq!(uncles, vec![InclusionHeight(3u64), Uncle(hash, None)]);
+		})
+	}
+
+	#[test]
+	fn rejects_bad_uncles() {
+		new_test_ext().execute_with(|| {
+			let author_a = 69;
+
+			struct CanonChain {
+				inner: Vec<Header>,
+			}
+
+			impl CanonChain {
+				fn best_hash(&self) -> H256 {
+					self.inner.last().unwrap().hash()
+				}
+
+				fn canon_hash(&self, index: usize) -> H256 {
+					self.inner[index].hash()
+				}
+
+				fn header(&self, index: usize) -> &Header {
+					&self.inner[index]
+				}
+
+				fn push(&mut self, header: Header) {
+					self.inner.push(header)
+				}
+			}
+
+			let mut canon_chain = CanonChain {
+				inner: vec![seal_header(create_header(0, Default::default(), Default::default()), 999)],
+			};
+
+			for number in 1..8 {
+				System::initialize(&number, &canon_chain.best_hash(), &Default::default(), &Default::default());
+				let header = seal_header(System::finalize(), author_a);
+				canon_chain.push(header);
+			}
+
+			// initialize so system context is set up correctly.
+			System::initialize(&8, &canon_chain.best_hash(), &Default::default(), &Default::default());
+
+			// 2 of the same uncle at once
+			{
+				let uncle_a = seal_header(
+					create_header(3, canon_chain.canon_hash(2), [1; 32].into()),
+					author_a,
+				);
+				assert_eq!(
+					Authorship::verify_and_import_uncles(vec![uncle_a.clone(), uncle_a.clone()]),
+					Err("uncle already included"),
+				);
+			}
+
+			// 2 of the same uncle at different times.
+			{
+				let uncle_a = seal_header(
+					create_header(3, canon_chain.canon_hash(2), [1; 32].into()),
+					author_a,
+				);
+
+				assert!(Authorship::verify_and_import_uncles(vec![uncle_a.clone()]).is_ok());
+
+				assert_eq!(
+					Authorship::verify_and_import_uncles(vec![uncle_a.clone()]),
+					Err("uncle already included"),
+				);
+			}
+
+			// same uncle as ancestor.
+			{
+				let uncle_clone = canon_chain.header(5).clone();
+
+				assert_eq!(
+					Authorship::verify_and_import_uncles(vec![uncle_clone]),
+					Err("uncle already included"),
+				);
+			}
+
+			// uncle without valid seal.
+			{
+				let unsealed = create_header(3, canon_chain.canon_hash(2), [2; 32].into());
+				assert_eq!(
+					Authorship::verify_and_import_uncles(vec![unsealed]),
+					Err("no author"),
+				);
+			}
+
+			// old uncles can't get in.
+			{
+				assert_eq!(System::block_number(), 8);
+
+				let gen_2 = seal_header(
+					create_header(2, canon_chain.canon_hash(1), [3; 32].into()),
+					author_a,
+				);
+
+				assert_eq!(
+					Authorship::verify_and_import_uncles(vec![gen_2]),
+					Err("uncle not recent enough to be included"),
+				);
+			}
+
+			// siblings are also allowed
+			{
+				let other_8 = seal_header(
+					create_header(8, canon_chain.canon_hash(7), [1; 32].into()),
+					author_a,
+				);
+
+				assert!(Authorship::verify_and_import_uncles(vec![other_8]).is_ok());
+			}
+		});
+	}
+
+	#[test]
+	fn sets_author_lazily() {
+		new_test_ext().execute_with(|| {
+			let author = 42;
+			let mut header = seal_header(
+				create_header(1, Default::default(), [1; 32].into()),
+				author,
+			);
+
+			header.digest_mut().pop(); // pop the seal off.
+			System::initialize(&1, &Default::default(), &Default::default(), header.digest());
+
+			assert_eq!(Authorship::author(), author);
+		});
+	}
+
+	#[test]
+	fn one_uncle_per_author_per_number() {
+		type Filter = OnePerAuthorPerHeight<VerifyBlock, u64>;
+
+		let author_a = 42;
+		let author_b = 43;
+
+		let mut acc: <Filter as FilterUncle<Header, u64>>::Accumulator = Default::default();
+		let header_a1 = seal_header(
+			create_header(1, Default::default(), [1; 32].into()),
+			author_a,
+		);
+		let header_b1 = seal_header(
+			create_header(1, Default::default(), [1; 32].into()),
+			author_b,
+		);
+
+		let header_a2_1 = seal_header(
+			create_header(2, Default::default(), [1; 32].into()),
+			author_a,
+		);
+		let header_a2_2 = seal_header(
+			create_header(2, Default::default(), [2; 32].into()),
+			author_a,
+		);
+
+		let mut check_filter = move |uncle| {
+			Filter::filter_uncle(uncle, &mut acc)
+		};
+
+		// same height, different author is OK.
+		assert_eq!(check_filter(&header_a1), Ok(Some(author_a)));
+		assert_eq!(check_filter(&header_b1), Ok(Some(author_b)));
+
+		// same author, different height.
+		assert_eq!(check_filter(&header_a2_1), Ok(Some(author_a)));
+
+		// same author, same height (author a, height 2)
+		assert!(check_filter(&header_a2_2).is_err());
+	}
+}

substrate/frame/babe/Cargo.toml

@@ -0,0 +1,46 @@
+[package]
+name = "pallet-babe"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+hex-literal = "0.2.1"
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true }
+inherents = { package = "substrate-inherents", path = "../../primitives/inherents", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+timestamp = { package = "pallet-timestamp", path = "../timestamp", default-features = false }
+sp-timestamp = { path = "../../primitives/timestamp", default-features = false }
+session = { package = "pallet-session", path = "../session", default-features = false }
+babe-primitives = { package = "substrate-consensus-babe-primitives", path = "../../primitives/consensus/babe", default-features = false }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+
+[dev-dependencies]
+lazy_static = "1.4.0"
+parking_lot = "0.9.0"
+sr-version = { path = "../../primitives/sr-version", default-features = false }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+test-runtime = { package = "substrate-test-runtime", path = "../../test/utils/runtime" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"rstd/std",
+	"support/std",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"system/std",
+	"timestamp/std",
+	"sp-timestamp/std",
+	"inherents/std",
+	"babe-primitives/std",
+	"session/std",
+	"runtime-io/std",
+]

substrate/frame/babe/src/lib.rs

@@ -0,0 +1,553 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Consensus extension module for BABE consensus. Collects on-chain randomness
+//! from VRF outputs and manages epoch transitions.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+#![forbid(unused_must_use, unsafe_code, unused_variables, unused_must_use)]
+#![deny(unused_imports)]
+pub use timestamp;
+use sp_timestamp;
+
+use rstd::{result, prelude::*};
+use support::{decl_storage, decl_module, traits::FindAuthor, traits::Get};
+use sp_timestamp::OnTimestampSet;
+use sr_primitives::{generic::DigestItem, ConsensusEngineId, Perbill};
+use sr_primitives::traits::{IsMember, SaturatedConversion, Saturating, RandomnessBeacon};
+use sr_staking_primitives::{
+	SessionIndex,
+	offence::{Offence, Kind},
+};
+
+use codec::{Encode, Decode};
+use inherents::{InherentIdentifier, InherentData, ProvideInherent, MakeFatalError};
+use babe_primitives::{
+	BABE_ENGINE_ID, ConsensusLog, BabeAuthorityWeight, NextEpochDescriptor, RawBabePreDigest,
+	SlotNumber, inherents::{INHERENT_IDENTIFIER, BabeInherentData}
+};
+pub use babe_primitives::{AuthorityId, VRF_OUTPUT_LENGTH, PUBLIC_KEY_LENGTH};
+
+#[cfg(all(feature = "std", test))]
+mod tests;
+
+#[cfg(all(feature = "std", test))]
+mod mock;
+
+pub trait Trait: timestamp::Trait {
+	/// The amount of time, in slots, that each epoch should last.
+	type EpochDuration: Get<SlotNumber>;
+
+	/// The expected average block time at which BABE should be creating
+	/// blocks. Since BABE is probabilistic it is not trivial to figure out
+	/// what the expected average block time should be based on the slot
+	/// duration and the security parameter `c` (where `1 - c` represents
+	/// the probability of a slot being empty).
+	type ExpectedBlockTime: Get<Self::Moment>;
+
+	/// BABE requires some logic to be triggered on every block to query for whether an epoch
+	/// has ended and to perform the transition to the next epoch.
+	///
+	/// Typically, the `ExternalTrigger` type should be used. An internal trigger should only be used
+	/// when no other module is responsible for changing authority set.
+	type EpochChangeTrigger: EpochChangeTrigger;
+}
+
+/// Trigger an epoch change, if any should take place.
+pub trait EpochChangeTrigger {
+	/// Trigger an epoch change, if any should take place. This should be called
+	/// during every block, after initialization is done.
+	fn trigger<T: Trait>(now: T::BlockNumber);
+}
+
+/// A type signifying to BABE that an external trigger
+/// for epoch changes (e.g. pallet-session) is used.
+pub struct ExternalTrigger;
+
+impl EpochChangeTrigger for ExternalTrigger {
+	fn trigger<T: Trait>(_: T::BlockNumber) { } // nothing - trigger is external.
+}
+
+/// A type signifying to BABE that it should perform epoch changes
+/// with an internal trigger, recycling the same authorities forever.
+pub struct SameAuthoritiesForever;
+
+impl EpochChangeTrigger for SameAuthoritiesForever {
+	fn trigger<T: Trait>(now: T::BlockNumber) {
+		if <Module<T>>::should_epoch_change(now) {
+			let authorities = <Module<T>>::authorities();
+			let next_authorities = authorities.clone();
+
+			<Module<T>>::enact_epoch_change(authorities, next_authorities);
+		}
+	}
+}
+
+/// The length of the BABE randomness
+pub const RANDOMNESS_LENGTH: usize = 32;
+
+const UNDER_CONSTRUCTION_SEGMENT_LENGTH: usize = 256;
+
+type MaybeVrf = Option<[u8; 32 /* VRF_OUTPUT_LENGTH */]>;
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Babe {
+		/// Current epoch index.
+		pub EpochIndex get(fn epoch_index): u64;
+
+		/// Current epoch authorities.
+		pub Authorities get(fn authorities): Vec<(AuthorityId, BabeAuthorityWeight)>;
+
+		/// The slot at which the first epoch actually started. This is 0
+		/// until the first block of the chain.
+		pub GenesisSlot get(fn genesis_slot): u64;
+
+		/// Current slot number.
+		pub CurrentSlot get(fn current_slot): u64;
+
+		/// The epoch randomness for the *current* epoch.
+		///
+		/// # Security
+		///
+		/// This MUST NOT be used for gambling, as it can be influenced by a
+		/// malicious validator in the short term. It MAY be used in many
+		/// cryptographic protocols, however, so long as one remembers that this
+		/// (like everything else on-chain) it is public. For example, it can be
+		/// used where a number is needed that cannot have been chosen by an
+		/// adversary, for purposes such as public-coin zero-knowledge proofs.
+		// NOTE: the following fields don't use the constants to define the
+		// array size because the metadata API currently doesn't resolve the
+		// variable to its underlying value.
+		pub Randomness get(fn randomness): [u8; 32 /* RANDOMNESS_LENGTH */];
+
+		/// Next epoch randomness.
+		NextRandomness: [u8; 32 /* RANDOMNESS_LENGTH */];
+
+		/// Randomness under construction.
+		///
+		/// We make a tradeoff between storage accesses and list length.
+		/// We store the under-construction randomness in segments of up to
+		/// `UNDER_CONSTRUCTION_SEGMENT_LENGTH`.
+		///
+		/// Once a segment reaches this length, we begin the next one.
+		/// We reset all segments and return to `0` at the beginning of every
+		/// epoch.
+		SegmentIndex build(|_| 0): u32;
+		UnderConstruction: map u32 => Vec<[u8; 32 /* VRF_OUTPUT_LENGTH */]>;
+
+		/// Temporary value (cleared at block finalization) which is `Some`
+		/// if per-block initialization has already been called for current block.
+		Initialized get(fn initialized): Option<MaybeVrf>;
+	}
+	add_extra_genesis {
+		config(authorities): Vec<(AuthorityId, BabeAuthorityWeight)>;
+		build(|config| Module::<T>::initialize_authorities(&config.authorities))
+	}
+}
+
+decl_module! {
+	/// The BABE SRML module
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		/// The number of **slots** that an epoch takes. We couple sessions to
+		/// epochs, i.e. we start a new session once the new epoch begins.
+		const EpochDuration: u64 = T::EpochDuration::get();
+
+		/// The expected average block time at which BABE should be creating
+		/// blocks. Since BABE is probabilistic it is not trivial to figure out
+		/// what the expected average block time should be based on the slot
+		/// duration and the security parameter `c` (where `1 - c` represents
+		/// the probability of a slot being empty).
+		const ExpectedBlockTime: T::Moment = T::ExpectedBlockTime::get();
+
+		/// Initialization
+		fn on_initialize(now: T::BlockNumber) {
+			Self::do_initialize(now);
+		}
+
+		/// Block finalization
+		fn on_finalize() {
+			// at the end of the block, we can safely include the new VRF output
+			// from this block into the under-construction randomness. If we've determined
+			// that this block was the first in a new epoch, the changeover logic has
+			// already occurred at this point, so the under-construction randomness
+			// will only contain outputs from the right epoch.
+			if let Some(Some(vrf_output)) = Initialized::take() {
+				Self::deposit_vrf_output(&vrf_output);
+			}
+		}
+	}
+}
+
+impl<T: Trait> RandomnessBeacon for Module<T> {
+	fn random() -> [u8; VRF_OUTPUT_LENGTH] {
+		Self::randomness()
+	}
+}
+
+/// A BABE public key
+pub type BabeKey = [u8; PUBLIC_KEY_LENGTH];
+
+impl<T: Trait> FindAuthor<u32> for Module<T> {
+	fn find_author<'a, I>(digests: I) -> Option<u32> where
+		I: 'a + IntoIterator<Item=(ConsensusEngineId, &'a [u8])>
+	{
+		for (id, mut data) in digests.into_iter() {
+			if id == BABE_ENGINE_ID {
+				let pre_digest = RawBabePreDigest::decode(&mut data).ok()?;
+				return Some(match pre_digest {
+					RawBabePreDigest::Primary { authority_index, .. } =>
+						authority_index,
+					RawBabePreDigest::Secondary { authority_index, .. } =>
+						authority_index,
+				});
+			}
+		}
+
+		return None;
+	}
+}
+
+impl<T: Trait> IsMember<AuthorityId> for Module<T> {
+	fn is_member(authority_id: &AuthorityId) -> bool {
+		<Module<T>>::authorities()
+			.iter()
+			.any(|id| &id.0 == authority_id)
+	}
+}
+
+impl<T: Trait> session::ShouldEndSession<T::BlockNumber> for Module<T> {
+	fn should_end_session(now: T::BlockNumber) -> bool {
+		// it might be (and it is in current implementation) that session module is calling
+		// should_end_session() from it's own on_initialize() handler
+		// => because session on_initialize() is called earlier than ours, let's ensure
+		// that we have synced with digest before checking if session should be ended.
+		Self::do_initialize(now);
+
+		Self::should_epoch_change(now)
+	}
+}
+
+// TODO [slashing]: @marcio use this, remove the dead_code annotation.
+/// A BABE equivocation offence report.
+///
+/// When a validator released two or more blocks at the same slot.
+#[allow(dead_code)]
+struct BabeEquivocationOffence<FullIdentification> {
+	/// A babe slot number in which this incident happened.
+	slot: u64,
+	/// The session index in which the incident happened.
+	session_index: SessionIndex,
+	/// The size of the validator set at the time of the offence.
+	validator_set_count: u32,
+	/// The authority that produced the equivocation.
+	offender: FullIdentification,
+}
+
+impl<FullIdentification: Clone> Offence<FullIdentification> for BabeEquivocationOffence<FullIdentification> {
+	const ID: Kind = *b"babe:equivocatio";
+	type TimeSlot = u64;
+
+	fn offenders(&self) -> Vec<FullIdentification> {
+		vec![self.offender.clone()]
+	}
+
+	fn session_index(&self) -> SessionIndex {
+		self.session_index
+	}
+
+	fn validator_set_count(&self) -> u32 {
+		self.validator_set_count
+	}
+
+	fn time_slot(&self) -> Self::TimeSlot {
+		self.slot
+	}
+
+	fn slash_fraction(
+		offenders_count: u32,
+		validator_set_count: u32,
+	) -> Perbill {
+		// the formula is min((3k / n)^2, 1)
+		let x = Perbill::from_rational_approximation(3 * offenders_count, validator_set_count);
+		// _ ^ 2
+		x.square()
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Determine the BABE slot duration based on the Timestamp module configuration.
+	pub fn slot_duration() -> T::Moment {
+		// we double the minimum block-period so each author can always propose within
+		// the majority of their slot.
+		<T as timestamp::Trait>::MinimumPeriod::get().saturating_mul(2.into())
+	}
+
+	/// Determine whether an epoch change should take place at this block.
+	/// Assumes that initialization has already taken place.
+	pub fn should_epoch_change(now: T::BlockNumber) -> bool {
+		// The epoch has technically ended during the passage of time
+		// between this block and the last, but we have to "end" the epoch now,
+		// since there is no earlier possible block we could have done it.
+		//
+		// The exception is for block 1: the genesis has slot 0, so we treat
+		// epoch 0 as having started at the slot of block 1. We want to use
+		// the same randomness and validator set as signalled in the genesis,
+		// so we don't rotate the epoch.
+		now != sr_primitives::traits::One::one() && {
+			let diff = CurrentSlot::get().saturating_sub(Self::current_epoch_start());
+			diff >= T::EpochDuration::get()
+		}
+	}
+
+	/// DANGEROUS: Enact an epoch change. Should be done on every block where `should_epoch_change` has returned `true`,
+	/// and the caller is the only caller of this function.
+	///
+	/// Typically, this is not handled directly by the user, but by higher-level validator-set manager logic like
+	/// `pallet-session`.
+	pub fn enact_epoch_change(
+		authorities: Vec<(AuthorityId, BabeAuthorityWeight)>,
+		next_authorities: Vec<(AuthorityId, BabeAuthorityWeight)>,
+	) {
+		// PRECONDITION: caller has done initialization and is guaranteed
+		// by the session module to be called before this.
+		#[cfg(debug_assertions)]
+		{
+			assert!(Self::initialized().is_some())
+		}
+
+		// Update epoch index
+		let epoch_index = EpochIndex::get()
+			.checked_add(1)
+			.expect("epoch indices will never reach 2^64 before the death of the universe; qed");
+
+		EpochIndex::put(epoch_index);
+		Authorities::put(authorities);
+
+		// Update epoch randomness.
+		let next_epoch_index = epoch_index
+			.checked_add(1)
+			.expect("epoch indices will never reach 2^64 before the death of the universe; qed");
+
+		// Returns randomness for the current epoch and computes the *next*
+		// epoch randomness.
+		let randomness = Self::randomness_change_epoch(next_epoch_index);
+		Randomness::put(randomness);
+
+		// After we update the current epoch, we signal the *next* epoch change
+		// so that nodes can track changes.
+		let next_randomness = NextRandomness::get();
+
+		let next = NextEpochDescriptor {
+			authorities: next_authorities,
+			randomness: next_randomness,
+		};
+
+		Self::deposit_consensus(ConsensusLog::NextEpochData(next))
+	}
+
+	// finds the start slot of the current epoch. only guaranteed to
+	// give correct results after `do_initialize` of the first block
+	// in the chain (as its result is based off of `GenesisSlot`).
+	fn current_epoch_start() -> SlotNumber {
+		(EpochIndex::get() * T::EpochDuration::get()) + GenesisSlot::get()
+	}
+
+	fn deposit_consensus<U: Encode>(new: U) {
+		let log: DigestItem<T::Hash> = DigestItem::Consensus(BABE_ENGINE_ID, new.encode());
+		<system::Module<T>>::deposit_log(log.into())
+	}
+
+	fn deposit_vrf_output(vrf_output: &[u8; VRF_OUTPUT_LENGTH]) {
+		let segment_idx = <SegmentIndex>::get();
+		let mut segment = <UnderConstruction>::get(&segment_idx);
+		if segment.len() < UNDER_CONSTRUCTION_SEGMENT_LENGTH {
+			// push onto current segment: not full.
+			segment.push(*vrf_output);
+			<UnderConstruction>::insert(&segment_idx, &segment);
+		} else {
+			// move onto the next segment and update the index.
+			let segment_idx = segment_idx + 1;
+			<UnderConstruction>::insert(&segment_idx, &vec![*vrf_output]);
+			<SegmentIndex>::put(&segment_idx);
+		}
+	}
+
+	fn do_initialize(now: T::BlockNumber) {
+		// since do_initialize can be called twice (if session module is present)
+		// => let's ensure that we only modify the storage once per block
+		let initialized = Self::initialized().is_some();
+		if initialized {
+			return;
+		}
+
+		let maybe_pre_digest = <system::Module<T>>::digest()
+			.logs
+			.iter()
+			.filter_map(|s| s.as_pre_runtime())
+			.filter_map(|(id, mut data)| if id == BABE_ENGINE_ID {
+				RawBabePreDigest::decode(&mut data).ok()
+			} else {
+				None
+			})
+			.next();
+
+		let maybe_vrf = maybe_pre_digest.and_then(|digest| {
+			// on the first non-zero block (i.e. block #1)
+			// this is where the first epoch (epoch #0) actually starts.
+			// we need to adjust internal storage accordingly.
+			if GenesisSlot::get() == 0 {
+				GenesisSlot::put(digest.slot_number());
+				debug_assert_ne!(GenesisSlot::get(), 0);
+
+				// deposit a log because this is the first block in epoch #0
+				// we use the same values as genesis because we haven't collected any
+				// randomness yet.
+				let next = NextEpochDescriptor {
+					authorities: Self::authorities(),
+					randomness: Self::randomness(),
+				};
+
+				Self::deposit_consensus(ConsensusLog::NextEpochData(next))
+			}
+
+			CurrentSlot::put(digest.slot_number());
+
+			if let RawBabePreDigest::Primary { vrf_output, .. } = digest {
+				// place the VRF output into the `Initialized` storage item
+				// and it'll be put onto the under-construction randomness
+				// later, once we've decided which epoch this block is in.
+				Some(vrf_output)
+			} else {
+				None
+			}
+		});
+
+		Initialized::put(maybe_vrf);
+
+		// enact epoch change, if necessary.
+		T::EpochChangeTrigger::trigger::<T>(now)
+	}
+
+	/// Call this function exactly once when an epoch changes, to update the
+	/// randomness. Returns the new randomness.
+	fn randomness_change_epoch(next_epoch_index: u64) -> [u8; RANDOMNESS_LENGTH] {
+		let this_randomness = NextRandomness::get();
+		let segment_idx: u32 = <SegmentIndex>::mutate(|s| rstd::mem::replace(s, 0));
+
+		// overestimate to the segment being full.
+		let rho_size = segment_idx.saturating_add(1) as usize * UNDER_CONSTRUCTION_SEGMENT_LENGTH;
+
+		let next_randomness = compute_randomness(
+			this_randomness,
+			next_epoch_index,
+			(0..segment_idx).flat_map(|i| <UnderConstruction>::take(&i)),
+			Some(rho_size),
+		);
+		NextRandomness::put(&next_randomness);
+		this_randomness
+	}
+
+	fn initialize_authorities(authorities: &[(AuthorityId, BabeAuthorityWeight)]) {
+		if !authorities.is_empty() {
+			assert!(Authorities::get().is_empty(), "Authorities are already initialized!");
+			Authorities::put(authorities);
+		}
+	}
+}
+
+impl<T: Trait> OnTimestampSet<T::Moment> for Module<T> {
+	fn on_timestamp_set(_moment: T::Moment) { }
+}
+
+impl<T: Trait> sr_primitives::BoundToRuntimeAppPublic for Module<T> {
+	type Public = AuthorityId;
+}
+
+impl<T: Trait> session::OneSessionHandler<T::AccountId> for Module<T> {
+	type Key = AuthorityId;
+
+	fn on_genesis_session<'a, I: 'a>(validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, AuthorityId)>
+	{
+		let authorities = validators.map(|(_, k)| (k, 1)).collect::<Vec<_>>();
+		Self::initialize_authorities(&authorities);
+	}
+
+	fn on_new_session<'a, I: 'a>(_changed: bool, validators: I, queued_validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, AuthorityId)>
+	{
+		let authorities = validators.map(|(_account, k)| {
+			(k, 1)
+		}).collect::<Vec<_>>();
+
+		let next_authorities = queued_validators.map(|(_account, k)| {
+			(k, 1)
+		}).collect::<Vec<_>>();
+
+		Self::enact_epoch_change(authorities, next_authorities)
+	}
+
+	fn on_disabled(i: usize) {
+		Self::deposit_consensus(ConsensusLog::OnDisabled(i as u32))
+	}
+}
+
+// compute randomness for a new epoch. rho is the concatenation of all
+// VRF outputs in the prior epoch.
+//
+// an optional size hint as to how many VRF outputs there were may be provided.
+fn compute_randomness(
+	last_epoch_randomness: [u8; RANDOMNESS_LENGTH],
+	epoch_index: u64,
+	rho: impl Iterator<Item=[u8; VRF_OUTPUT_LENGTH]>,
+	rho_size_hint: Option<usize>,
+) -> [u8; RANDOMNESS_LENGTH] {
+	let mut s = Vec::with_capacity(40 + rho_size_hint.unwrap_or(0) * VRF_OUTPUT_LENGTH);
+	s.extend_from_slice(&last_epoch_randomness);
+	s.extend_from_slice(&epoch_index.to_le_bytes());
+
+	for vrf_output in rho {
+		s.extend_from_slice(&vrf_output[..]);
+	}
+
+	runtime_io::hashing::blake2_256(&s)
+}
+
+impl<T: Trait> ProvideInherent for Module<T> {
+	type Call = timestamp::Call<T>;
+	type Error = MakeFatalError<inherents::Error>;
+	const INHERENT_IDENTIFIER: InherentIdentifier = INHERENT_IDENTIFIER;
+
+	fn create_inherent(_: &InherentData) -> Option<Self::Call> {
+		None
+	}
+
+	fn check_inherent(call: &Self::Call, data: &InherentData) -> result::Result<(), Self::Error> {
+		let timestamp = match call {
+			timestamp::Call::set(ref timestamp) => timestamp.clone(),
+			_ => return Ok(()),
+		};
+
+		let timestamp_based_slot = (timestamp / Self::slot_duration()).saturated_into::<u64>();
+		let seal_slot = data.babe_inherent_data()?;
+
+		if timestamp_based_slot == seal_slot {
+			Ok(())
+		} else {
+			Err(inherents::Error::from("timestamp set in block doesn't match slot in seal").into())
+		}
+	}
+}

substrate/frame/babe/src/mock.rs

@@ -0,0 +1,109 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+#![allow(dead_code, unused_imports)]
+
+use super::{Trait, Module, GenesisConfig};
+use babe_primitives::AuthorityId;
+use sr_primitives::{
+	traits::IdentityLookup, Perbill, testing::{Header, UintAuthorityId}, impl_opaque_keys,
+};
+use sr_version::RuntimeVersion;
+use support::{impl_outer_origin, parameter_types};
+use runtime_io;
+use primitives::{H256, Blake2Hasher};
+
+impl_outer_origin!{
+	pub enum Origin for Test {}
+}
+
+type DummyValidatorId = u64;
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Test;
+
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+	pub const MinimumPeriod: u64 = 1;
+	pub const EpochDuration: u64 = 3;
+	pub const ExpectedBlockTime: u64 = 1;
+	pub const Version: RuntimeVersion = test_runtime::VERSION;
+	pub const DisabledValidatorsThreshold: Perbill = Perbill::from_percent(16);
+}
+
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Version = Version;
+	type Hashing = sr_primitives::traits::BlakeTwo256;
+	type AccountId = DummyValidatorId;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type MaximumBlockLength = MaximumBlockLength;
+}
+
+impl_opaque_keys! {
+	pub struct MockSessionKeys {
+		pub dummy: UintAuthorityId,
+	}
+}
+
+impl session::Trait for Test {
+	type Event = ();
+	type ValidatorId = <Self as system::Trait>::AccountId;
+	type ShouldEndSession = Babe;
+	type SessionHandler = (Babe,Babe,);
+	type OnSessionEnding = ();
+	type ValidatorIdOf = ();
+	type SelectInitialValidators = ();
+	type Keys = MockSessionKeys;
+	type DisabledValidatorsThreshold = DisabledValidatorsThreshold;
+}
+
+impl timestamp::Trait for Test {
+	type Moment = u64;
+	type OnTimestampSet = Babe;
+	type MinimumPeriod = MinimumPeriod;
+}
+
+impl Trait for Test {
+	type EpochDuration = EpochDuration;
+	type ExpectedBlockTime = ExpectedBlockTime;
+	type EpochChangeTrigger = crate::ExternalTrigger;
+}
+
+pub fn new_test_ext(authorities: Vec<DummyValidatorId>) -> runtime_io::TestExternalities {
+	let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+	GenesisConfig {
+		authorities: authorities.into_iter().map(|a| (UintAuthorityId(a).to_public_key(), 1)).collect(),
+	}.assimilate_storage::<Test>(&mut t).unwrap();
+	t.into()
+}
+
+pub type System = system::Module<Test>;
+pub type Babe = Module<Test>;

substrate/frame/babe/src/tests.rs

@@ -0,0 +1,126 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Consensus extension module tests for BABE consensus.
+
+use super::*;
+use mock::{new_test_ext, Babe, Test};
+use sr_primitives::{traits::OnFinalize, testing::{Digest, DigestItem}};
+use session::ShouldEndSession;
+
+const EMPTY_RANDOMNESS: [u8; 32] = [
+	74, 25, 49, 128, 53, 97, 244, 49,
+	222, 202, 176, 2, 231, 66, 95, 10,
+	133, 49, 213, 228, 86, 161, 164, 127,
+	217, 153, 138, 37, 48, 192, 248, 0,
+];
+
+fn make_pre_digest(
+	authority_index: babe_primitives::AuthorityIndex,
+	slot_number: babe_primitives::SlotNumber,
+	vrf_output: [u8; babe_primitives::VRF_OUTPUT_LENGTH],
+	vrf_proof: [u8; babe_primitives::VRF_PROOF_LENGTH],
+) -> Digest {
+	let digest_data = babe_primitives::RawBabePreDigest::Primary {
+		authority_index,
+		slot_number,
+		vrf_output,
+		vrf_proof,
+	};
+	let log = DigestItem::PreRuntime(babe_primitives::BABE_ENGINE_ID, digest_data.encode());
+	Digest { logs: vec![log] }
+}
+
+#[test]
+fn empty_randomness_is_correct() {
+	let s = compute_randomness([0; RANDOMNESS_LENGTH], 0, std::iter::empty(), None);
+	assert_eq!(s, EMPTY_RANDOMNESS);
+}
+
+#[test]
+fn initial_values() {
+	new_test_ext(vec![0, 1, 2, 3]).execute_with(|| {
+		assert_eq!(Babe::authorities().len(), 4)
+	})
+}
+
+#[test]
+fn check_module() {
+	new_test_ext(vec![0, 1, 2, 3]).execute_with(|| {
+		assert!(!Babe::should_end_session(0), "Genesis does not change sessions");
+		assert!(!Babe::should_end_session(200000),
+			"BABE does not include the block number in epoch calculations");
+	})
+}
+
+type System = system::Module<Test>;
+
+#[test]
+fn first_block_epoch_zero_start() {
+	new_test_ext(vec![0, 1, 2, 3]).execute_with(|| {
+		let genesis_slot = 100;
+		let first_vrf = [1; 32];
+		let pre_digest = make_pre_digest(
+			0,
+			genesis_slot,
+			first_vrf,
+			[0xff; 64],
+		);
+
+		assert_eq!(Babe::genesis_slot(), 0);
+		System::initialize(&1, &Default::default(), &Default::default(), &pre_digest);
+
+		// see implementation of the function for details why: we issue an
+		// epoch-change digest but don't do it via the normal session mechanism.
+		assert!(!Babe::should_end_session(1));
+		assert_eq!(Babe::genesis_slot(), genesis_slot);
+		assert_eq!(Babe::current_slot(), genesis_slot);
+		assert_eq!(Babe::epoch_index(), 0);
+
+		Babe::on_finalize(1);
+		let header = System::finalize();
+
+		assert_eq!(SegmentIndex::get(), 0);
+		assert_eq!(UnderConstruction::get(0), vec![first_vrf]);
+		assert_eq!(Babe::randomness(), [0; 32]);
+		assert_eq!(NextRandomness::get(), [0; 32]);
+
+		assert_eq!(header.digest.logs.len(), 2);
+		assert_eq!(pre_digest.logs.len(), 1);
+		assert_eq!(header.digest.logs[0], pre_digest.logs[0]);
+
+		let authorities = Babe::authorities();
+		let consensus_log = babe_primitives::ConsensusLog::NextEpochData(
+			babe_primitives::NextEpochDescriptor {
+				authorities,
+				randomness: Babe::randomness(),
+			}
+		);
+		let consensus_digest = DigestItem::Consensus(BABE_ENGINE_ID, consensus_log.encode());
+
+		// first epoch descriptor has same info as last.
+		assert_eq!(header.digest.logs[1], consensus_digest.clone())
+	})
+}
+
+#[test]
+fn authority_index() {
+	new_test_ext(vec![0, 1, 2, 3]).execute_with(|| {
+		assert_eq!(
+			Babe::find_author((&[(BABE_ENGINE_ID, &[][..])]).into_iter().cloned()), None,
+			"Trivially invalid authorities are ignored")
+	})
+}

substrate/frame/balances/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "pallet-balances"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io" }
+primitives = { package = "substrate-primitives", path = "../../primitives/core" }
+transaction-payment = { package = "pallet-transaction-payment", path = "../transaction-payment" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"safe-mix/std",
+	"codec/std",
+	"rstd/std",
+	"support/std",
+	"sr-primitives/std",
+	"system/std",
+]

substrate/frame/balances/src/mock.rs

@@ -0,0 +1,188 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+use sr_primitives::{Perbill, traits::{ConvertInto, IdentityLookup}, testing::Header};
+use primitives::H256;
+use runtime_io;
+use support::{impl_outer_origin, parameter_types};
+use support::traits::Get;
+use support::weights::{Weight, DispatchInfo};
+use std::cell::RefCell;
+use crate::{GenesisConfig, Module, Trait};
+
+impl_outer_origin!{
+	pub enum Origin for Runtime {}
+}
+
+thread_local! {
+	pub(crate) static EXISTENTIAL_DEPOSIT: RefCell<u64> = RefCell::new(0);
+	static TRANSFER_FEE: RefCell<u64> = RefCell::new(0);
+	static CREATION_FEE: RefCell<u64> = RefCell::new(0);
+}
+
+pub struct ExistentialDeposit;
+impl Get<u64> for ExistentialDeposit {
+	fn get() -> u64 { EXISTENTIAL_DEPOSIT.with(|v| *v.borrow()) }
+}
+
+pub struct TransferFee;
+impl Get<u64> for TransferFee {
+	fn get() -> u64 { TRANSFER_FEE.with(|v| *v.borrow()) }
+}
+
+pub struct CreationFee;
+impl Get<u64> for CreationFee {
+	fn get() -> u64 { CREATION_FEE.with(|v| *v.borrow()) }
+}
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Runtime;
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Runtime {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = ::sr_primitives::traits::BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+parameter_types! {
+	pub const TransactionBaseFee: u64 = 0;
+	pub const TransactionByteFee: u64 = 1;
+}
+impl transaction_payment::Trait for Runtime {
+	type Currency = Module<Runtime>;
+	type OnTransactionPayment = ();
+	type TransactionBaseFee = TransactionBaseFee;
+	type TransactionByteFee = TransactionByteFee;
+	type WeightToFee = ConvertInto;
+	type FeeMultiplierUpdate = ();
+}
+impl Trait for Runtime {
+	type Balance = u64;
+	type OnFreeBalanceZero = ();
+	type OnNewAccount = ();
+	type Event = ();
+	type DustRemoval = ();
+	type TransferPayment = ();
+	type ExistentialDeposit = ExistentialDeposit;
+	type TransferFee = TransferFee;
+	type CreationFee = CreationFee;
+}
+
+pub struct ExtBuilder {
+	existential_deposit: u64,
+	transfer_fee: u64,
+	creation_fee: u64,
+	monied: bool,
+	vesting: bool,
+}
+impl Default for ExtBuilder {
+	fn default() -> Self {
+		Self {
+			existential_deposit: 0,
+			transfer_fee: 0,
+			creation_fee: 0,
+			monied: false,
+			vesting: false,
+		}
+	}
+}
+impl ExtBuilder {
+	pub fn existential_deposit(mut self, existential_deposit: u64) -> Self {
+		self.existential_deposit = existential_deposit;
+		self
+	}
+	#[allow(dead_code)]
+	pub fn transfer_fee(mut self, transfer_fee: u64) -> Self {
+		self.transfer_fee = transfer_fee;
+		self
+	}
+	pub fn creation_fee(mut self, creation_fee: u64) -> Self {
+		self.creation_fee = creation_fee;
+		self
+	}
+	pub fn monied(mut self, monied: bool) -> Self {
+		self.monied = monied;
+		if self.existential_deposit == 0 {
+			self.existential_deposit = 1;
+		}
+		self
+	}
+	pub fn vesting(mut self, vesting: bool) -> Self {
+		self.vesting = vesting;
+		self
+	}
+	pub fn set_associated_consts(&self) {
+		EXISTENTIAL_DEPOSIT.with(|v| *v.borrow_mut() = self.existential_deposit);
+		TRANSFER_FEE.with(|v| *v.borrow_mut() = self.transfer_fee);
+		CREATION_FEE.with(|v| *v.borrow_mut() = self.creation_fee);
+	}
+	pub fn build(self) -> runtime_io::TestExternalities {
+		self.set_associated_consts();
+		let mut t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+		GenesisConfig::<Runtime> {
+			balances: if self.monied {
+				vec![
+					(1, 10 * self.existential_deposit),
+					(2, 20 * self.existential_deposit),
+					(3, 30 * self.existential_deposit),
+					(4, 40 * self.existential_deposit),
+					(12, 10 * self.existential_deposit)
+				]
+			} else {
+				vec![]
+			},
+			vesting: if self.vesting && self.monied {
+				vec![
+					(1, 0, 10, 5 * self.existential_deposit),
+					(2, 10, 20, 0),
+					(12, 10, 20, 5 * self.existential_deposit)
+				]
+			} else {
+				vec![]
+			},
+		}.assimilate_storage(&mut t).unwrap();
+		t.into()
+	}
+}
+
+pub type System = system::Module<Runtime>;
+pub type Balances = Module<Runtime>;
+
+pub const CALL: &<Runtime as system::Trait>::Call = &();
+
+/// create a transaction info struct from weight. Handy to avoid building the whole struct.
+pub fn info_from_weight(w: Weight) -> DispatchInfo {
+	DispatchInfo { weight: w, ..Default::default() }
+}

substrate/frame/balances/src/tests.rs

@@ -0,0 +1,771 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the module.
+
+use super::*;
+use mock::{Balances, ExtBuilder, Runtime, System, info_from_weight, CALL};
+use sr_primitives::traits::SignedExtension;
+use support::{
+	assert_noop, assert_ok, assert_err,
+	traits::{LockableCurrency, LockIdentifier, WithdrawReason, WithdrawReasons,
+	Currency, ReservableCurrency, ExistenceRequirement::AllowDeath}
+};
+use transaction_payment::ChargeTransactionPayment;
+use system::RawOrigin;
+
+const ID_1: LockIdentifier = *b"1       ";
+const ID_2: LockIdentifier = *b"2       ";
+const ID_3: LockIdentifier = *b"3       ";
+
+#[test]
+fn basic_locking_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		assert_eq!(Balances::free_balance(&1), 10);
+		Balances::set_lock(ID_1, &1, 9, u64::max_value(), WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 5, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+	});
+}
+
+#[test]
+fn partial_locking_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 5, u64::max_value(), WithdrawReasons::all());
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn lock_removal_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, u64::max_value(), u64::max_value(), WithdrawReasons::all());
+		Balances::remove_lock(ID_1, &1);
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn lock_replacement_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, u64::max_value(), u64::max_value(), WithdrawReasons::all());
+		Balances::set_lock(ID_1, &1, 5, u64::max_value(), WithdrawReasons::all());
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn double_locking_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 5, u64::max_value(), WithdrawReasons::all());
+		Balances::set_lock(ID_2, &1, 5, u64::max_value(), WithdrawReasons::all());
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn combination_locking_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, u64::max_value(), 0, WithdrawReasons::none());
+		Balances::set_lock(ID_2, &1, 0, u64::max_value(), WithdrawReasons::none());
+		Balances::set_lock(ID_3, &1, 0, 0, WithdrawReasons::all());
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn lock_value_extension_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 5, u64::max_value(), WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		Balances::extend_lock(ID_1, &1, 2, u64::max_value(), WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		Balances::extend_lock(ID_1, &1, 8, u64::max_value(), WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 3, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+	});
+}
+
+#[test]
+fn lock_reasons_should_work() {
+	ExtBuilder::default()
+		.existential_deposit(1)
+		.monied(true)
+		.build()
+		.execute_with(|| {
+			Balances::set_lock(ID_1, &1, 10, u64::max_value(), WithdrawReason::Transfer.into());
+			assert_noop!(
+				<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath),
+				"account liquidity restrictions prevent withdrawal"
+			);
+			assert_ok!(<Balances as ReservableCurrency<_>>::reserve(&1, 1));
+			// NOTE: this causes a fee payment.
+			assert!(<ChargeTransactionPayment<Runtime> as SignedExtension>::pre_dispatch(
+				ChargeTransactionPayment::from(1),
+				&1,
+				CALL,
+				info_from_weight(1),
+				0,
+			).is_ok());
+
+			Balances::set_lock(ID_1, &1, 10, u64::max_value(), WithdrawReason::Reserve.into());
+			assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+			assert_noop!(
+				<Balances as ReservableCurrency<_>>::reserve(&1, 1),
+				"account liquidity restrictions prevent withdrawal"
+			);
+			assert!(<ChargeTransactionPayment<Runtime> as SignedExtension>::pre_dispatch(
+				ChargeTransactionPayment::from(1),
+				&1,
+				CALL,
+				info_from_weight(1),
+				0,
+			).is_ok());
+
+			Balances::set_lock(ID_1, &1, 10, u64::max_value(), WithdrawReason::TransactionPayment.into());
+			assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+			assert_ok!(<Balances as ReservableCurrency<_>>::reserve(&1, 1));
+			assert!(<ChargeTransactionPayment<Runtime> as SignedExtension>::pre_dispatch(
+				ChargeTransactionPayment::from(1),
+				&1,
+				CALL,
+				info_from_weight(1),
+				0,
+			).is_err());
+		});
+}
+
+#[test]
+fn lock_block_number_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 10, 2, WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+
+		System::set_block_number(2);
+		assert_ok!(<Balances as Currency<_>>::transfer(&1, &2, 1, AllowDeath));
+	});
+}
+
+#[test]
+fn lock_block_number_extension_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 10, 2, WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		Balances::extend_lock(ID_1, &1, 10, 1, WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		System::set_block_number(2);
+		Balances::extend_lock(ID_1, &1, 10, 8, WithdrawReasons::all());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 3, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+	});
+}
+
+#[test]
+fn lock_reasons_extension_should_work() {
+	ExtBuilder::default().existential_deposit(1).monied(true).build().execute_with(|| {
+		Balances::set_lock(ID_1, &1, 10, 10, WithdrawReason::Transfer.into());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		Balances::extend_lock(ID_1, &1, 10, 10, WithdrawReasons::none());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+		Balances::extend_lock(ID_1, &1, 10, 10, WithdrawReason::Reserve.into());
+		assert_noop!(
+			<Balances as Currency<_>>::transfer(&1, &2, 6, AllowDeath),
+			"account liquidity restrictions prevent withdrawal"
+		);
+	});
+}
+
+#[test]
+fn default_indexing_on_new_accounts_should_not_work2() {
+	ExtBuilder::default()
+		.existential_deposit(10)
+		.creation_fee(50)
+		.monied(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(Balances::is_dead_account(&5), true); // account 5 should not exist
+			// ext_deposit is 10, value is 9, not satisfies for ext_deposit
+			assert_noop!(
+				Balances::transfer(Some(1).into(), 5, 9),
+				"value too low to create account",
+			);
+			assert_eq!(Balances::is_dead_account(&5), true); // account 5 should not exist
+			assert_eq!(Balances::free_balance(&1), 100);
+		});
+}
+
+#[test]
+fn reserved_balance_should_prevent_reclaim_count() {
+	ExtBuilder::default()
+		.existential_deposit(256 * 1)
+		.monied(true)
+		.build()
+		.execute_with(|| {
+			System::inc_account_nonce(&2);
+			assert_eq!(Balances::is_dead_account(&2), false);
+			assert_eq!(Balances::is_dead_account(&5), true);
+			assert_eq!(Balances::total_balance(&2), 256 * 20);
+
+			assert_ok!(Balances::reserve(&2, 256 * 19 + 1)); // account 2 becomes mostly reserved
+			assert_eq!(Balances::free_balance(&2), 0); // "free" account deleted."
+			assert_eq!(Balances::total_balance(&2), 256 * 19 + 1); // reserve still exists.
+			assert_eq!(Balances::is_dead_account(&2), false);
+			assert_eq!(System::account_nonce(&2), 1);
+
+			// account 4 tries to take index 1 for account 5.
+			assert_ok!(Balances::transfer(Some(4).into(), 5, 256 * 1 + 0x69));
+			assert_eq!(Balances::total_balance(&5), 256 * 1 + 0x69);
+			assert_eq!(Balances::is_dead_account(&5), false);
+
+			assert!(Balances::slash(&2, 256 * 18 + 2).1.is_zero()); // account 2 gets slashed
+			// "reserve" account reduced to 255 (below ED) so account deleted
+			assert_eq!(Balances::total_balance(&2), 0);
+			assert_eq!(System::account_nonce(&2), 0);	// nonce zero
+			assert_eq!(Balances::is_dead_account(&2), true);
+
+			// account 4 tries to take index 1 again for account 6.
+			assert_ok!(Balances::transfer(Some(4).into(), 6, 256 * 1 + 0x69));
+			assert_eq!(Balances::total_balance(&6), 256 * 1 + 0x69);
+			assert_eq!(Balances::is_dead_account(&6), false);
+		});
+}
+
+
+#[test]
+fn reward_should_work() {
+	ExtBuilder::default().monied(true).build().execute_with(|| {
+		assert_eq!(Balances::total_balance(&1), 10);
+		assert_ok!(Balances::deposit_into_existing(&1, 10).map(drop));
+		assert_eq!(Balances::total_balance(&1), 20);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 120);
+	});
+}
+
+#[test]
+fn dust_account_removal_should_work() {
+	ExtBuilder::default()
+		.existential_deposit(100)
+		.monied(true)
+		.build()
+		.execute_with(|| {
+			System::inc_account_nonce(&2);
+			assert_eq!(System::account_nonce(&2), 1);
+			assert_eq!(Balances::total_balance(&2), 2000);
+
+			assert_ok!(Balances::transfer(Some(2).into(), 5, 1901)); // index 1 (account 2) becomes zombie
+			assert_eq!(Balances::total_balance(&2), 0);
+			assert_eq!(Balances::total_balance(&5), 1901);
+			assert_eq!(System::account_nonce(&2), 0);
+		});
+}
+
+#[test]
+fn dust_account_removal_should_work2() {
+	ExtBuilder::default()
+		.existential_deposit(100)
+		.creation_fee(50)
+		.monied(true)
+		.build()
+		.execute_with(|| {
+			System::inc_account_nonce(&2);
+			assert_eq!(System::account_nonce(&2), 1);
+			assert_eq!(Balances::total_balance(&2), 2000);
+			// index 1 (account 2) becomes zombie for 256*10 + 50(fee) < 256 * 10 (ext_deposit)
+			assert_ok!(Balances::transfer(Some(2).into(), 5, 1851));
+			assert_eq!(Balances::total_balance(&2), 0);
+			assert_eq!(Balances::total_balance(&5), 1851);
+			assert_eq!(System::account_nonce(&2), 0);
+		});
+}
+
+#[test]
+fn balance_works() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 42);
+		assert_eq!(Balances::free_balance(&1), 42);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+		assert_eq!(Balances::total_balance(&1), 42);
+		assert_eq!(Balances::free_balance(&2), 0);
+		assert_eq!(Balances::reserved_balance(&2), 0);
+		assert_eq!(Balances::total_balance(&2), 0);
+	});
+}
+
+#[test]
+fn balance_transfer_works() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::transfer(Some(1).into(), 2, 69));
+		assert_eq!(Balances::total_balance(&1), 42);
+		assert_eq!(Balances::total_balance(&2), 69);
+	});
+}
+
+#[test]
+fn force_transfer_works() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_noop!(
+			Balances::force_transfer(Some(2).into(), 1, 2, 69),
+			"RequireRootOrigin",
+		);
+		assert_ok!(Balances::force_transfer(RawOrigin::Root.into(), 1, 2, 69));
+		assert_eq!(Balances::total_balance(&1), 42);
+		assert_eq!(Balances::total_balance(&2), 69);
+	});
+}
+
+#[test]
+fn reserving_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+
+		assert_eq!(Balances::total_balance(&1), 111);
+		assert_eq!(Balances::free_balance(&1), 111);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+
+		assert_ok!(Balances::reserve(&1, 69));
+
+		assert_eq!(Balances::total_balance(&1), 111);
+		assert_eq!(Balances::free_balance(&1), 42);
+		assert_eq!(Balances::reserved_balance(&1), 69);
+	});
+}
+
+#[test]
+fn balance_transfer_when_reserved_should_not_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 69));
+		assert_noop!(
+			Balances::transfer(Some(1).into(), 2, 69),
+			"balance too low to send value",
+		);
+	});
+}
+
+#[test]
+fn deducting_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 69));
+		assert_eq!(Balances::free_balance(&1), 42);
+	});
+}
+
+#[test]
+fn refunding_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 42);
+		Balances::set_reserved_balance(&1, 69);
+		Balances::unreserve(&1, 69);
+		assert_eq!(Balances::free_balance(&1), 111);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+	});
+}
+
+#[test]
+fn slashing_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 69));
+		assert!(Balances::slash(&1, 69).1.is_zero());
+		assert_eq!(Balances::free_balance(&1), 0);
+		assert_eq!(Balances::reserved_balance(&1), 42);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 42);
+	});
+}
+
+#[test]
+fn slashing_incomplete_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 42);
+		assert_ok!(Balances::reserve(&1, 21));
+		assert_eq!(Balances::slash(&1, 69).1, 27);
+		assert_eq!(Balances::free_balance(&1), 0);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 0);
+	});
+}
+
+#[test]
+fn unreserving_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 111));
+		Balances::unreserve(&1, 42);
+		assert_eq!(Balances::reserved_balance(&1), 69);
+		assert_eq!(Balances::free_balance(&1), 42);
+	});
+}
+
+#[test]
+fn slashing_reserved_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 111));
+		assert_eq!(Balances::slash_reserved(&1, 42).1, 0);
+		assert_eq!(Balances::reserved_balance(&1), 69);
+		assert_eq!(Balances::free_balance(&1), 0);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 69);
+	});
+}
+
+#[test]
+fn slashing_incomplete_reserved_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 42));
+		assert_eq!(Balances::slash_reserved(&1, 69).1, 27);
+		assert_eq!(Balances::free_balance(&1), 69);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 69);
+	});
+}
+
+#[test]
+fn transferring_reserved_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 110);
+		let _ = Balances::deposit_creating(&2, 1);
+		assert_ok!(Balances::reserve(&1, 110));
+		assert_ok!(Balances::repatriate_reserved(&1, &2, 41), 0);
+		assert_eq!(Balances::reserved_balance(&1), 69);
+		assert_eq!(Balances::free_balance(&1), 0);
+		assert_eq!(Balances::reserved_balance(&2), 0);
+		assert_eq!(Balances::free_balance(&2), 42);
+	});
+}
+
+#[test]
+fn transferring_reserved_balance_to_nonexistent_should_fail() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 111);
+		assert_ok!(Balances::reserve(&1, 111));
+		assert_noop!(Balances::repatriate_reserved(&1, &2, 42), "beneficiary account must pre-exist");
+	});
+}
+
+#[test]
+fn transferring_incomplete_reserved_balance_should_work() {
+	ExtBuilder::default().build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 110);
+		let _ = Balances::deposit_creating(&2, 1);
+		assert_ok!(Balances::reserve(&1, 41));
+		assert_ok!(Balances::repatriate_reserved(&1, &2, 69), 28);
+		assert_eq!(Balances::reserved_balance(&1), 0);
+		assert_eq!(Balances::free_balance(&1), 69);
+		assert_eq!(Balances::reserved_balance(&2), 0);
+		assert_eq!(Balances::free_balance(&2), 42);
+	});
+}
+
+#[test]
+fn transferring_too_high_value_should_not_panic() {
+	ExtBuilder::default().build().execute_with(|| {
+		<FreeBalance<Runtime>>::insert(1, u64::max_value());
+		<FreeBalance<Runtime>>::insert(2, 1);
+
+		assert_err!(
+			Balances::transfer(Some(1).into(), 2, u64::max_value()),
+			"destination balance too high to receive value",
+		);
+
+		assert_eq!(Balances::free_balance(&1), u64::max_value());
+		assert_eq!(Balances::free_balance(&2), 1);
+	});
+}
+
+#[test]
+fn account_create_on_free_too_low_with_other() {
+	ExtBuilder::default().existential_deposit(100).build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 100);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 100);
+
+		// No-op.
+		let _ = Balances::deposit_creating(&2, 50);
+		assert_eq!(Balances::free_balance(&2), 0);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 100);
+	})
+}
+
+
+#[test]
+fn account_create_on_free_too_low() {
+	ExtBuilder::default().existential_deposit(100).build().execute_with(|| {
+		// No-op.
+		let _ = Balances::deposit_creating(&2, 50);
+		assert_eq!(Balances::free_balance(&2), 0);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 0);
+	})
+}
+
+#[test]
+fn account_removal_on_free_too_low() {
+	ExtBuilder::default().existential_deposit(100).build().execute_with(|| {
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 0);
+
+		// Setup two accounts with free balance above the existential threshold.
+		let _ = Balances::deposit_creating(&1, 110);
+		let _ = Balances::deposit_creating(&2, 110);
+
+		assert_eq!(Balances::free_balance(&1), 110);
+		assert_eq!(Balances::free_balance(&2), 110);
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 220);
+
+		// Transfer funds from account 1 of such amount that after this transfer
+		// the balance of account 1 will be below the existential threshold.
+		// This should lead to the removal of all balance of this account.
+		assert_ok!(Balances::transfer(Some(1).into(), 2, 20));
+
+		// Verify free balance removal of account 1.
+		assert_eq!(Balances::free_balance(&1), 0);
+		assert_eq!(Balances::free_balance(&2), 130);
+
+		// Verify that TotalIssuance tracks balance removal when free balance is too low.
+		assert_eq!(<TotalIssuance<Runtime>>::get(), 130);
+	});
+}
+
+#[test]
+fn transfer_overflow_isnt_exploitable() {
+	ExtBuilder::default().creation_fee(50).build().execute_with(|| {
+		// Craft a value that will overflow if summed with `creation_fee`.
+		let evil_value = u64::max_value() - 49;
+
+		assert_err!(
+			Balances::transfer(Some(1).into(), 5, evil_value),
+			"got overflow after adding a fee to value",
+		);
+	});
+}
+
+#[test]
+fn check_vesting_status() {
+	ExtBuilder::default()
+		.existential_deposit(256)
+		.monied(true)
+		.vesting(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(System::block_number(), 1);
+			let user1_free_balance = Balances::free_balance(&1);
+			let user2_free_balance = Balances::free_balance(&2);
+			let user12_free_balance = Balances::free_balance(&12);
+			assert_eq!(user1_free_balance, 256 * 10); // Account 1 has free balance
+			assert_eq!(user2_free_balance, 256 * 20); // Account 2 has free balance
+			assert_eq!(user12_free_balance, 256 * 10); // Account 12 has free balance
+			let user1_vesting_schedule = VestingSchedule {
+				locked: 256 * 5,
+				per_block: 128, // Vesting over 10 blocks
+				starting_block: 0,
+			};
+			let user2_vesting_schedule = VestingSchedule {
+				locked: 256 * 20,
+				per_block: 256, // Vesting over 20 blocks
+				starting_block: 10,
+			};
+			let user12_vesting_schedule = VestingSchedule {
+				locked: 256 * 5,
+				per_block: 64, // Vesting over 20 blocks
+				starting_block: 10,
+			};
+			assert_eq!(Balances::vesting(&1), Some(user1_vesting_schedule)); // Account 1 has a vesting schedule
+			assert_eq!(Balances::vesting(&2), Some(user2_vesting_schedule)); // Account 2 has a vesting schedule
+			assert_eq!(Balances::vesting(&12), Some(user12_vesting_schedule)); // Account 12 has a vesting schedule
+
+			// Account 1 has only 128 units vested from their illiquid 256 * 5 units at block 1
+			assert_eq!(Balances::vesting_balance(&1), 128 * 9);
+			// Account 2 has their full balance locked
+			assert_eq!(Balances::vesting_balance(&2), user2_free_balance);
+			// Account 12 has only their illiquid funds locked
+			assert_eq!(Balances::vesting_balance(&12), user12_free_balance - 256 * 5);
+
+			System::set_block_number(10);
+			assert_eq!(System::block_number(), 10);
+
+			// Account 1 has fully vested by block 10
+			assert_eq!(Balances::vesting_balance(&1), 0);
+			// Account 2 has started vesting by block 10
+			assert_eq!(Balances::vesting_balance(&2), user2_free_balance);
+			// Account 12 has started vesting by block 10
+			assert_eq!(Balances::vesting_balance(&12), user12_free_balance - 256 * 5);
+
+			System::set_block_number(30);
+			assert_eq!(System::block_number(), 30);
+
+			assert_eq!(Balances::vesting_balance(&1), 0); // Account 1 is still fully vested, and not negative
+			assert_eq!(Balances::vesting_balance(&2), 0); // Account 2 has fully vested by block 30
+			assert_eq!(Balances::vesting_balance(&12), 0); // Account 2 has fully vested by block 30
+
+		});
+}
+
+#[test]
+fn unvested_balance_should_not_transfer() {
+	ExtBuilder::default()
+		.existential_deposit(10)
+		.monied(true)
+		.vesting(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(System::block_number(), 1);
+			let user1_free_balance = Balances::free_balance(&1);
+			assert_eq!(user1_free_balance, 100); // Account 1 has free balance
+			// Account 1 has only 5 units vested at block 1 (plus 50 unvested)
+			assert_eq!(Balances::vesting_balance(&1), 45);
+			assert_noop!(
+				Balances::transfer(Some(1).into(), 2, 56),
+				"vesting balance too high to send value",
+			); // Account 1 cannot send more than vested amount
+		});
+}
+
+#[test]
+fn vested_balance_should_transfer() {
+	ExtBuilder::default()
+		.existential_deposit(10)
+		.monied(true)
+		.vesting(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(System::block_number(), 1);
+			let user1_free_balance = Balances::free_balance(&1);
+			assert_eq!(user1_free_balance, 100); // Account 1 has free balance
+			// Account 1 has only 5 units vested at block 1 (plus 50 unvested)
+			assert_eq!(Balances::vesting_balance(&1), 45);
+			assert_ok!(Balances::transfer(Some(1).into(), 2, 55));
+		});
+}
+
+#[test]
+fn extra_balance_should_transfer() {
+	ExtBuilder::default()
+		.existential_deposit(10)
+		.monied(true)
+		.vesting(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(System::block_number(), 1);
+			assert_ok!(Balances::transfer(Some(3).into(), 1, 100));
+			assert_ok!(Balances::transfer(Some(3).into(), 2, 100));
+
+			let user1_free_balance = Balances::free_balance(&1);
+			assert_eq!(user1_free_balance, 200); // Account 1 has 100 more free balance than normal
+
+			let user2_free_balance = Balances::free_balance(&2);
+			assert_eq!(user2_free_balance, 300); // Account 2 has 100 more free balance than normal
+
+			// Account 1 has only 5 units vested at block 1 (plus 150 unvested)
+			assert_eq!(Balances::vesting_balance(&1), 45);
+			assert_ok!(Balances::transfer(Some(1).into(), 3, 155)); // Account 1 can send extra units gained
+
+			// Account 2 has no units vested at block 1, but gained 100
+			assert_eq!(Balances::vesting_balance(&2), 200);
+			assert_ok!(Balances::transfer(Some(2).into(), 3, 100)); // Account 2 can send extra units gained
+		});
+}
+
+#[test]
+fn liquid_funds_should_transfer_with_delayed_vesting() {
+	ExtBuilder::default()
+		.existential_deposit(256)
+		.monied(true)
+		.vesting(true)
+		.build()
+		.execute_with(|| {
+			assert_eq!(System::block_number(), 1);
+			let user12_free_balance = Balances::free_balance(&12);
+
+			assert_eq!(user12_free_balance, 2560); // Account 12 has free balance
+			// Account 12 has liquid funds
+			assert_eq!(Balances::vesting_balance(&12), user12_free_balance - 256 * 5);
+
+			// Account 12 has delayed vesting
+			let user12_vesting_schedule = VestingSchedule {
+				locked: 256 * 5,
+				per_block: 64, // Vesting over 20 blocks
+				starting_block: 10,
+			};
+			assert_eq!(Balances::vesting(&12), Some(user12_vesting_schedule));
+
+			// Account 12 can still send liquid funds
+			assert_ok!(Balances::transfer(Some(12).into(), 3, 256 * 5));
+		});
+}
+
+#[test]
+fn burn_must_work() {
+	ExtBuilder::default().monied(true).build().execute_with(|| {
+		let init_total_issuance = Balances::total_issuance();
+		let imbalance = Balances::burn(10);
+		assert_eq!(Balances::total_issuance(), init_total_issuance - 10);
+		drop(imbalance);
+		assert_eq!(Balances::total_issuance(), init_total_issuance);
+	});
+}
+
+#[test]
+fn transfer_keep_alive_works() {
+	ExtBuilder::default().existential_deposit(1).build().execute_with(|| {
+		let _ = Balances::deposit_creating(&1, 100);
+		assert_err!(
+			Balances::transfer_keep_alive(Some(1).into(), 2, 100),
+			"transfer would kill account"
+		);
+		assert_eq!(Balances::is_dead_account(&1), false);
+		assert_eq!(Balances::total_balance(&1), 100);
+		assert_eq!(Balances::total_balance(&2), 0);
+	});
+}
+
+#[test]
+#[should_panic="the balance of any account should always be more than existential deposit."]
+fn cannot_set_genesis_value_below_ed() {
+	mock::EXISTENTIAL_DEPOSIT.with(|v| *v.borrow_mut() = 11);
+	let mut t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+	let _ = GenesisConfig::<Runtime> {
+		balances: vec![(1, 10)],
+		vesting: vec![],
+	}.assimilate_storage(&mut t).unwrap();
+}

substrate/frame/collective/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "pallet-collective"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+hex-literal = "0.2.1"
+balances = { package = "pallet-balances", path = "../balances" }
+
+[features]
+default = ["std"]
+std = [
+	"safe-mix/std",
+	"codec/std",
+	"primitives/std",
+	"rstd/std",
+	"serde",
+	"runtime-io/std",
+	"support/std",
+	"sr-primitives/std",
+	"system/std",
+]

substrate/frame/collective/src/lib.rs

@@ -0,0 +1,743 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Collective system: Members of a set of account IDs can make their collective feelings known
+//! through dispatched calls from one of two specialised origins.
+//!
+//! The membership can be provided in one of two ways: either directly, using the Root-dispatchable
+//! function `set_members`, or indirectly, through implementing the `ChangeMembers`
+
+#![cfg_attr(not(feature = "std"), no_std)]
+#![recursion_limit="128"]
+
+use rstd::{prelude::*, result};
+use primitives::u32_trait::Value as U32;
+use sr_primitives::RuntimeDebug;
+use sr_primitives::traits::{Hash, EnsureOrigin};
+use support::weights::SimpleDispatchInfo;
+use support::{
+	dispatch::{Dispatchable, Parameter}, codec::{Encode, Decode},
+	traits::{ChangeMembers, InitializeMembers}, decl_module, decl_event,
+	decl_storage, ensure,
+};
+use system::{self, ensure_signed, ensure_root};
+
+/// Simple index type for proposal counting.
+pub type ProposalIndex = u32;
+
+/// A number of members.
+///
+/// This also serves as a number of voting members, and since for motions, each member may
+/// vote exactly once, therefore also the number of votes for any given motion.
+pub type MemberCount = u32;
+
+pub trait Trait<I=DefaultInstance>: system::Trait {
+	/// The outer origin type.
+	type Origin: From<RawOrigin<Self::AccountId, I>>;
+
+	/// The outer call dispatch type.
+	type Proposal: Parameter + Dispatchable<Origin=<Self as Trait<I>>::Origin>;
+
+	/// The outer event type.
+	type Event: From<Event<Self, I>> + Into<<Self as system::Trait>::Event>;
+}
+
+/// Origin for the collective module.
+#[derive(PartialEq, Eq, Clone, RuntimeDebug)]
+pub enum RawOrigin<AccountId, I> {
+	/// It has been condoned by a given number of members of the collective from a given total.
+	Members(MemberCount, MemberCount),
+	/// It has been condoned by a single member of the collective.
+	Member(AccountId),
+	/// Dummy to manage the fact we have instancing.
+	_Phantom(rstd::marker::PhantomData<I>),
+}
+
+/// Origin for the collective module.
+pub type Origin<T, I=DefaultInstance> = RawOrigin<<T as system::Trait>::AccountId, I>;
+
+#[derive(PartialEq, Eq, Clone, Encode, Decode, RuntimeDebug)]
+/// Info for keeping track of a motion being voted on.
+pub struct Votes<AccountId> {
+	/// The proposal's unique index.
+	index: ProposalIndex,
+	/// The number of approval votes that are needed to pass the motion.
+	threshold: MemberCount,
+	/// The current set of voters that approved it.
+	ayes: Vec<AccountId>,
+	/// The current set of voters that rejected it.
+	nays: Vec<AccountId>,
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait<I>, I: Instance=DefaultInstance> as Collective {
+		/// The hashes of the active proposals.
+		pub Proposals get(fn proposals): Vec<T::Hash>;
+		/// Actual proposal for a given hash, if it's current.
+		pub ProposalOf get(fn proposal_of): map T::Hash => Option<<T as Trait<I>>::Proposal>;
+		/// Votes on a given proposal, if it is ongoing.
+		pub Voting get(fn voting): map T::Hash => Option<Votes<T::AccountId>>;
+		/// Proposals so far.
+		pub ProposalCount get(fn proposal_count): u32;
+		/// The current members of the collective. This is stored sorted (just by value).
+		pub Members get(fn members): Vec<T::AccountId>;
+	}
+	add_extra_genesis {
+		config(phantom): rstd::marker::PhantomData<I>;
+		config(members): Vec<T::AccountId>;
+		build(|config| Module::<T, I>::initialize_members(&config.members))
+	}
+}
+
+decl_event!(
+	pub enum Event<T, I=DefaultInstance> where
+		<T as system::Trait>::Hash,
+		<T as system::Trait>::AccountId,
+	{
+		/// A motion (given hash) has been proposed (by given account) with a threshold (given
+		/// `MemberCount`).
+		Proposed(AccountId, ProposalIndex, Hash, MemberCount),
+		/// A motion (given hash) has been voted on by given account, leaving
+		/// a tally (yes votes and no votes given respectively as `MemberCount`).
+		Voted(AccountId, Hash, bool, MemberCount, MemberCount),
+		/// A motion was approved by the required threshold.
+		Approved(Hash),
+		/// A motion was not approved by the required threshold.
+		Disapproved(Hash),
+		/// A motion was executed; `bool` is true if returned without error.
+		Executed(Hash, bool),
+		/// A single member did some action; `bool` is true if returned without error.
+		MemberExecuted(Hash, bool),
+	}
+);
+
+// Note: this module is not benchmarked. The weights are obtained based on the similarity of the
+// executed logic with other democracy function. Note that councillor operations are assigned to the
+// operational class.
+decl_module! {
+	pub struct Module<T: Trait<I>, I: Instance=DefaultInstance> for enum Call where origin: <T as system::Trait>::Origin {
+		fn deposit_event() = default;
+
+		/// Set the collective's membership manually to `new_members`. Be nice to the chain and
+		/// provide it pre-sorted.
+		///
+		/// Requires root origin.
+		#[weight = SimpleDispatchInfo::FixedOperational(100_000)]
+		fn set_members(origin, new_members: Vec<T::AccountId>) {
+			ensure_root(origin)?;
+			let mut new_members = new_members;
+			new_members.sort();
+			<Members<T, I>>::mutate(|m| {
+				<Self as ChangeMembers<T::AccountId>>::set_members_sorted(&new_members[..], m);
+				*m = new_members;
+			});
+		}
+
+		/// Dispatch a proposal from a member using the `Member` origin.
+		///
+		/// Origin must be a member of the collective.
+		#[weight = SimpleDispatchInfo::FixedOperational(100_000)]
+		fn execute(origin, proposal: Box<<T as Trait<I>>::Proposal>) {
+			let who = ensure_signed(origin)?;
+			ensure!(Self::is_member(&who), "proposer not a member");
+
+			let proposal_hash = T::Hashing::hash_of(&proposal);
+			let ok = proposal.dispatch(RawOrigin::Member(who).into()).is_ok();
+			Self::deposit_event(RawEvent::MemberExecuted(proposal_hash, ok));
+		}
+
+		/// # <weight>
+		/// - Bounded storage reads and writes.
+		/// - Argument `threshold` has bearing on weight.
+		/// # </weight>
+		#[weight = SimpleDispatchInfo::FixedOperational(5_000_000)]
+		fn propose(origin, #[compact] threshold: MemberCount, proposal: Box<<T as Trait<I>>::Proposal>) {
+			let who = ensure_signed(origin)?;
+			ensure!(Self::is_member(&who), "proposer not a member");
+
+			let proposal_hash = T::Hashing::hash_of(&proposal);
+
+			ensure!(!<ProposalOf<T, I>>::exists(proposal_hash), "duplicate proposals not allowed");
+
+			if threshold < 2 {
+				let seats = Self::members().len() as MemberCount;
+				let ok = proposal.dispatch(RawOrigin::Members(1, seats).into()).is_ok();
+				Self::deposit_event(RawEvent::Executed(proposal_hash, ok));
+			} else {
+				let index = Self::proposal_count();
+				<ProposalCount<I>>::mutate(|i| *i += 1);
+				<Proposals<T, I>>::mutate(|proposals| proposals.push(proposal_hash));
+				<ProposalOf<T, I>>::insert(proposal_hash, *proposal);
+				let votes = Votes { index, threshold, ayes: vec![who.clone()], nays: vec![] };
+				<Voting<T, I>>::insert(proposal_hash, votes);
+
+				Self::deposit_event(RawEvent::Proposed(who, index, proposal_hash, threshold));
+			}
+		}
+
+		/// # <weight>
+		/// - Bounded storage read and writes.
+		/// - Will be slightly heavier if the proposal is approved / disapproved after the vote.
+		/// # </weight>
+		#[weight = SimpleDispatchInfo::FixedOperational(200_000)]
+		fn vote(origin, proposal: T::Hash, #[compact] index: ProposalIndex, approve: bool) {
+			let who = ensure_signed(origin)?;
+			ensure!(Self::is_member(&who), "voter not a member");
+
+			let mut voting = Self::voting(&proposal).ok_or("proposal must exist")?;
+			ensure!(voting.index == index, "mismatched index");
+
+			let position_yes = voting.ayes.iter().position(|a| a == &who);
+			let position_no = voting.nays.iter().position(|a| a == &who);
+
+			if approve {
+				if position_yes.is_none() {
+					voting.ayes.push(who.clone());
+				} else {
+					return Err("duplicate vote ignored")
+				}
+				if let Some(pos) = position_no {
+					voting.nays.swap_remove(pos);
+				}
+			} else {
+				if position_no.is_none() {
+					voting.nays.push(who.clone());
+				} else {
+					return Err("duplicate vote ignored")
+				}
+				if let Some(pos) = position_yes {
+					voting.ayes.swap_remove(pos);
+				}
+			}
+
+			let yes_votes = voting.ayes.len() as MemberCount;
+			let no_votes = voting.nays.len() as MemberCount;
+			Self::deposit_event(RawEvent::Voted(who, proposal, approve, yes_votes, no_votes));
+
+			let seats = Self::members().len() as MemberCount;
+			let approved = yes_votes >= voting.threshold;
+			let disapproved = seats.saturating_sub(no_votes) < voting.threshold;
+			if approved || disapproved {
+				if approved {
+					Self::deposit_event(RawEvent::Approved(proposal));
+
+					// execute motion, assuming it exists.
+					if let Some(p) = <ProposalOf<T, I>>::take(&proposal) {
+						let origin = RawOrigin::Members(voting.threshold, seats).into();
+						let ok = p.dispatch(origin).is_ok();
+						Self::deposit_event(RawEvent::Executed(proposal, ok));
+					}
+				} else {
+					// disapproved
+					Self::deposit_event(RawEvent::Disapproved(proposal));
+				}
+
+				// remove vote
+				<Voting<T, I>>::remove(&proposal);
+				<Proposals<T, I>>::mutate(|proposals| proposals.retain(|h| h != &proposal));
+			} else {
+				// update voting
+				<Voting<T, I>>::insert(&proposal, voting);
+			}
+		}
+	}
+}
+
+impl<T: Trait<I>, I: Instance> Module<T, I> {
+	pub fn is_member(who: &T::AccountId) -> bool {
+		Self::members().contains(who)
+	}
+}
+
+impl<T: Trait<I>, I: Instance> ChangeMembers<T::AccountId> for Module<T, I> {
+	fn change_members_sorted(_incoming: &[T::AccountId], outgoing: &[T::AccountId], new: &[T::AccountId]) {
+		// remove accounts from all current voting in motions.
+		let mut outgoing = outgoing.to_vec();
+		outgoing.sort_unstable();
+		for h in Self::proposals().into_iter() {
+			<Voting<T, I>>::mutate(h, |v|
+				if let Some(mut votes) = v.take() {
+					votes.ayes = votes.ayes.into_iter()
+						.filter(|i| outgoing.binary_search(i).is_err())
+						.collect();
+					votes.nays = votes.nays.into_iter()
+						.filter(|i| outgoing.binary_search(i).is_err())
+						.collect();
+					*v = Some(votes);
+				}
+			);
+		}
+		<Members<T, I>>::put(new);
+	}
+}
+
+impl<T: Trait<I>, I: Instance> InitializeMembers<T::AccountId> for Module<T, I> {
+	fn initialize_members(members: &[T::AccountId]) {
+		if !members.is_empty() {
+			assert!(<Members<T, I>>::get().is_empty(), "Members are already initialized!");
+			<Members<T, I>>::put(members);
+		}
+	}
+}
+
+/// Ensure that the origin `o` represents at least `n` members. Returns `Ok` or an `Err`
+/// otherwise.
+pub fn ensure_members<OuterOrigin, AccountId, I>(o: OuterOrigin, n: MemberCount)
+	-> result::Result<MemberCount, &'static str>
+where
+	OuterOrigin: Into<result::Result<RawOrigin<AccountId, I>, OuterOrigin>>
+{
+	match o.into() {
+		Ok(RawOrigin::Members(x, _)) if x >= n => Ok(n),
+		_ => Err("bad origin: expected to be a threshold number of members"),
+	}
+}
+
+pub struct EnsureMember<AccountId, I=DefaultInstance>(rstd::marker::PhantomData<(AccountId, I)>);
+impl<
+	O: Into<Result<RawOrigin<AccountId, I>, O>> + From<RawOrigin<AccountId, I>>,
+	AccountId,
+	I,
+> EnsureOrigin<O> for EnsureMember<AccountId, I> {
+	type Success = AccountId;
+	fn try_origin(o: O) -> Result<Self::Success, O> {
+		o.into().and_then(|o| match o {
+			RawOrigin::Member(id) => Ok(id),
+			r => Err(O::from(r)),
+		})
+	}
+}
+
+pub struct EnsureMembers<N: U32, AccountId, I=DefaultInstance>(rstd::marker::PhantomData<(N, AccountId, I)>);
+impl<
+	O: Into<Result<RawOrigin<AccountId, I>, O>> + From<RawOrigin<AccountId, I>>,
+	N: U32,
+	AccountId,
+	I,
+> EnsureOrigin<O> for EnsureMembers<N, AccountId, I> {
+	type Success = (MemberCount, MemberCount);
+	fn try_origin(o: O) -> Result<Self::Success, O> {
+		o.into().and_then(|o| match o {
+			RawOrigin::Members(n, m) if n >= N::VALUE => Ok((n, m)),
+			r => Err(O::from(r)),
+		})
+	}
+}
+
+pub struct EnsureProportionMoreThan<N: U32, D: U32, AccountId, I=DefaultInstance>(
+	rstd::marker::PhantomData<(N, D, AccountId, I)>
+);
+impl<
+	O: Into<Result<RawOrigin<AccountId, I>, O>> + From<RawOrigin<AccountId, I>>,
+	N: U32,
+	D: U32,
+	AccountId,
+	I,
+> EnsureOrigin<O> for EnsureProportionMoreThan<N, D, AccountId, I> {
+	type Success = ();
+	fn try_origin(o: O) -> Result<Self::Success, O> {
+		o.into().and_then(|o| match o {
+			RawOrigin::Members(n, m) if n * D::VALUE > N::VALUE * m => Ok(()),
+			r => Err(O::from(r)),
+		})
+	}
+}
+
+pub struct EnsureProportionAtLeast<N: U32, D: U32, AccountId, I=DefaultInstance>(
+	rstd::marker::PhantomData<(N, D, AccountId, I)>
+);
+impl<
+	O: Into<Result<RawOrigin<AccountId, I>, O>> + From<RawOrigin<AccountId, I>>,
+	N: U32,
+	D: U32,
+	AccountId,
+	I,
+> EnsureOrigin<O> for EnsureProportionAtLeast<N, D, AccountId, I> {
+	type Success = ();
+	fn try_origin(o: O) -> Result<Self::Success, O> {
+		o.into().and_then(|o| match o {
+			RawOrigin::Members(n, m) if n * D::VALUE >= N::VALUE * m => Ok(()),
+			r => Err(O::from(r)),
+		})
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use support::{Hashable, assert_ok, assert_noop, parameter_types};
+	use system::{EventRecord, Phase};
+	use hex_literal::hex;
+	use primitives::H256;
+	use sr_primitives::{
+		Perbill, traits::{BlakeTwo256, IdentityLookup, Block as BlockT}, testing::Header,
+		BuildStorage,
+	};
+	use crate as collective;
+
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Call = ();
+		type Hash = H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = Event;
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type MaximumBlockLength = MaximumBlockLength;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type Version = ();
+	}
+	impl Trait<Instance1> for Test {
+		type Origin = Origin;
+		type Proposal = Call;
+		type Event = Event;
+	}
+	impl Trait for Test {
+		type Origin = Origin;
+		type Proposal = Call;
+		type Event = Event;
+	}
+
+	pub type Block = sr_primitives::generic::Block<Header, UncheckedExtrinsic>;
+	pub type UncheckedExtrinsic = sr_primitives::generic::UncheckedExtrinsic<u32, u64, Call, ()>;
+
+	support::construct_runtime!(
+		pub enum Test where
+			Block = Block,
+			NodeBlock = Block,
+			UncheckedExtrinsic = UncheckedExtrinsic
+		{
+			System: system::{Module, Call, Event},
+			Collective: collective::<Instance1>::{Module, Call, Event<T>, Origin<T>, Config<T>},
+			DefaultCollective: collective::{Module, Call, Event<T>, Origin<T>, Config<T>},
+		}
+	);
+
+	fn make_ext() -> runtime_io::TestExternalities {
+		GenesisConfig {
+			collective_Instance1: Some(collective::GenesisConfig {
+				members: vec![1, 2, 3],
+				phantom: Default::default(),
+			}),
+			collective: None,
+		}.build_storage().unwrap().into()
+	}
+
+	#[test]
+	fn motions_basic_environment_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			assert_eq!(Collective::members(), vec![1, 2, 3]);
+			assert_eq!(Collective::proposals(), Vec::<H256>::new());
+		});
+	}
+
+	fn make_proposal(value: u64) -> Call {
+		Call::System(system::Call::remark(value.encode()))
+	}
+
+	#[test]
+	fn removal_of_old_voters_votes_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash = BlakeTwo256::hash_of(&proposal);
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(2), hash.clone(), 0, true));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 3, ayes: vec![1, 2], nays: vec![] })
+			);
+			Collective::change_members_sorted(&[4], &[1], &[2, 3, 4]);
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 3, ayes: vec![2], nays: vec![] })
+			);
+
+			let proposal = make_proposal(69);
+			let hash = BlakeTwo256::hash_of(&proposal);
+			assert_ok!(Collective::propose(Origin::signed(2), 2, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(3), hash.clone(), 1, false));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 1, threshold: 2, ayes: vec![2], nays: vec![3] })
+			);
+			Collective::change_members_sorted(&[], &[3], &[2, 4]);
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 1, threshold: 2, ayes: vec![2], nays: vec![] })
+			);
+		});
+	}
+
+	#[test]
+	fn removal_of_old_voters_votes_works_with_set_members() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash = BlakeTwo256::hash_of(&proposal);
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(2), hash.clone(), 0, true));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 3, ayes: vec![1, 2], nays: vec![] })
+			);
+			assert_ok!(Collective::set_members(Origin::ROOT, vec![2, 3, 4]));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 3, ayes: vec![2], nays: vec![] })
+			);
+
+			let proposal = make_proposal(69);
+			let hash = BlakeTwo256::hash_of(&proposal);
+			assert_ok!(Collective::propose(Origin::signed(2), 2, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(3), hash.clone(), 1, false));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 1, threshold: 2, ayes: vec![2], nays: vec![3] })
+			);
+			assert_ok!(Collective::set_members(Origin::ROOT, vec![2, 4]));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 1, threshold: 2, ayes: vec![2], nays: vec![] })
+			);
+		});
+	}
+
+	#[test]
+	fn propose_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_eq!(Collective::proposals(), vec![hash]);
+			assert_eq!(Collective::proposal_of(&hash), Some(proposal));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 3, ayes: vec![1], nays: vec![] })
+			);
+
+			assert_eq!(System::events(), vec![
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Proposed(
+						1,
+						0,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						3,
+					)),
+					topics: vec![],
+				}
+			]);
+		});
+	}
+
+	#[test]
+	fn motions_ignoring_non_collective_proposals_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			assert_noop!(
+				Collective::propose(Origin::signed(42), 3, Box::new(proposal.clone())),
+				"proposer not a member"
+			);
+		});
+	}
+
+	#[test]
+	fn motions_ignoring_non_collective_votes_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash: H256 = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_noop!(
+				Collective::vote(Origin::signed(42), hash.clone(), 0, true),
+				"voter not a member",
+			);
+		});
+	}
+
+	#[test]
+	fn motions_ignoring_bad_index_collective_vote_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(3);
+			let proposal = make_proposal(42);
+			let hash: H256 = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_noop!(
+				Collective::vote(Origin::signed(2), hash.clone(), 1, true),
+				"mismatched index",
+			);
+		});
+	}
+
+	#[test]
+	fn motions_revoting_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash: H256 = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 2, Box::new(proposal.clone())));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 2, ayes: vec![1], nays: vec![] })
+			);
+			assert_noop!(
+				Collective::vote(Origin::signed(1), hash.clone(), 0, true),
+				"duplicate vote ignored",
+			);
+			assert_ok!(Collective::vote(Origin::signed(1), hash.clone(), 0, false));
+			assert_eq!(
+				Collective::voting(&hash),
+				Some(Votes { index: 0, threshold: 2, ayes: vec![], nays: vec![1] })
+			);
+			assert_noop!(
+				Collective::vote(Origin::signed(1), hash.clone(), 0, false),
+				"duplicate vote ignored",
+			);
+
+			assert_eq!(System::events(), vec![
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Proposed(
+						1,
+						0,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						2,
+					)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Voted(
+						1,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						false,
+						0,
+						1,
+					)),
+					topics: vec![],
+				}
+			]);
+		});
+	}
+
+	#[test]
+	fn motions_disapproval_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash: H256 = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 3, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(2), hash.clone(), 0, false));
+
+			assert_eq!(System::events(), vec![
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(
+						RawEvent::Proposed(
+							1,
+							0,
+							hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+							3,
+						)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Voted(
+						2,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						false,
+						1,
+						1,
+					)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Disapproved(
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+					)),
+					topics: vec![],
+				}
+			]);
+		});
+	}
+
+	#[test]
+	fn motions_approval_works() {
+		make_ext().execute_with(|| {
+			System::set_block_number(1);
+			let proposal = make_proposal(42);
+			let hash: H256 = proposal.blake2_256().into();
+			assert_ok!(Collective::propose(Origin::signed(1), 2, Box::new(proposal.clone())));
+			assert_ok!(Collective::vote(Origin::signed(2), hash.clone(), 0, true));
+
+			assert_eq!(System::events(), vec![
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Proposed(
+						1,
+						0,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						2,
+					)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Voted(
+						2,
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						true,
+						2,
+						0,
+					)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Approved(
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+					)),
+					topics: vec![],
+				},
+				EventRecord {
+					phase: Phase::Finalization,
+					event: Event::collective_Instance1(RawEvent::Executed(
+						hex!["68eea8f20b542ec656c6ac2d10435ae3bd1729efc34d1354ab85af840aad2d35"].into(),
+						false,
+					)),
+					topics: vec![],
+				}
+			]);
+		});
+	}
+}

substrate/frame/contracts/COMPLEXITY.md

@@ -0,0 +1,417 @@
+# Complexity
+
+This analysis is on the computing and memory complexity of specific procedures. It provides a rough estimate of operations performed in general and especially focusing on DB reads and writes. It is also an attempt to estimate the memory consumption at its peak.
+
+The primary goal is to come up with decent pricing for functions that can be invoked by a user (via extrinsics) or by untrusted code that prevents DoS attacks.
+
+# Sandboxing
+
+It makes sense to describe the sandboxing module first because the smart-contract module is built upon it.
+
+## Memory
+
+### set
+
+Copies data from the supervisor's memory to the guest's memory.
+
+**complexity**: It doesn't allocate, and the computational complexity is proportional to the number of bytes to copy.
+
+### get
+
+Copies data from the guest's memory to the supervisor's memory.
+
+**complexity**: It doesn't allocate, and the computational complexity is proportional to the number of bytes to copy.
+
+## Instance
+
+### Instantiation
+
+Instantiation of a sandbox module consists of the following steps:
+
+1. Loading the wasm module in the in-memory representation,
+2. Performing validation of the wasm code,
+3. Setting up the environment which will be used to instantiate the module,
+4. Performing the standard wasm instantiation process, which includes (but is not limited to):
+    1. Allocating of memory requested by the instance,
+    2. Copying static data from the module to newly allocated memory,
+    3. Executing the `start` function.
+
+**Note** that the `start` function can be viewed as a normal function and can do anything that a normal function can do, including allocation of more memory or calling the host environment. The complexity of running the `start` function should be considered separately.
+
+In order to start the process of instantiation, the supervisor should provide the wasm module code being instantiated and the environment definition (a set of functions, memories (and maybe globals and tables in the future) available for import by the guest module) for that module. While the environment definition typically is of the constant size (unless mechanisms like dynamic linking are used), the size of wasm is not.
+
+Validation and instantiation in WebAssembly are designed to be able to be performed in linear time. The allocation and computational complexity of loading a wasm module depend on the underlying wasm VM being used. For example, for JIT compilers it can and probably will be non-linear because of compilation. However, for wasmi, it should be linear. We can try to use other VMs that are able to compile code with memory and time consumption proportional to the size of the code.
+
+Since the module itself requests memory, the amount of allocation depends on the module code itself. If untrusted code is being instantiated, it's up to the supervisor to limit the amount of memory available to allocate.
+
+**complexity**: The computational complexity is proportional to the size of wasm code. Memory complexity is proportional to the size of wasm code and the amount of memory requested by the module.
+
+### Preparation to invoke
+
+Invocation of an exported function in the sandboxed module consists of the following steps:
+
+1. Marshalling, copying and unmarshalling the arguments when passing them between the supervisor and executor,
+2. Calling into the underlying VM,
+3. Marshalling, copying and unmarshalling the result when passing it between the executor and supervisor,
+
+**Note** that the complexity of running the function code itself should be considered separately.
+
+The actual complexity of invocation depends on the underlying VM. Wasmi will reserve a relatively large chunk of memory for the stack before execution of the code, although it's of constant size.
+
+The size of the arguments and the return value depends on the exact function in question, but can be considered as constant.
+
+**complexity**: Memory and computational complexity can be considered as a constant.
+
+### Call from the guest to the supervisor
+
+The executor handles each call from the guest. The execution of it consists of the following steps:
+
+1. Marshalling, copying and unmarshalling the arguments when passing them between the guest and executor,
+2. Calling into the supervisor,
+3. Marshaling, copying and unmarshalling the result when passing it between the executor and guest.
+
+**Note** that the complexity of running the supervisor handler should be considered separately.
+
+Because calling into the supervisor requires invoking a wasm VM, the actual complexity of invocation depends on the actual VM used for the runtime/supervisor. Wasmi will reserve a relatively large chunk of memory for the stack before execution of the code, although it's of constant size.
+
+The size of the arguments and the return value depends on the exact function in question, but can be considered as a constant.
+
+**complexity**: Memory and computational complexity can be considered as a constant.
+
+# `AccountDb`
+
+`AccountDb` is an abstraction that supports collecting changes to accounts with the ability to efficiently reverting them. Contract
+execution contexts operate on the AccountDb. All changes are flushed into underlying storage only after origin transaction succeeds.
+
+## Relation to the underlying storage
+
+At present, `AccountDb` is implemented as a cascade of overlays with the direct storage at the bottom. The direct
+storage `AccountDb` leverages child tries. Each overlay is represented by a `Map`. On a commit from an overlay to an
+overlay, maps are merged. On commit from an overlay to the bottommost `AccountDb` all changes are flushed to the storage
+and on revert, the overlay is just discarded.
+
+> ℹ️ The underlying storage has a overlay layer implemented as a `Map`. If the runtime reads a storage location and the
+> respective key doesn't exist in the overlay, then the underlying storage performs a DB access, but the value won't be
+> placed into the overlay. The overlay is only filled with writes.
+>
+> This means that the overlay can be abused in the following ways:
+>
+> - The overlay can be inflated by issuing a lot of writes to unique locations,
+> - Deliberate cache misses can be induced by reading non-modified storage locations,
+
+It also worth noting that the performance degrades with more state stored in the trie. Due to this
+there is not negligible chance that gas schedule will be updated for all operations that involve
+storage access.
+
+## get_storage, get_code_hash, get_rent_allowance, get_balance, contract_exists
+
+These functions check the local cache for a requested value and, if it is there, the value is returned. Otherwise, these functions will ask an underlying `AccountDb`  for the value. This means that the number of lookups is proportional to the depth of the overlay cascade. If the value can't be found before reaching the bottommost `AccountDb`, then a DB read will be performed (in case `get_balance` the function `free_balance` will be invoked).
+
+A lookup in the local cache consists of at least one `Map` lookup, for locating the specific account. For `get_storage` there is a second lookup: because account's storage is implemented as a nested map, another lookup is required for fetching a storage value by a key.
+
+These functions return an owned value as its result, so memory usage depends on the value being returned.
+
+**complexity**: The memory complexity is proportional to the size of the value. The computational complexity is proportional to the depth of the overlay cascade and the size of the value; the cost is dominated by the DB read though.
+
+## set_storage, set_balance, set_rent_allowance
+
+These functions only modify the local `Map`.
+
+A lookup in the local cache consists of at least one `Map` lookup, for locating the specific account. For `get_storage` there is a second lookup: because account's storage is implemented as a nested map, another lookup is required for fetching a storage value by a key.
+
+While these functions only modify the local `Map`, if changes made by them are committed to the bottommost `AccountDb`, each changed entry in the `Map` will require a DB write. Moreover, if the balance of the account is changed to be below `existential_deposit` then that account along with all its storage will be removed, which requires time proportional to the number of storage entries that account has. It should be ensured that pricing accounts for these facts.
+
+**complexity**: Each lookup has a logarithmical computing time to the number of already inserted entries. No additional memory is required.
+
+## instantiate_contract
+
+Calls `contract_exists` and if it doesn't exist, do not modify the local `Map` similarly to `set_rent_allowance`.
+
+**complexity**: The computational complexity is proportional to the depth of the overlay cascade and the size of the value; the cost is dominated by the DB read though. No additional memory is required.
+
+## commit
+
+In this function, all cached values will be inserted into the underlying `AccountDb` or into the storage.
+
+We are doing `N` inserts into `Map` (`O(log M)` complexity) or into the storage, where `N` is the size of the committed `Map` and `M` is the size of the map of the underlying overlay. Consider adjusting the price of modifying the `AccountDb` to account for this (since pricing for the count of entries in `commit` will make the price of commit way less predictable). No additional memory is required.
+
+Note that in case of storage modification we need to construct a key in the underlying storage. In order to do that we need:
+
+- perform `twox_128` hashing over a concatenation of some prefix literal and the `AccountId` of the storage owner.
+- then perform `blake2_256` hashing of the storage key.
+- concatenation of these hashes will constitute the key in the underlying storage.
+
+There is also a special case to think of: if the balance of some account goes below `existential_deposit`, then all storage entries of that account will be erased, which requires time proprotional to the number of storage entries that account has.
+
+**complexity**: `N` inserts into a `Map` or eventually into the storage (if committed). Every deleted account will induce removal of all its storage which is proportional to the number of storage entries that account has.
+
+## revert
+
+Consists of dropping (in the Rust sense) of the `AccountDb`.
+
+**complexity**: Computing complexity is proportional to a number of changed entries in a overlay. No additional memory is required.
+
+# Executive
+
+## Transfer
+
+This function performs the following steps:
+
+1. Querying source and destination balances from an overlay (see `get_balance`),
+2. Querying `existential_deposit`.
+3. Executing `ensure_account_liquid` hook.
+4. Updating source and destination balance in the overlay (see `set_balance`).
+
+**Note** that the complexity of executing `ensure_account_liquid` hook should be considered separately.
+
+In the course of the execution this function can perform up to 2 DB reads to `get_balance` of source and destination accounts. It can also induce up to 2 DB writes via `set_balance` if flushed to the storage.
+
+Moreover, if the source balance goes below `existential_deposit` then the account will be deleted along with all its storage which requires time proportional to the number of storage entries of that account.
+
+Assuming marshaled size of a balance value is of the constant size we can neglect its effect on the performance.
+
+**complexity**: up to 2 DB reads and up to 2 DB writes (if flushed to the storage) in the standard case. If removal of the source account takes place then it will additionally perform a DB write per one storage entry that the account has. For the current `AccountDb` implementation computing complexity also depends on the depth of the `AccountDb` cascade. Memorywise it can be assumed to be constant.
+
+## Initialization
+
+Before a call or instantiate can be performed the execution context must be initialized.
+
+For the first call or instantiation in the handling of an extrinsic, this involves two calls:
+
+1. `<timestamp::Module<T>>::now()`
+2. `<system::Module<T>>::block_number()`
+
+The complexity of initialization depends on the complexity of these functions. In the current
+implementation they just involve a DB read.
+
+For subsequent calls and instantiations during contract execution, the initialization requires no
+expensive operations.
+
+## Call
+
+This function receives input data for the contract execution. The execution consists of the following steps:
+
+1. Initialization of the execution context.
+2. Checking rent payment.
+3. Loading code from the DB.
+4. `transfer`-ing funds between the caller and the destination account.
+5. Executing the code of the destination account.
+6. Committing overlayed changed to the underlying `AccountDb`.
+
+**Note** that the complexity of executing the contract code should be considered separately.
+
+Checking for rent involves 2 unconditional DB reads: `ContractInfoOf` and `block_number`
+and on top of that at most once per block:
+
+- DB read to `free_balance` and
+- `rent_deposit_offset` and
+- `rent_byte_price` and
+- `Currency::minimum_balance` and
+- `tombstone_deposit`.
+- Calls to `ensure_can_withdraw`, `withdraw`, `make_free_balance_be` can perform arbitrary logic and should be considered separately,
+- `child_storage_root`
+- `kill_child_storage`
+- mutation of `ContractInfoOf`
+
+Loading code most likely will trigger a DB read, since the code is immutable and therefore will not get into the cache (unless a suicide removes it, or it has been instantiated in the same call chain).
+
+Also, `transfer` can make up to 2 DB reads and up to 2 DB writes (if flushed to the storage) in the standard case. If removal of the source account takes place then it will additionally perform a DB write per one storage entry that the account has.
+
+Finally, all changes are `commit`-ted into the underlying overlay. The complexity of this depends on the number of changes performed by the code. Thus, the pricing of storage modification should account for that.
+
+**complexity**:
+- Only for the first invocation of the contract: up to 5 DB reads and one DB write as well as logic executed by `ensure_can_withdraw`, `withdraw`, `make_free_balance_be`.
+- On top of that for every invocation: Up to 5 DB reads. DB read of the code is of dynamic size. There can also be up to 2 DB writes (if flushed to the storage). Additionally, if the source account removal takes place a DB write will be performed per one storage entry that the account has.
+
+## Instantiate
+
+This function takes the code of the constructor and input data. Instantiation of a contract consists of the following steps:
+
+1. Initialization of the execution context.
+2. Calling `DetermineContractAddress` hook to determine an address for the contract,
+3. `transfer`-ing funds between self and the newly instantiated contract.
+4. Executing the constructor code. This will yield the final code of the code.
+5. Storing the code for the newly instantiated contract in the overlay.
+6. Committing overlayed changed to the underlying `AccountDb`.
+
+**Note** that the complexity of executing the constructor code should be considered separately.
+
+**Note** that the complexity of `DetermineContractAddress` hook should be considered separately as well. Most likely it will use some kind of hashing over the code of the constructor and input data. The default `SimpleAddressDeterminator` does precisely that.
+
+**Note** that the constructor returns code in the owned form and it's obtained via return facilities, which should have take fee for the return value.
+
+Also, `transfer` can make up to 2 DB reads and up to 2 DB writes (if flushed to the storage) in the standard case. If removal of the source account takes place then it will additionally perform a DB write per one storage entry that the account has.
+
+Storing the code in the overlay may induce another DB write (if flushed to the storage) with the size proportional to the size of the constructor code.
+
+Finally, all changes are `commit`-ted into the underlying overlay. The complexity of this depends on the number of changes performed by the constructor code. Thus, the pricing of storage modification should account for that.
+
+**complexity**: Up to 2 DB reads and induces up to 3 DB writes (if flushed to the storage), one of which is dependent on the size of the code. Additionally, if the source account removal takes place a DB write will be performed per one storage entry that the account has.
+
+# Externalities
+
+Each external function invoked from a contract can involve some overhead.
+
+## ext_gas
+
+**complexity**: This is of constant complexity.
+
+## ext_set_storage
+
+This function receives a `key` and `value` as arguments. It consists of the following steps:
+
+1. Reading the sandbox memory for `key` and `value` (see sandboxing memory get).
+2. Setting the storage by the given `key` with the given `value` (see `set_storage`).
+
+**complexity**: Complexity is proportional to the size of the `value`. This function induces a DB write of size proportional to the `value` size (if flushed to the storage), so should be priced accordingly.
+
+## ext_get_storage
+
+This function receives a `key` as an argument. It consists of the following steps:
+
+1. Reading the sandbox memory for `key` (see sandboxing memory get).
+2. Reading the storage with the given key (see `get_storage`). It receives back the owned result buffer.
+3. Replacing the scratch buffer.
+
+Key is of a constant size. Therefore, the sandbox memory load can be considered to be of constant complexity.
+
+Unless the value is cached, a DB read will be performed. The size of the value is not known until the read is
+performed. Moreover, the DB read has to be synchronous and no progress can be made until the value is fetched.
+
+**complexity**: The memory and computing complexity is proportional to the size of the fetched value. This function performs a
+DB read.
+
+## ext_call
+
+This function receives the following arguments:
+
+- `callee` buffer of a marshaled `AccountId`,
+- `gas` limit which is plain u64,
+- `value` buffer of a marshaled `Balance`,
+- `input_data`. An arbitrarily sized byte vector.
+
+It consists of the following steps:
+
+1. Loading `callee` buffer from the sandbox memory (see sandboxing memory get) and then decoding it.
+2. Loading `value` buffer from the sandbox memory and then decoding it.
+3. Loading `input_data` buffer from the sandbox memory.
+4. Invoking the executive function `call`.
+
+Loading of `callee` and `value` buffers should be charged. This is because the sizes of buffers are specified by the calling code, even though marshaled representations are, essentially, of constant size. This can be fixed by assigning an upper bound for sizes of `AccountId` and `Balance`.
+
+Loading `input_data` should be charged in any case.
+
+**complexity**: All complexity comes from loading buffers and executing `call` executive function. The former component is proportional to the sizes of `callee`, `value` and `input_data` buffers. The latter component completely depends on the complexity of `call` executive function, and also dominated by it.
+
+## ext_instantiate
+
+This function receives the following arguments:
+
+- `init_code`, a buffer which contains the code of the constructor.
+- `gas` limit which is plain u64
+- `value` buffer of a marshaled `Balance`
+- `input_data`. an arbitrarily sized byte vector.
+
+It consists of the following steps:
+
+1. Loading `init_code` buffer from the sandbox memory (see sandboxing memory get) and then decoding it.
+2. Loading `value` buffer from the sandbox memory and then decoding it.
+3. Loading `input_data` buffer from the sandbox memory.
+4. Invoking `instantiate` executive function.
+
+Loading of `value` buffer should be charged. This is because the size of the buffer is specified by the calling code, even though marshaled representation is, essentially, of constant size. This can be fixed by assigning an upper bound for size for `Balance`.
+
+Loading `init_code` and `input_data` should be charged in any case.
+
+**complexity**: All complexity comes from loading buffers and executing `instantiate` executive function. The former component is proportional to the sizes of `init_code`, `value` and `input_data` buffers. The latter component completely depends on the complexity of `instantiate` executive function and also dominated by it.
+
+## ext_return
+
+This function receives a `data` buffer as an argument. Execution of the function consists of the following steps:
+
+1. Loading `data` buffer from the sandbox memory (see sandboxing memory get),
+2. Trapping
+
+**complexity**: The complexity of this function is proportional to the size of the `data` buffer.
+
+## ext_deposit_event
+
+This function receives a `data` buffer as an argument. Execution of the function consists of the following steps:
+
+1. Loading `data` buffer from the sandbox memory (see sandboxing memory get),
+2. Insert to nested context execution
+3. Copies from nested to underlying contexts
+4. Call system deposit event
+
+**complexity**: The complexity of this function is proportional to the size of the `data` buffer.
+
+## ext_caller
+
+This function serializes the address of the caller into the scratch buffer.
+
+**complexity**: Assuming that the address is of constant size, this function has constant complexity.
+
+## ext_random
+
+This function serializes a random number generated by the given subject into the scratch buffer.
+The complexity of this function highly depends on the complexity of `System::random`. `max_subject_len`
+limits the size of the subject buffer.
+
+**complexity**: The complexity of this function depends on the implementation of `System::random`.
+
+## ext_now
+
+This function serializes the current block's timestamp into the scratch buffer.
+
+**complexity**: Assuming that the timestamp is of constant size, this function has constant complexity.
+
+## ext_scratch_size
+
+This function returns the size of the scratch buffer.
+
+**complexity**: This function is of constant complexity.
+
+## ext_scratch_read
+
+This function copies slice of data from the scratch buffer to the sandbox memory. The calling code specifies the slice length. Execution of the function consists of the following steps:
+
+1. Storing a specified slice of the scratch buffer into the sandbox memory (see sandboxing memory set)
+
+**complexity**: The computing complexity of this function is proportional to the length of the slice. No additional memory is required.
+
+## ext_scratch_write
+
+This function copies slice of data from the sandbox memory to the scratch buffer. The calling code specifies the slice length. Execution of the function consists of the following steps:
+
+1. Loading a slice from the sandbox memory into the (see sandboxing memory get)
+
+**complexity**: Complexity is proportional to the length of the slice.
+
+## ext_set_rent_allowance
+
+This function receives the following argument:
+
+- `value` buffer of a marshaled `Balance`,
+
+It consists of the following steps:
+
+1. Loading `value` buffer from the sandbox memory and then decoding it.
+2. Invoking `set_rent_allowance` AccountDB function.
+
+**complexity**: Complexity is proportional to the size of the `value`. This function induces a DB write of size proportional to the `value` size (if flushed to the storage), so should be priced accordingly.
+
+## ext_rent_allowance
+
+It consists of the following steps:
+
+1. Invoking `get_rent_allowance` AccountDB function.
+2. Serializing the rent allowance of the current contract into the scratch buffer.
+
+**complexity**: Assuming that the rent allowance is of constant size, this function has constant complexity. This
+function performs a DB read.
+
+## ext_block_number
+
+This function serializes the current block's number into the scratch buffer.
+
+**complexity**: Assuming that the block number is of constant size, this function has constant complexity.

substrate/frame/contracts/Cargo.toml

@@ -0,0 +1,45 @@
+[package]
+name = "pallet-contracts"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+pwasm-utils = { version = "0.11.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+parity-wasm = { version = "0.40.3", default-features = false }
+wasmi-validation = { version = "0.2.0", default-features = false }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sandbox = { package = "sr-sandbox", path = "../../primitives/sr-sandbox", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+wabt = "0.9.2"
+assert_matches = "1.3.0"
+hex-literal = "0.2.1"
+balances = { package = "pallet-balances", path = "../balances" }
+hex = "0.3.2"
+timestamp = { package = "pallet-timestamp", path = "../timestamp" }
+randomness-collective-flip = { package = "pallet-randomness-collective-flip", path = "../randomness-collective-flip" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"primitives/std",
+	"sr-primitives/std",
+	"runtime-io/std",
+	"rstd/std",
+	"sandbox/std",
+	"support/std",
+	"system/std",
+	"parity-wasm/std",
+	"pwasm-utils/std",
+	"wasmi-validation/std",
+]

substrate/frame/contracts/rpc/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "pallet-contracts-rpc"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+client = { package = "substrate-client", path = "../../../client/" }
+codec = { package = "parity-scale-codec", version = "1.0.0" }
+jsonrpc-core = "14.0.3"
+jsonrpc-core-client = "14.0.3"
+jsonrpc-derive = "14.0.3"
+primitives = { package = "substrate-primitives",  path = "../../../primitives/core" }
+rpc-primitives = { package = "substrate-rpc-primitives", path = "../../../primitives/rpc" }
+serde = { version = "1.0.101", features = ["derive"] }
+sr-primitives = { path = "../../../primitives/sr-primitives" }
+pallet-contracts-rpc-runtime-api = { path = "./runtime-api" }

substrate/frame/contracts/rpc/runtime-api/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "pallet-contracts-rpc-runtime-api"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+sr-api = { path = "../../../../primitives/sr-api", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../../../primitives/sr-std", default-features = false }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+sr-primitives = { path = "../../../../primitives/sr-primitives", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"sr-api/std",
+	"codec/std",
+	"rstd/std",
+	"serde",
+	"sr-primitives/std",
+]

substrate/frame/contracts/rpc/runtime-api/src/lib.rs

@@ -0,0 +1,90 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Runtime API definition required by Contracts RPC extensions.
+//!
+//! This API should be imported and implemented by the runtime,
+//! of a node that wants to use the custom RPC extension
+//! adding Contracts access methods.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::vec::Vec;
+use codec::{Encode, Decode, Codec};
+use sr_primitives::RuntimeDebug;
+
+/// A result of execution of a contract.
+#[derive(Eq, PartialEq, Encode, Decode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(serde::Serialize, serde::Deserialize))]
+pub enum ContractExecResult {
+	/// The contract returned successfully.
+	///
+	/// There is a status code and, optionally, some data returned by the contract.
+	Success {
+		/// Status code returned by the contract.
+		status: u8,
+		/// Output data returned by the contract.
+		///
+		/// Can be empty.
+		data: Vec<u8>,
+	},
+	/// The contract execution either trapped or returned an error.
+	Error,
+}
+
+/// A result type of the get storage call.
+///
+/// See [`ContractsApi::get_storage`] for more info.
+pub type GetStorageResult = Result<Option<Vec<u8>>, GetStorageError>;
+
+/// The possible errors that can happen querying the storage of a contract.
+#[derive(Eq, PartialEq, Encode, Decode, RuntimeDebug)]
+pub enum GetStorageError {
+	/// The given address doesn't point on a contract.
+	ContractDoesntExist,
+	/// The specified contract is a tombstone and thus cannot have any storage.
+	IsTombstone,
+}
+
+sr_api::decl_runtime_apis! {
+	/// The API to interact with contracts without using executive.
+	pub trait ContractsApi<AccountId, Balance> where
+		AccountId: Codec,
+		Balance: Codec,
+	{
+		/// Perform a call from a specified account to a given contract.
+		///
+		/// See the contracts' `call` dispatchable function for more details.
+		fn call(
+			origin: AccountId,
+			dest: AccountId,
+			value: Balance,
+			gas_limit: u64,
+			input_data: Vec<u8>,
+		) -> ContractExecResult;
+
+		/// Query a given storage key in a given contract.
+		///
+		/// Returns `Ok(Some(Vec<u8>))` if the storage value exists under the given key in the
+		/// specified account and `Ok(None)` if it doesn't. If the account specified by the address
+		/// doesn't exist, or doesn't have a contract or if the contract is a tombstone, then `Err`
+		/// is returned.
+		fn get_storage(
+			address: AccountId,
+			key: [u8; 32],
+		) -> GetStorageResult;
+	}
+}

substrate/frame/contracts/rpc/src/lib.rs

@@ -0,0 +1,187 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Node-specific RPC methods for interaction with contracts.
+
+use std::sync::Arc;
+
+use client::blockchain::HeaderBackend;
+use codec::Codec;
+use jsonrpc_core::{Error, ErrorCode, Result};
+use jsonrpc_derive::rpc;
+use primitives::{H256, Bytes};
+use rpc_primitives::number;
+use serde::{Deserialize, Serialize};
+use sr_primitives::{
+	generic::BlockId,
+	traits::{Block as BlockT, ProvideRuntimeApi},
+};
+
+pub use self::gen_client::Client as ContractsClient;
+pub use pallet_contracts_rpc_runtime_api::{
+	self as runtime_api, ContractExecResult, ContractsApi as ContractsRuntimeApi, GetStorageResult,
+};
+
+const RUNTIME_ERROR: i64 = 1;
+const CONTRACT_DOESNT_EXIST: i64 = 2;
+const CONTRACT_IS_A_TOMBSTONE: i64 = 3;
+
+// A private newtype for converting `GetStorageError` into an RPC error.
+struct GetStorageError(runtime_api::GetStorageError);
+impl From<GetStorageError> for Error {
+	fn from(e: GetStorageError) -> Error {
+		use runtime_api::GetStorageError::*;
+		match e.0 {
+			ContractDoesntExist => Error {
+				code: ErrorCode::ServerError(CONTRACT_DOESNT_EXIST),
+				message: "The specified contract doesn't exist.".into(),
+				data: None,
+			},
+			IsTombstone => Error {
+				code: ErrorCode::ServerError(CONTRACT_IS_A_TOMBSTONE),
+				message: "The contract is a tombstone and doesn't have any storage.".into(),
+				data: None,
+			}
+		}
+	}
+}
+
+/// A struct that encodes RPC parameters required for a call to a smart-contract.
+#[derive(Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+pub struct CallRequest<AccountId, Balance> {
+	origin: AccountId,
+	dest: AccountId,
+	value: Balance,
+	gas_limit: number::NumberOrHex<u64>,
+	input_data: Bytes,
+}
+
+/// Contracts RPC methods.
+#[rpc]
+pub trait ContractsApi<BlockHash, AccountId, Balance> {
+	/// Executes a call to a contract.
+	///
+	/// This call is performed locally without submitting any transactions. Thus executing this
+	/// won't change any state. Nonetheless, the calling state-changing contracts is still possible.
+	///
+	/// This method is useful for calling getter-like methods on contracts.
+	#[rpc(name = "contracts_call")]
+	fn call(
+		&self,
+		call_request: CallRequest<AccountId, Balance>,
+		at: Option<BlockHash>,
+	) -> Result<ContractExecResult>;
+
+	/// Returns the value under a specified storage `key` in a contract given by `address` param,
+	/// or `None` if it is not set.
+	#[rpc(name = "contracts_getStorage")]
+	fn get_storage(
+		&self,
+		address: AccountId,
+		key: H256,
+		at: Option<BlockHash>,
+	) -> Result<Option<Bytes>>;
+}
+
+/// An implementation of contract specific RPC methods.
+pub struct Contracts<C, B> {
+	client: Arc<C>,
+	_marker: std::marker::PhantomData<B>,
+}
+
+impl<C, B> Contracts<C, B> {
+	/// Create new `Contracts` with the given reference to the client.
+	pub fn new(client: Arc<C>) -> Self {
+		Contracts {
+			client,
+			_marker: Default::default(),
+		}
+	}
+}
+
+impl<C, Block, AccountId, Balance> ContractsApi<<Block as BlockT>::Hash, AccountId, Balance>
+	for Contracts<C, Block>
+where
+	Block: BlockT,
+	C: Send + Sync + 'static,
+	C: ProvideRuntimeApi,
+	C: HeaderBackend<Block>,
+	C::Api: ContractsRuntimeApi<Block, AccountId, Balance>,
+	AccountId: Codec,
+	Balance: Codec,
+{
+	fn call(
+		&self,
+		call_request: CallRequest<AccountId, Balance>,
+		at: Option<<Block as BlockT>::Hash>,
+	) -> Result<ContractExecResult> {
+		let api = self.client.runtime_api();
+		let at = BlockId::hash(at.unwrap_or_else(||
+			// If the block hash is not supplied assume the best block.
+			self.client.info().best_hash));
+
+		let CallRequest {
+			origin,
+			dest,
+			value,
+			gas_limit,
+			input_data,
+		} = call_request;
+		let gas_limit = gas_limit.to_number().map_err(|e| Error {
+			code: ErrorCode::InvalidParams,
+			message: e,
+			data: None,
+		})?;
+
+		let exec_result = api
+			.call(&at, origin, dest, value, gas_limit, input_data.to_vec())
+			.map_err(|e| Error {
+				code: ErrorCode::ServerError(RUNTIME_ERROR),
+				message: "Runtime trapped while executing a contract.".into(),
+				data: Some(format!("{:?}", e).into()),
+			})?;
+
+		Ok(exec_result)
+	}
+
+	fn get_storage(
+		&self,
+		address: AccountId,
+		key: H256,
+		at: Option<<Block as BlockT>::Hash>,
+	) -> Result<Option<Bytes>> {
+		let api = self.client.runtime_api();
+		let at = BlockId::hash(at.unwrap_or_else(||
+			// If the block hash is not supplied assume the best block.
+			self.client.info().best_hash));
+
+		let get_storage_result = api
+			.get_storage(&at, address, key.into())
+			.map_err(|e|
+				// Handle general API calling errors.
+				Error {
+					code: ErrorCode::ServerError(RUNTIME_ERROR),
+					message: "Runtime trapped while querying storage.".into(),
+					data: Some(format!("{:?}", e).into()),
+				})?
+			.map_err(GetStorageError)?
+			.map(Bytes);
+
+		Ok(get_storage_result)
+	}
+}

substrate/frame/contracts/src/account_db.rs

@@ -0,0 +1,391 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+//! Auxiliaries to help with managing partial changes to accounts state.
+
+use super::{
+	AliveContractInfo, BalanceOf, CodeHash, ContractInfo, ContractInfoOf, Trait, TrieId,
+	TrieIdGenerator,
+};
+use crate::exec::StorageKey;
+use rstd::cell::RefCell;
+use rstd::collections::btree_map::{BTreeMap, Entry};
+use rstd::prelude::*;
+use runtime_io::hashing::blake2_256;
+use sr_primitives::traits::{Bounded, Zero};
+use support::traits::{Currency, Get, Imbalance, SignedImbalance, UpdateBalanceOutcome};
+use support::{storage::child, StorageMap};
+use system;
+
+// Note: we don't provide Option<Contract> because we can't create
+// the trie_id in the overlay, thus we provide an overlay on the fields
+// specifically.
+pub struct ChangeEntry<T: Trait> {
+	/// If Some(_), then the account balance is modified to the value. If None and `reset` is false,
+	/// the balance unmodified. If None and `reset` is true, the balance is reset to 0.
+	balance: Option<BalanceOf<T>>,
+	/// If Some(_), then a contract is instantiated with the code hash. If None and `reset` is false,
+	/// then the contract code is unmodified. If None and `reset` is true, the contract is deleted.
+	code_hash: Option<CodeHash<T>>,
+	/// If Some(_), then the rent allowance is set to the value. If None and `reset` is false, then
+	/// the rent allowance is unmodified. If None and `reset` is true, the contract is deleted.
+	rent_allowance: Option<BalanceOf<T>>,
+	storage: BTreeMap<StorageKey, Option<Vec<u8>>>,
+	/// If true, indicates that the existing contract and all its storage entries should be removed
+	/// and replaced with the fields on this change entry. Otherwise, the fields on this change
+	/// entry are updates merged into the existing contract info and storage.
+	reset: bool,
+}
+
+impl<T: Trait> ChangeEntry<T> {
+	fn balance(&self) -> Option<BalanceOf<T>> {
+		self.balance.or_else(|| {
+			if self.reset {
+				Some(<BalanceOf<T>>::zero())
+			} else {
+				None
+			}
+		})
+	}
+
+	fn code_hash(&self) -> Option<Option<CodeHash<T>>> {
+		if self.reset {
+			Some(self.code_hash)
+		} else {
+			self.code_hash.map(Some)
+		}
+	}
+
+	fn rent_allowance(&self) -> Option<Option<BalanceOf<T>>> {
+		if self.reset {
+			Some(self.rent_allowance)
+		} else {
+			self.rent_allowance.map(Some)
+		}
+	}
+
+	fn storage(&self, location: &StorageKey) -> Option<Option<Vec<u8>>> {
+		let value = self.storage.get(location).cloned();
+		if self.reset {
+			Some(value.unwrap_or(None))
+		} else {
+			value
+		}
+	}
+}
+
+// Cannot derive(Default) since it erroneously bounds T by Default.
+impl<T: Trait> Default for ChangeEntry<T> {
+	fn default() -> Self {
+		ChangeEntry {
+			rent_allowance: Default::default(),
+			balance: Default::default(),
+			code_hash: Default::default(),
+			storage: Default::default(),
+			reset: false,
+		}
+	}
+}
+
+pub type ChangeSet<T> = BTreeMap<<T as system::Trait>::AccountId, ChangeEntry<T>>;
+
+pub trait AccountDb<T: Trait> {
+	/// Account is used when overlayed otherwise trie_id must be provided.
+	/// This is for performance reason.
+	///
+	/// Trie id is None iff account doesn't have an associated trie id in <ContractInfoOf<T>>.
+	/// Because DirectAccountDb bypass the lookup for this association.
+	fn get_storage(&self, account: &T::AccountId, trie_id: Option<&TrieId>, location: &StorageKey) -> Option<Vec<u8>>;
+	/// If account has an alive contract then return the code hash associated.
+	fn get_code_hash(&self, account: &T::AccountId) -> Option<CodeHash<T>>;
+	/// If account has an alive contract then return the rent allowance associated.
+	fn get_rent_allowance(&self, account: &T::AccountId) -> Option<BalanceOf<T>>;
+	/// Returns false iff account has no alive contract nor tombstone.
+	fn contract_exists(&self, account: &T::AccountId) -> bool;
+	fn get_balance(&self, account: &T::AccountId) -> BalanceOf<T>;
+
+	fn commit(&mut self, change_set: ChangeSet<T>);
+}
+
+pub struct DirectAccountDb;
+impl<T: Trait> AccountDb<T> for DirectAccountDb {
+	fn get_storage(
+		&self,
+		_account: &T::AccountId,
+		trie_id: Option<&TrieId>,
+		location: &StorageKey
+	) -> Option<Vec<u8>> {
+		trie_id.and_then(|id| child::get_raw(id, &blake2_256(location)))
+	}
+	fn get_code_hash(&self, account: &T::AccountId) -> Option<CodeHash<T>> {
+		<ContractInfoOf<T>>::get(account).and_then(|i| i.as_alive().map(|i| i.code_hash))
+	}
+	fn get_rent_allowance(&self, account: &T::AccountId) -> Option<BalanceOf<T>> {
+		<ContractInfoOf<T>>::get(account).and_then(|i| i.as_alive().map(|i| i.rent_allowance))
+	}
+	fn contract_exists(&self, account: &T::AccountId) -> bool {
+		<ContractInfoOf<T>>::exists(account)
+	}
+	fn get_balance(&self, account: &T::AccountId) -> BalanceOf<T> {
+		T::Currency::free_balance(account)
+	}
+	fn commit(&mut self, s: ChangeSet<T>) {
+		let mut total_imbalance = SignedImbalance::zero();
+		for (address, changed) in s.into_iter() {
+			if let Some(balance) = changed.balance() {
+				let (imbalance, outcome) = T::Currency::make_free_balance_be(&address, balance);
+				total_imbalance = total_imbalance.merge(imbalance);
+				if let UpdateBalanceOutcome::AccountKilled = outcome {
+					// Account killed. This will ultimately lead to calling `OnFreeBalanceZero` callback
+					// which will make removal of CodeHashOf and AccountStorage for this account.
+					// In order to avoid writing over the deleted properties we `continue` here.
+					continue;
+				}
+			}
+
+			if changed.code_hash().is_some()
+				|| changed.rent_allowance().is_some()
+				|| !changed.storage.is_empty()
+				|| changed.reset
+			{
+				let old_info = match <ContractInfoOf<T>>::get(&address) {
+					Some(ContractInfo::Alive(alive)) => Some(alive),
+					None => None,
+					// Cannot commit changes to tombstone contract
+					Some(ContractInfo::Tombstone(_)) => continue,
+				};
+
+				let mut new_info = match (changed.reset, old_info.clone(), changed.code_hash) {
+					// Existing contract is being modified.
+					(false, Some(info), _) => info,
+					// Existing contract is being removed.
+					(true, Some(info), None) => {
+						child::kill_storage(&info.trie_id);
+						<ContractInfoOf<T>>::remove(&address);
+						continue;
+					}
+					// Existing contract is being replaced by a new one.
+					(true, Some(info), Some(code_hash)) => {
+						child::kill_storage(&info.trie_id);
+						AliveContractInfo::<T> {
+							code_hash,
+							storage_size: T::StorageSizeOffset::get(),
+							trie_id: <T as Trait>::TrieIdGenerator::trie_id(&address),
+							deduct_block: <system::Module<T>>::block_number(),
+							rent_allowance: <BalanceOf<T>>::max_value(),
+							last_write: None,
+						}
+					}
+					// New contract is being instantiated.
+					(_, None, Some(code_hash)) => {
+						AliveContractInfo::<T> {
+							code_hash,
+							storage_size: T::StorageSizeOffset::get(),
+							trie_id: <T as Trait>::TrieIdGenerator::trie_id(&address),
+							deduct_block: <system::Module<T>>::block_number(),
+							rent_allowance: <BalanceOf<T>>::max_value(),
+							last_write: None,
+						}
+					}
+					// There is no existing at the address nor a new one to be instantiated.
+					(_, None, None) => continue,
+				};
+
+				if let Some(rent_allowance) = changed.rent_allowance {
+					new_info.rent_allowance = rent_allowance;
+				}
+
+				if let Some(code_hash) = changed.code_hash {
+					new_info.code_hash = code_hash;
+				}
+
+				if !changed.storage.is_empty() {
+					new_info.last_write = Some(<system::Module<T>>::block_number());
+				}
+
+				for (k, v) in changed.storage.into_iter() {
+					if let Some(value) = child::get_raw(&new_info.trie_id[..], &blake2_256(&k)) {
+						new_info.storage_size -= value.len() as u32;
+					}
+					if let Some(value) = v {
+						new_info.storage_size += value.len() as u32;
+						child::put_raw(&new_info.trie_id[..], &blake2_256(&k), &value[..]);
+					} else {
+						child::kill(&new_info.trie_id[..], &blake2_256(&k));
+					}
+				}
+
+				if old_info
+					.map(|old_info| old_info != new_info)
+					.unwrap_or(true)
+				{
+					<ContractInfoOf<T>>::insert(&address, ContractInfo::Alive(new_info));
+				}
+			}
+		}
+
+		match total_imbalance {
+			// If we've detected a positive imbalance as a result of our contract-level machinations
+			// then it's indicative of a buggy contracts system.
+			// Panicking is far from ideal as it opens up a DoS attack on block validators, however
+			// it's a less bad option than allowing arbitrary value to be created.
+			SignedImbalance::Positive(ref p) if !p.peek().is_zero() =>
+				panic!("contract subsystem resulting in positive imbalance!"),
+			_ => {}
+		}
+	}
+}
+pub struct OverlayAccountDb<'a, T: Trait + 'a> {
+	local: RefCell<ChangeSet<T>>,
+	underlying: &'a dyn AccountDb<T>,
+}
+impl<'a, T: Trait> OverlayAccountDb<'a, T> {
+	pub fn new(underlying: &'a dyn AccountDb<T>) -> OverlayAccountDb<'a, T> {
+		OverlayAccountDb {
+			local: RefCell::new(ChangeSet::new()),
+			underlying,
+		}
+	}
+
+	pub fn into_change_set(self) -> ChangeSet<T> {
+		self.local.into_inner()
+	}
+
+	pub fn set_storage(
+		&mut self,
+		account: &T::AccountId,
+		location: StorageKey,
+		value: Option<Vec<u8>>,
+	) {
+		self.local.borrow_mut()
+			.entry(account.clone())
+			.or_insert(Default::default())
+			.storage
+			.insert(location, value);
+	}
+
+	/// Return an error if contract already exists (either if it is alive or tombstone)
+	pub fn instantiate_contract(
+		&mut self,
+		account: &T::AccountId,
+		code_hash: CodeHash<T>,
+	) -> Result<(), &'static str> {
+		if self.contract_exists(account) {
+			return Err("Alive contract or tombstone already exists");
+		}
+
+		let mut local = self.local.borrow_mut();
+		let contract = local.entry(account.clone()).or_insert_with(|| Default::default());
+
+		contract.code_hash = Some(code_hash);
+		contract.rent_allowance = Some(<BalanceOf<T>>::max_value());
+
+		Ok(())
+	}
+
+	/// Mark a contract as deleted.
+	pub fn destroy_contract(&mut self, account: &T::AccountId) {
+		let mut local = self.local.borrow_mut();
+		local.insert(
+			account.clone(),
+			ChangeEntry {
+				reset: true,
+				..Default::default()
+			}
+		);
+	}
+
+	/// Assume contract exists
+	pub fn set_rent_allowance(&mut self, account: &T::AccountId, rent_allowance: BalanceOf<T>) {
+		self.local
+			.borrow_mut()
+			.entry(account.clone())
+			.or_insert(Default::default())
+			.rent_allowance = Some(rent_allowance);
+	}
+	pub fn set_balance(&mut self, account: &T::AccountId, balance: BalanceOf<T>) {
+		self.local
+			.borrow_mut()
+			.entry(account.clone())
+			.or_insert(Default::default())
+			.balance = Some(balance);
+	}
+}
+
+impl<'a, T: Trait> AccountDb<T> for OverlayAccountDb<'a, T> {
+	fn get_storage(
+		&self,
+		account: &T::AccountId,
+		trie_id: Option<&TrieId>,
+		location: &StorageKey
+	) -> Option<Vec<u8>> {
+		self.local
+			.borrow()
+			.get(account)
+			.and_then(|changes| changes.storage(location))
+			.unwrap_or_else(|| self.underlying.get_storage(account, trie_id, location))
+	}
+	fn get_code_hash(&self, account: &T::AccountId) -> Option<CodeHash<T>> {
+		self.local
+			.borrow()
+			.get(account)
+			.and_then(|changes| changes.code_hash())
+			.unwrap_or_else(|| self.underlying.get_code_hash(account))
+	}
+	fn get_rent_allowance(&self, account: &T::AccountId) -> Option<BalanceOf<T>> {
+		self.local
+			.borrow()
+			.get(account)
+			.and_then(|changes| changes.rent_allowance())
+			.unwrap_or_else(|| self.underlying.get_rent_allowance(account))
+	}
+	fn contract_exists(&self, account: &T::AccountId) -> bool {
+		self.local
+			.borrow()
+			.get(account)
+			.and_then(|changes| changes.code_hash().map(|code_hash| code_hash.is_some()))
+			.unwrap_or_else(|| self.underlying.contract_exists(account))
+	}
+	fn get_balance(&self, account: &T::AccountId) -> BalanceOf<T> {
+		self.local
+			.borrow()
+			.get(account)
+			.and_then(|changes| changes.balance())
+			.unwrap_or_else(|| self.underlying.get_balance(account))
+	}
+	fn commit(&mut self, s: ChangeSet<T>) {
+		let mut local = self.local.borrow_mut();
+
+		for (address, changed) in s.into_iter() {
+			match local.entry(address) {
+				Entry::Occupied(e) => {
+					let mut value = e.into_mut();
+					if changed.reset {
+						*value = changed;
+					} else {
+						value.balance = changed.balance.or(value.balance);
+						value.code_hash = changed.code_hash.or(value.code_hash);
+						value.rent_allowance = changed.rent_allowance.or(value.rent_allowance);
+						value.storage.extend(changed.storage.into_iter());
+					}
+				}
+				Entry::Vacant(e) => {
+					e.insert(changed);
+				}
+			}
+		}
+	}
+}

substrate/frame/contracts/src/gas.rs

@@ -0,0 +1,384 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+use crate::{GasSpent, Module, Trait, BalanceOf, NegativeImbalanceOf};
+use rstd::convert::TryFrom;
+use sr_primitives::traits::{
+	CheckedMul, Zero, SaturatedConversion, SimpleArithmetic, UniqueSaturatedInto,
+};
+use support::{
+	traits::{Currency, ExistenceRequirement, Imbalance, OnUnbalanced, WithdrawReason}, StorageValue,
+};
+
+#[cfg(test)]
+use std::{any::Any, fmt::Debug};
+
+// Gas units are chosen to be represented by u64 so that gas metering instructions can operate on
+// them efficiently.
+pub type Gas = u64;
+
+#[must_use]
+#[derive(Debug, PartialEq, Eq)]
+pub enum GasMeterResult {
+	Proceed,
+	OutOfGas,
+}
+
+impl GasMeterResult {
+	pub fn is_out_of_gas(&self) -> bool {
+		match *self {
+			GasMeterResult::OutOfGas => true,
+			GasMeterResult::Proceed => false,
+		}
+	}
+}
+
+#[cfg(not(test))]
+pub trait TestAuxiliaries {}
+#[cfg(not(test))]
+impl<T> TestAuxiliaries for T {}
+
+#[cfg(test)]
+pub trait TestAuxiliaries: Any + Debug + PartialEq + Eq {}
+#[cfg(test)]
+impl<T: Any + Debug + PartialEq + Eq> TestAuxiliaries for T {}
+
+/// This trait represents a token that can be used for charging `GasMeter`.
+/// There is no other way of charging it.
+///
+/// Implementing type is expected to be super lightweight hence `Copy` (`Clone` is added
+/// for consistency). If inlined there should be no observable difference compared
+/// to a hand-written code.
+pub trait Token<T: Trait>: Copy + Clone + TestAuxiliaries {
+	/// Metadata type, which the token can require for calculating the amount
+	/// of gas to charge. Can be a some configuration type or
+	/// just the `()`.
+	type Metadata;
+
+	/// Calculate amount of gas that should be taken by this token.
+	///
+	/// This function should be really lightweight and must not fail. It is not
+	/// expected that implementors will query the storage or do any kinds of heavy operations.
+	///
+	/// That said, implementors of this function still can run into overflows
+	/// while calculating the amount. In this case it is ok to use saturating operations
+	/// since on overflow they will return `max_value` which should consume all gas.
+	fn calculate_amount(&self, metadata: &Self::Metadata) -> Gas;
+}
+
+/// A wrapper around a type-erased trait object of what used to be a `Token`.
+#[cfg(test)]
+pub struct ErasedToken {
+	pub description: String,
+	pub token: Box<dyn Any>,
+}
+
+pub struct GasMeter<T: Trait> {
+	limit: Gas,
+	/// Amount of gas left from initial gas limit. Can reach zero.
+	gas_left: Gas,
+	gas_price: BalanceOf<T>,
+
+	#[cfg(test)]
+	tokens: Vec<ErasedToken>,
+}
+impl<T: Trait> GasMeter<T> {
+	pub fn with_limit(gas_limit: Gas, gas_price: BalanceOf<T>) -> GasMeter<T> {
+		GasMeter {
+			limit: gas_limit,
+			gas_left: gas_limit,
+			gas_price,
+			#[cfg(test)]
+			tokens: Vec::new(),
+		}
+	}
+
+	/// Account for used gas.
+	///
+	/// Amount is calculated by the given `token`.
+	///
+	/// Returns `OutOfGas` if there is not enough gas or addition of the specified
+	/// amount of gas has lead to overflow. On success returns `Proceed`.
+	///
+	/// NOTE that amount is always consumed, i.e. if there is not enough gas
+	/// then the counter will be set to zero.
+	#[inline]
+	pub fn charge<Tok: Token<T>>(
+		&mut self,
+		metadata: &Tok::Metadata,
+		token: Tok,
+	) -> GasMeterResult {
+		#[cfg(test)]
+		{
+			// Unconditionally add the token to the storage.
+			let erased_tok = ErasedToken {
+				description: format!("{:?}", token),
+				token: Box::new(token),
+			};
+			self.tokens.push(erased_tok);
+		}
+
+		let amount = token.calculate_amount(metadata);
+		let new_value = match self.gas_left.checked_sub(amount) {
+			None => None,
+			Some(val) => Some(val),
+		};
+
+		// We always consume the gas even if there is not enough gas.
+		self.gas_left = new_value.unwrap_or_else(Zero::zero);
+
+		match new_value {
+			Some(_) => GasMeterResult::Proceed,
+			None => GasMeterResult::OutOfGas,
+		}
+	}
+
+	/// Allocate some amount of gas and perform some work with
+	/// a newly created nested gas meter.
+	///
+	/// Invokes `f` with either the gas meter that has `amount` gas left or
+	/// with `None`, if this gas meter has not enough gas to allocate given `amount`.
+	///
+	/// All unused gas in the nested gas meter is returned to this gas meter.
+	pub fn with_nested<R, F: FnOnce(Option<&mut GasMeter<T>>) -> R>(
+		&mut self,
+		amount: Gas,
+		f: F,
+	) -> R {
+		// NOTE that it is ok to allocate all available gas since it still ensured
+		// by `charge` that it doesn't reach zero.
+		if self.gas_left < amount {
+			f(None)
+		} else {
+			self.gas_left = self.gas_left - amount;
+			let mut nested = GasMeter::with_limit(amount, self.gas_price);
+
+			let r = f(Some(&mut nested));
+
+			self.gas_left = self.gas_left + nested.gas_left;
+
+			r
+		}
+	}
+
+	pub fn gas_price(&self) -> BalanceOf<T> {
+		self.gas_price
+	}
+
+	/// Returns how much gas left from the initial budget.
+	pub fn gas_left(&self) -> Gas {
+		self.gas_left
+	}
+
+	/// Returns how much gas was spent.
+	fn spent(&self) -> Gas {
+		self.limit - self.gas_left
+	}
+
+	#[cfg(test)]
+	pub fn tokens(&self) -> &[ErasedToken] {
+		&self.tokens
+	}
+}
+
+/// Buy the given amount of gas.
+///
+/// Cost is calculated by multiplying the gas cost (taken from the storage) by the `gas_limit`.
+/// The funds are deducted from `transactor`.
+pub fn buy_gas<T: Trait>(
+	transactor: &T::AccountId,
+	gas_limit: Gas,
+) -> Result<(GasMeter<T>, NegativeImbalanceOf<T>), &'static str> {
+	// Buy the specified amount of gas.
+	let gas_price = <Module<T>>::gas_price();
+	let cost = if gas_price.is_zero() {
+		<BalanceOf<T>>::zero()
+	} else {
+		<BalanceOf<T> as TryFrom<Gas>>::try_from(gas_limit).ok()
+			.and_then(|gas_limit| gas_price.checked_mul(&gas_limit))
+			.ok_or("overflow multiplying gas limit by price")?
+	};
+
+	let imbalance = T::Currency::withdraw(
+		transactor,
+		cost,
+		WithdrawReason::Fee.into(),
+		ExistenceRequirement::KeepAlive
+	)?;
+
+	Ok((GasMeter::with_limit(gas_limit, gas_price), imbalance))
+}
+
+/// Refund the unused gas.
+pub fn refund_unused_gas<T: Trait>(
+	transactor: &T::AccountId,
+	gas_meter: GasMeter<T>,
+	imbalance: NegativeImbalanceOf<T>,
+) {
+	let gas_spent = gas_meter.spent();
+	let gas_left = gas_meter.gas_left();
+
+	// Increase total spent gas.
+	// This cannot overflow, since `gas_spent` is never greater than `block_gas_limit`, which
+	// also has Gas type.
+	GasSpent::mutate(|block_gas_spent| *block_gas_spent += gas_spent);
+
+	// Refund gas left by the price it was bought at.
+	let refund = gas_meter.gas_price * gas_left.unique_saturated_into();
+	let refund_imbalance = T::Currency::deposit_creating(transactor, refund);
+	if let Ok(imbalance) = imbalance.offset(refund_imbalance) {
+		T::GasPayment::on_unbalanced(imbalance);
+	}
+}
+
+/// A little handy utility for converting a value in balance units into approximate value in gas units
+/// at the given gas price.
+pub fn approx_gas_for_balance<Balance>(gas_price: Balance, balance: Balance) -> Gas
+	where Balance: SimpleArithmetic
+{
+	(balance / gas_price).saturated_into::<Gas>()
+}
+
+/// A simple utility macro that helps to match against a
+/// list of tokens.
+#[macro_export]
+macro_rules! match_tokens {
+	($tokens_iter:ident,) => {
+	};
+	($tokens_iter:ident, $x:expr, $($rest:tt)*) => {
+		{
+			let next = ($tokens_iter).next().unwrap();
+			let pattern = $x;
+
+			// Note that we don't specify the type name directly in this macro,
+			// we only have some expression $x of some type. At the same time, we
+			// have an iterator of Box<dyn Any> and to downcast we need to specify
+			// the type which we want downcast to.
+			//
+			// So what we do is we assign `_pattern_typed_next_ref` to a variable which has
+			// the required type.
+			//
+			// Then we make `_pattern_typed_next_ref = token.downcast_ref()`. This makes
+			// rustc infer the type `T` (in `downcast_ref<T: Any>`) to be the same as in $x.
+
+			let mut _pattern_typed_next_ref = &pattern;
+			_pattern_typed_next_ref = match next.token.downcast_ref() {
+				Some(p) => {
+					assert_eq!(p, &pattern);
+					p
+				}
+				None => {
+					panic!("expected type {} got {}", stringify!($x), next.description);
+				}
+			};
+		}
+
+		match_tokens!($tokens_iter, $($rest)*);
+	};
+}
+
+#[cfg(test)]
+mod tests {
+	use super::{GasMeter, Token};
+	use crate::tests::Test;
+
+	/// A trivial token that charges the specified number of gas units.
+	#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+	struct SimpleToken(u64);
+	impl Token<Test> for SimpleToken {
+		type Metadata = ();
+		fn calculate_amount(&self, _metadata: &()) -> u64 { self.0 }
+	}
+
+	struct MultiplierTokenMetadata {
+		multiplier: u64,
+	}
+	/// A simple token that charges for the given amount multiplied to
+	/// a multiplier taken from a given metadata.
+	#[derive(Copy, Clone, PartialEq, Eq, Debug)]
+	struct MultiplierToken(u64);
+
+	impl Token<Test> for MultiplierToken {
+		type Metadata = MultiplierTokenMetadata;
+		fn calculate_amount(&self, metadata: &MultiplierTokenMetadata) -> u64 {
+			// Probably you want to use saturating mul in production code.
+			self.0 * metadata.multiplier
+		}
+	}
+
+	#[test]
+	fn it_works() {
+		let gas_meter = GasMeter::<Test>::with_limit(50000, 10);
+		assert_eq!(gas_meter.gas_left(), 50000);
+	}
+
+	#[test]
+	fn simple() {
+		let mut gas_meter = GasMeter::<Test>::with_limit(50000, 10);
+
+		let result = gas_meter
+			.charge(&MultiplierTokenMetadata { multiplier: 3 }, MultiplierToken(10));
+		assert!(!result.is_out_of_gas());
+
+		assert_eq!(gas_meter.gas_left(), 49_970);
+		assert_eq!(gas_meter.spent(), 30);
+		assert_eq!(gas_meter.gas_price(), 10);
+	}
+
+	#[test]
+	fn tracing() {
+		let mut gas_meter = GasMeter::<Test>::with_limit(50000, 10);
+		assert!(!gas_meter.charge(&(), SimpleToken(1)).is_out_of_gas());
+		assert!(!gas_meter
+			.charge(&MultiplierTokenMetadata { multiplier: 3 }, MultiplierToken(10))
+			.is_out_of_gas());
+
+		let mut tokens = gas_meter.tokens()[0..2].iter();
+		match_tokens!(tokens, SimpleToken(1), MultiplierToken(10),);
+	}
+
+	// This test makes sure that nothing can be executed if there is no gas.
+	#[test]
+	fn refuse_to_execute_anything_if_zero() {
+		let mut gas_meter = GasMeter::<Test>::with_limit(0, 10);
+		assert!(gas_meter.charge(&(), SimpleToken(1)).is_out_of_gas());
+	}
+
+	// Make sure that if the gas meter is charged by exceeding amount then not only an error
+	// returned for that charge, but also for all consequent charges.
+	//
+	// This is not strictly necessary, because the execution should be interrupted immediately
+	// if the gas meter runs out of gas. However, this is just a nice property to have.
+	#[test]
+	fn overcharge_is_unrecoverable() {
+		let mut gas_meter = GasMeter::<Test>::with_limit(200, 10);
+
+		// The first charge is should lead to OOG.
+		assert!(gas_meter.charge(&(), SimpleToken(300)).is_out_of_gas());
+
+		// The gas meter is emptied at this moment, so this should also fail.
+		assert!(gas_meter.charge(&(), SimpleToken(1)).is_out_of_gas());
+	}
+
+
+	// Charging the exact amount that the user paid for should be
+	// possible.
+	#[test]
+	fn charge_exact_amount() {
+		let mut gas_meter = GasMeter::<Test>::with_limit(25, 10);
+		assert!(!gas_meter.charge(&(), SimpleToken(25)).is_out_of_gas());
+	}
+}

substrate/frame/contracts/src/rent.rs

@@ -0,0 +1,194 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+use crate::{BalanceOf, ContractInfo, ContractInfoOf, TombstoneContractInfo, Trait, AliveContractInfo};
+use sr_primitives::traits::{Bounded, CheckedDiv, CheckedMul, Saturating, Zero,
+	SaturatedConversion};
+use support::traits::{Currency, ExistenceRequirement, Get, WithdrawReason, OnUnbalanced};
+use support::StorageMap;
+
+#[derive(PartialEq, Eq, Copy, Clone)]
+#[must_use]
+pub enum RentOutcome {
+	/// Exempted from rent iff:
+	/// * rent is offset completely by the `rent_deposit_offset`,
+	/// * or rent has already been paid for this block number,
+	/// * or account doesn't have a contract,
+	/// * or account has a tombstone.
+	Exempted,
+	/// Evicted iff:
+	/// * rent exceed rent allowance,
+	/// * or can't withdraw the rent,
+	/// * or go below subsistence threshold.
+	Evicted,
+	/// The outstanding dues were paid or were able to be paid.
+	Ok,
+}
+
+/// Evict and optionally pay dues (or check account can pay them otherwise) at the current
+/// block number (modulo `handicap`, read on).
+///
+/// `pay_rent` gives an ability to pay or skip paying rent.
+/// `handicap` gives a way to check or pay the rent up to a moment in the past instead
+/// of current block.
+///
+/// NOTE: This function acts eagerly, all modification are committed into the storage.
+fn try_evict_or_and_pay_rent<T: Trait>(
+	account: &T::AccountId,
+	handicap: T::BlockNumber,
+	pay_rent: bool,
+) -> (RentOutcome, Option<ContractInfo<T>>) {
+	let contract_info = <ContractInfoOf<T>>::get(account);
+	let contract = match contract_info {
+		None | Some(ContractInfo::Tombstone(_)) => return (RentOutcome::Exempted, contract_info),
+		Some(ContractInfo::Alive(contract)) => contract,
+	};
+
+	let current_block_number = <system::Module<T>>::block_number();
+
+	// How much block has passed since the last deduction for the contract.
+	let blocks_passed = {
+		// Calculate an effective block number, i.e. after adjusting for handicap.
+		let effective_block_number = current_block_number.saturating_sub(handicap);
+		let n = effective_block_number.saturating_sub(contract.deduct_block);
+		if n.is_zero() {
+			// Rent has already been paid
+			return (RentOutcome::Exempted, Some(ContractInfo::Alive(contract)));
+		}
+		n
+	};
+
+	let balance = T::Currency::free_balance(account);
+
+	// An amount of funds to charge per block for storage taken up by the contract.
+	let fee_per_block = {
+		let free_storage = balance
+			.checked_div(&T::RentDepositOffset::get())
+			.unwrap_or_else(Zero::zero);
+
+		let effective_storage_size =
+			<BalanceOf<T>>::from(contract.storage_size).saturating_sub(free_storage);
+
+		effective_storage_size
+			.checked_mul(&T::RentByteFee::get())
+			.unwrap_or(<BalanceOf<T>>::max_value())
+	};
+
+	if fee_per_block.is_zero() {
+		// The rent deposit offset reduced the fee to 0. This means that the contract
+		// gets the rent for free.
+		return (RentOutcome::Exempted, Some(ContractInfo::Alive(contract)));
+	}
+
+	// The minimal amount of funds required for a contract not to be evicted.
+	let subsistence_threshold = T::Currency::minimum_balance() + T::TombstoneDeposit::get();
+
+	if balance < subsistence_threshold {
+		// The contract cannot afford to leave a tombstone, so remove the contract info altogether.
+		<ContractInfoOf<T>>::remove(account);
+		runtime_io::storage::child_storage_kill(&contract.trie_id);
+		return (RentOutcome::Evicted, None);
+	}
+
+	let dues = fee_per_block
+		.checked_mul(&blocks_passed.saturated_into::<u32>().into())
+		.unwrap_or(<BalanceOf<T>>::max_value());
+	let rent_budget = contract.rent_allowance.min(balance - subsistence_threshold);
+	let insufficient_rent = rent_budget < dues;
+
+	// If the rent payment cannot be withdrawn due to locks on the account balance, then evict the
+	// account.
+	//
+	// NOTE: This seems problematic because it provides a way to tombstone an account while
+	// avoiding the last rent payment. In effect, someone could retroactively set rent_allowance
+	// for their contract to 0.
+	let dues_limited = dues.min(rent_budget);
+	let can_withdraw_rent = T::Currency::ensure_can_withdraw(
+		account,
+		dues_limited,
+		WithdrawReason::Fee.into(),
+		balance.saturating_sub(dues_limited),
+	)
+	.is_ok();
+
+	if can_withdraw_rent && (insufficient_rent || pay_rent) {
+		// Collect dues.
+		let imbalance = T::Currency::withdraw(
+			account,
+			dues_limited,
+			WithdrawReason::Fee.into(),
+			ExistenceRequirement::KeepAlive,
+		)
+		.expect(
+			"Withdraw has been checked above;
+			dues_limited < rent_budget < balance - subsistence < balance - existential_deposit;
+			qed",
+		);
+
+		T::RentPayment::on_unbalanced(imbalance);
+	}
+
+	if insufficient_rent || !can_withdraw_rent {
+		// The contract cannot afford the rent payment and has a balance above the subsistence
+		// threshold, so it leaves a tombstone.
+
+		// Note: this operation is heavy.
+		let child_storage_root = runtime_io::storage::child_root(&contract.trie_id);
+
+		let tombstone = <TombstoneContractInfo<T>>::new(
+			&child_storage_root[..],
+			contract.code_hash,
+		);
+		let tombstone_info = ContractInfo::Tombstone(tombstone);
+		<ContractInfoOf<T>>::insert(account, &tombstone_info);
+
+		runtime_io::storage::child_storage_kill(&contract.trie_id);
+
+		return (RentOutcome::Evicted, Some(tombstone_info));
+	}
+
+	if pay_rent {
+		let contract_info = ContractInfo::Alive(AliveContractInfo::<T> {
+			rent_allowance: contract.rent_allowance - dues, // rent_allowance is not exceeded
+			deduct_block: current_block_number,
+			..contract
+		});
+
+		<ContractInfoOf<T>>::insert(account, &contract_info);
+
+		return (RentOutcome::Ok, Some(contract_info));
+	}
+
+	(RentOutcome::Ok, Some(ContractInfo::Alive(contract)))
+}
+
+/// Make account paying the rent for the current block number
+///
+/// NOTE: This function acts eagerly.
+pub fn pay_rent<T: Trait>(account: &T::AccountId) -> Option<ContractInfo<T>> {
+	try_evict_or_and_pay_rent::<T>(account, Zero::zero(), true).1
+}
+
+/// Evict the account if it should be evicted at the given block number.
+///
+/// `handicap` gives a way to check or pay the rent up to a moment in the past instead
+/// of current block. E.g. if the contract is going to be evicted at the current block,
+/// `handicap=1` can defer the eviction for 1 block.
+///
+/// NOTE: This function acts eagerly.
+pub fn try_evict<T: Trait>(account: &T::AccountId, handicap: T::BlockNumber) -> RentOutcome {
+	try_evict_or_and_pay_rent::<T>(account, handicap, false).0
+}

substrate/frame/contracts/src/wasm/code_cache.rs

@@ -0,0 +1,104 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+//! A module that implements instrumented code cache.
+//!
+//! - In order to run contract code we need to instrument it with gas metering.
+//! To do that we need to provide the schedule which will supply exact gas costs values.
+//! We cache this code in the storage saving the schedule version.
+//! - Before running contract code we check if the cached code has the schedule version that
+//! is equal to the current saved schedule.
+//! If it is equal then run the code, if it isn't reinstrument with the current schedule.
+//! - When we update the schedule we want it to have strictly greater version than the current saved one:
+//! this guarantees that every instrumented contract code in cache cannot have the version equal to the current one.
+//! Thus, before executing a contract it should be reinstrument with new schedule.
+
+use crate::gas::{Gas, GasMeter, Token};
+use crate::wasm::{prepare, runtime::Env, PrefabWasmModule};
+use crate::{CodeHash, CodeStorage, PristineCode, Schedule, Trait};
+use rstd::prelude::*;
+use sr_primitives::traits::{Hash, Bounded};
+use support::StorageMap;
+
+/// Gas metering token that used for charging storing code into the code storage.
+///
+/// Specifies the code length in bytes.
+#[cfg_attr(test, derive(Debug, PartialEq, Eq))]
+#[derive(Copy, Clone)]
+pub struct PutCodeToken(u32);
+
+impl<T: Trait> Token<T> for PutCodeToken {
+	type Metadata = Schedule;
+
+	fn calculate_amount(&self, metadata: &Schedule) -> Gas {
+		metadata
+			.put_code_per_byte_cost
+			.checked_mul(self.0.into())
+			.unwrap_or_else(|| Bounded::max_value())
+	}
+}
+
+/// Put code in the storage. The hash of code is used as a key and is returned
+/// as a result of this function.
+///
+/// This function instruments the given code and caches it in the storage.
+pub fn save<T: Trait>(
+	original_code: Vec<u8>,
+	gas_meter: &mut GasMeter<T>,
+	schedule: &Schedule,
+) -> Result<CodeHash<T>, &'static str> {
+	// The first time instrumentation is on the user. However, consequent reinstrumentation
+	// due to the schedule changes is on governance system.
+	if gas_meter
+		.charge(schedule, PutCodeToken(original_code.len() as u32))
+		.is_out_of_gas()
+	{
+		return Err("there is not enough gas for storing the code");
+	}
+
+	let prefab_module = prepare::prepare_contract::<Env>(&original_code, schedule)?;
+	let code_hash = T::Hashing::hash(&original_code);
+
+	<CodeStorage<T>>::insert(code_hash, prefab_module);
+	<PristineCode<T>>::insert(code_hash, original_code);
+
+	Ok(code_hash)
+}
+
+/// Load code with the given code hash.
+///
+/// If the module was instrumented with a lower version of schedule than
+/// the current one given as an argument, then this function will perform
+/// re-instrumentation and update the cache in the storage.
+pub fn load<T: Trait>(
+	code_hash: &CodeHash<T>,
+	schedule: &Schedule,
+) -> Result<PrefabWasmModule, &'static str> {
+	let mut prefab_module =
+		<CodeStorage<T>>::get(code_hash).ok_or_else(|| "code is not found")?;
+
+	if prefab_module.schedule_version < schedule.version {
+		// The current schedule version is greater than the version of the one cached
+		// in the storage.
+		//
+		// We need to re-instrument the code with the latest schedule here.
+		let original_code =
+			<PristineCode<T>>::get(code_hash).ok_or_else(|| "pristine code is not found")?;
+		prefab_module = prepare::prepare_contract::<Env>(&original_code, schedule)?;
+		<CodeStorage<T>>::insert(&code_hash, &prefab_module);
+	}
+	Ok(prefab_module)
+}

substrate/frame/contracts/src/wasm/env_def/macros.rs

@@ -0,0 +1,323 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+//! Definition of macros that hides boilerplate of defining external environment
+//! for a wasm module.
+//!
+//! Most likely you should use `define_env` macro.
+
+#[macro_export]
+macro_rules! convert_args {
+	() => (vec![]);
+	( $( $t:ty ),* ) => ( vec![ $( { use $crate::wasm::env_def::ConvertibleToWasm; <$t>::VALUE_TYPE }, )* ] );
+}
+
+#[macro_export]
+macro_rules! gen_signature {
+	( ( $( $params: ty ),* ) ) => (
+		{
+			parity_wasm::elements::FunctionType::new(convert_args!($($params),*), None)
+		}
+	);
+
+	( ( $( $params: ty ),* ) -> $returns: ty ) => (
+		{
+			parity_wasm::elements::FunctionType::new(convert_args!($($params),*), Some({
+				use $crate::wasm::env_def::ConvertibleToWasm; <$returns>::VALUE_TYPE
+			}))
+		}
+	);
+}
+
+#[macro_export]
+macro_rules! gen_signature_dispatch {
+	(
+		$needle_name:ident,
+		$needle_sig:ident ;
+		$name:ident
+		( $ctx:ident $( , $names:ident : $params:ty )* ) $( -> $returns:ty )* , $($rest:tt)* ) => {
+		if stringify!($name).as_bytes() == $needle_name {
+			let signature = gen_signature!( ( $( $params ),* ) $( -> $returns )* );
+			if $needle_sig == &signature {
+				return true;
+			}
+		} else {
+			gen_signature_dispatch!($needle_name, $needle_sig ; $($rest)*);
+		}
+	};
+	( $needle_name:ident, $needle_sig:ident ; ) => {
+	};
+}
+
+/// Unmarshall arguments and then execute `body` expression and return its result.
+macro_rules! unmarshall_then_body {
+	( $body:tt, $ctx:ident, $args_iter:ident, $( $names:ident : $params:ty ),* ) => ({
+		$(
+			let $names : <$params as $crate::wasm::env_def::ConvertibleToWasm>::NativeType =
+				$args_iter.next()
+					.and_then(|v| <$params as $crate::wasm::env_def::ConvertibleToWasm>
+						::from_typed_value(v.clone()))
+					.expect(
+						"precondition: all imports should be checked against the signatures of corresponding
+						functions defined by `define_env!` macro by the user of the macro;
+						signatures of these functions defined by `$params`;
+						calls always made with arguments types of which are defined by the corresponding imports;
+						thus types of arguments should be equal to type list in `$params` and
+						length of argument list and $params should be equal;
+						thus this can never be `None`;
+						qed;
+						"
+					);
+		)*
+		$body
+	})
+}
+
+/// Since we can't specify the type of closure directly at binding site:
+///
+/// ```nocompile
+/// let f: FnOnce() -> Result<<u32 as ConvertibleToWasm>::NativeType, _> = || { /* ... */ };
+/// ```
+///
+/// we use this function to constrain the type of the closure.
+#[inline(always)]
+pub fn constrain_closure<R, F>(f: F) -> F
+where
+	F: FnOnce() -> Result<R, sandbox::HostError>,
+{
+	f
+}
+
+#[macro_export]
+macro_rules! unmarshall_then_body_then_marshall {
+	( $args_iter:ident, $ctx:ident, ( $( $names:ident : $params:ty ),* ) -> $returns:ty => $body:tt ) => ({
+		let body = $crate::wasm::env_def::macros::constrain_closure::<
+			<$returns as $crate::wasm::env_def::ConvertibleToWasm>::NativeType, _
+		>(|| {
+			unmarshall_then_body!($body, $ctx, $args_iter, $( $names : $params ),*)
+		});
+		let r = body()?;
+		return Ok(sandbox::ReturnValue::Value({ use $crate::wasm::env_def::ConvertibleToWasm; r.to_typed_value() }))
+	});
+	( $args_iter:ident, $ctx:ident, ( $( $names:ident : $params:ty ),* ) => $body:tt ) => ({
+		let body = $crate::wasm::env_def::macros::constrain_closure::<(), _>(|| {
+			unmarshall_then_body!($body, $ctx, $args_iter, $( $names : $params ),*)
+		});
+		body()?;
+		return Ok(sandbox::ReturnValue::Unit)
+	})
+}
+
+#[macro_export]
+macro_rules! define_func {
+	( < E: $ext_ty:tt > $name:ident ( $ctx: ident $(, $names:ident : $params:ty)*) $(-> $returns:ty)* => $body:tt ) => {
+		fn $name< E: $ext_ty >(
+			$ctx: &mut $crate::wasm::Runtime<E>,
+			args: &[sandbox::TypedValue],
+		) -> Result<sandbox::ReturnValue, sandbox::HostError> {
+			#[allow(unused)]
+			let mut args = args.iter();
+
+			unmarshall_then_body_then_marshall!(
+				args,
+				$ctx,
+				( $( $names : $params ),* ) $( -> $returns )* => $body
+			)
+		}
+	};
+}
+
+#[macro_export]
+macro_rules! register_func {
+	( $reg_cb:ident, < E: $ext_ty:tt > ; ) => {};
+
+	( $reg_cb:ident, < E: $ext_ty:tt > ;
+		$name:ident ( $ctx:ident $( , $names:ident : $params:ty )* )
+		$( -> $returns:ty )* => $body:tt $($rest:tt)*
+	) => {
+		$reg_cb(
+			stringify!($name).as_bytes(),
+			{
+				define_func!(
+					< E: $ext_ty > $name ( $ctx $(, $names : $params )* ) $( -> $returns )* => $body
+				);
+				$name::<E>
+			}
+		);
+		register_func!( $reg_cb, < E: $ext_ty > ; $($rest)* );
+	};
+}
+
+/// Define a function set that can be imported by executing wasm code.
+///
+/// **NB**: Be advised that all functions defined by this macro
+/// will panic if called with unexpected arguments.
+///
+/// It's up to the user of this macro to check signatures of wasm code to be executed
+/// and reject the code if any imported function has a mismatched signature.
+macro_rules! define_env {
+	( $init_name:ident , < E: $ext_ty:tt > ,
+		$( $name:ident ( $ctx:ident $( , $names:ident : $params:ty )* )
+			$( -> $returns:ty )* => $body:tt , )*
+	) => {
+		pub struct $init_name;
+
+		impl $crate::wasm::env_def::ImportSatisfyCheck for $init_name {
+			fn can_satisfy(name: &[u8], func_type: &parity_wasm::elements::FunctionType) -> bool {
+				gen_signature_dispatch!( name, func_type ; $( $name ( $ctx $(, $names : $params )* ) $( -> $returns )* , )* );
+
+				return false;
+			}
+		}
+
+		impl<E: Ext> $crate::wasm::env_def::FunctionImplProvider<E> for $init_name {
+			fn impls<F: FnMut(&[u8], $crate::wasm::env_def::HostFunc<E>)>(f: &mut F) {
+				register_func!(f, < E: $ext_ty > ; $( $name ( $ctx $( , $names : $params )* ) $( -> $returns)* => $body )* );
+			}
+		}
+	};
+}
+
+#[cfg(test)]
+mod tests {
+	use parity_wasm::elements::FunctionType;
+	use parity_wasm::elements::ValueType;
+	use sr_primitives::traits::Zero;
+	use sandbox::{self, ReturnValue, TypedValue};
+	use crate::wasm::tests::MockExt;
+	use crate::wasm::Runtime;
+	use crate::exec::Ext;
+	use crate::gas::Gas;
+
+	#[test]
+	fn macro_unmarshall_then_body_then_marshall_value_or_trap() {
+		fn test_value(
+			_ctx: &mut u32,
+			args: &[sandbox::TypedValue],
+		) -> Result<ReturnValue, sandbox::HostError> {
+			let mut args = args.iter();
+			unmarshall_then_body_then_marshall!(
+				args,
+				_ctx,
+				(a: u32, b: u32) -> u32 => {
+					if b == 0 {
+						Err(sandbox::HostError)
+					} else {
+						Ok(a / b)
+					}
+				}
+			)
+		}
+
+		let ctx = &mut 0;
+		assert_eq!(
+			test_value(ctx, &[TypedValue::I32(15), TypedValue::I32(3)]).unwrap(),
+			ReturnValue::Value(TypedValue::I32(5)),
+		);
+		assert!(test_value(ctx, &[TypedValue::I32(15), TypedValue::I32(0)]).is_err());
+	}
+
+	#[test]
+	fn macro_unmarshall_then_body_then_marshall_unit() {
+		fn test_unit(
+			ctx: &mut u32,
+			args: &[sandbox::TypedValue],
+		) -> Result<ReturnValue, sandbox::HostError> {
+			let mut args = args.iter();
+			unmarshall_then_body_then_marshall!(
+				args,
+				ctx,
+				(a: u32, b: u32) => {
+					*ctx = a + b;
+					Ok(())
+				}
+			)
+		}
+
+		let ctx = &mut 0;
+		let result = test_unit(ctx, &[TypedValue::I32(2), TypedValue::I32(3)]).unwrap();
+		assert_eq!(result, ReturnValue::Unit);
+		assert_eq!(*ctx, 5);
+	}
+
+	#[test]
+	fn macro_define_func() {
+		define_func!( <E: Ext> ext_gas (_ctx, amount: u32) => {
+			let amount = Gas::from(amount);
+			if !amount.is_zero() {
+				Ok(())
+			} else {
+				Err(sandbox::HostError)
+			}
+		});
+		let _f: fn(&mut Runtime<MockExt>, &[sandbox::TypedValue])
+			-> Result<sandbox::ReturnValue, sandbox::HostError> = ext_gas::<MockExt>;
+	}
+
+	#[test]
+	fn macro_gen_signature() {
+		assert_eq!(
+			gen_signature!((i32)),
+			FunctionType::new(vec![ValueType::I32], None),
+		);
+
+		assert_eq!(
+			gen_signature!( (i32, u32) -> u32 ),
+			FunctionType::new(vec![ValueType::I32, ValueType::I32], Some(ValueType::I32)),
+		);
+	}
+
+	#[test]
+	fn macro_unmarshall_then_body() {
+		let args = vec![TypedValue::I32(5), TypedValue::I32(3)];
+		let mut args = args.iter();
+
+		let ctx: &mut u32 = &mut 0;
+
+		let r = unmarshall_then_body!(
+			{
+				*ctx = a + b;
+				a * b
+			},
+			ctx,
+			args,
+			a: u32,
+			b: u32
+		);
+
+		assert_eq!(*ctx, 8);
+		assert_eq!(r, 15);
+	}
+
+	#[test]
+	fn macro_define_env() {
+		use crate::wasm::env_def::ImportSatisfyCheck;
+
+		define_env!(Env, <E: Ext>,
+			ext_gas( _ctx, amount: u32 ) => {
+				let amount = Gas::from(amount);
+				if !amount.is_zero() {
+					Ok(())
+				} else {
+					Err(sandbox::HostError)
+				}
+			},
+		);
+
+		assert!(Env::can_satisfy(b"ext_gas", &FunctionType::new(vec![ValueType::I32], None)));
+		assert!(!Env::can_satisfy(b"not_exists", &FunctionType::new(vec![], None)));
+	}
+}

substrate/frame/contracts/src/wasm/env_def/mod.rs

@@ -0,0 +1,86 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+use super::Runtime;
+use crate::exec::Ext;
+
+use sandbox::{self, TypedValue};
+use parity_wasm::elements::{FunctionType, ValueType};
+
+#[macro_use]
+pub(crate) mod macros;
+
+pub trait ConvertibleToWasm: Sized {
+	const VALUE_TYPE: ValueType;
+	type NativeType;
+	fn to_typed_value(self) -> TypedValue;
+	fn from_typed_value(_: TypedValue) -> Option<Self>;
+}
+impl ConvertibleToWasm for i32 {
+	type NativeType = i32;
+	const VALUE_TYPE: ValueType = ValueType::I32;
+	fn to_typed_value(self) -> TypedValue {
+		TypedValue::I32(self)
+	}
+	fn from_typed_value(v: TypedValue) -> Option<Self> {
+		v.as_i32()
+	}
+}
+impl ConvertibleToWasm for u32 {
+	type NativeType = u32;
+	const VALUE_TYPE: ValueType = ValueType::I32;
+	fn to_typed_value(self) -> TypedValue {
+		TypedValue::I32(self as i32)
+	}
+	fn from_typed_value(v: TypedValue) -> Option<Self> {
+		match v {
+			TypedValue::I32(v) => Some(v as u32),
+			_ => None,
+		}
+	}
+}
+impl ConvertibleToWasm for u64 {
+	type NativeType = u64;
+	const VALUE_TYPE: ValueType = ValueType::I64;
+	fn to_typed_value(self) -> TypedValue {
+		TypedValue::I64(self as i64)
+	}
+	fn from_typed_value(v: TypedValue) -> Option<Self> {
+		match v {
+			TypedValue::I64(v) => Some(v as u64),
+			_ => None,
+		}
+	}
+}
+
+pub(crate) type HostFunc<E> =
+	fn(
+		&mut Runtime<E>,
+		&[sandbox::TypedValue]
+	) -> Result<sandbox::ReturnValue, sandbox::HostError>;
+
+pub(crate) trait FunctionImplProvider<E: Ext> {
+	fn impls<F: FnMut(&[u8], HostFunc<E>)>(f: &mut F);
+}
+
+/// This trait can be used to check whether the host environment can satisfy
+/// a requested function import.
+pub trait ImportSatisfyCheck {
+	/// Returns `true` if the host environment contains a function with
+	/// the specified name and its type matches to the given type, or `false`
+	/// otherwise.
+	fn can_satisfy(name: &[u8], func_type: &FunctionType) -> bool;
+}

substrate/frame/contracts/src/wasm/prepare.rs

@@ -0,0 +1,839 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+//! This module takes care of loading, checking and preprocessing of a
+//! wasm module before execution. It also extracts some essential information
+//! from a module.
+
+use crate::wasm::env_def::ImportSatisfyCheck;
+use crate::wasm::PrefabWasmModule;
+use crate::Schedule;
+
+use parity_wasm::elements::{self, Internal, External, MemoryType, Type, ValueType};
+use pwasm_utils;
+use pwasm_utils::rules;
+use rstd::prelude::*;
+use sr_primitives::traits::{SaturatedConversion};
+
+struct ContractModule<'a> {
+	/// A deserialized module. The module is valid (this is Guaranteed by `new` method).
+	module: elements::Module,
+	schedule: &'a Schedule,
+}
+
+impl<'a> ContractModule<'a> {
+	/// Creates a new instance of `ContractModule`.
+	///
+	/// Returns `Err` if the `original_code` couldn't be decoded or
+	/// if it contains an invalid module.
+	fn new(
+		original_code: &[u8],
+		schedule: &'a Schedule,
+	) -> Result<Self, &'static str> {
+		use wasmi_validation::{validate_module, PlainValidator};
+
+		let module =
+			elements::deserialize_buffer(original_code).map_err(|_| "Can't decode wasm code")?;
+
+		// Make sure that the module is valid.
+		validate_module::<PlainValidator>(&module).map_err(|_| "Module is not valid")?;
+
+		// Return a `ContractModule` instance with
+		// __valid__ module.
+		Ok(ContractModule {
+			module,
+			schedule,
+		})
+	}
+
+	/// Ensures that module doesn't declare internal memories.
+	///
+	/// In this runtime we only allow wasm module to import memory from the environment.
+	/// Memory section contains declarations of internal linear memories, so if we find one
+	/// we reject such a module.
+	fn ensure_no_internal_memory(&self) -> Result<(), &'static str> {
+		if self.module
+			.memory_section()
+			.map_or(false, |ms| ms.entries().len() > 0)
+		{
+			return Err("module declares internal memory");
+		}
+		Ok(())
+	}
+
+	/// Ensures that tables declared in the module are not too big.
+	fn ensure_table_size_limit(&self, limit: u32) -> Result<(), &'static str> {
+        if let Some(table_section) = self.module.table_section() {
+			// In Wasm MVP spec, there may be at most one table declared. Double check this
+			// explicitly just in case the Wasm version changes.
+			if table_section.entries().len() > 1 {
+				return Err("multiple tables declared");
+			}
+			if let Some(table_type) = table_section.entries().first() {
+				// Check the table's initial size as there is no instruction or environment function
+				// capable of growing the table.
+				if table_type.limits().initial() > limit {
+					return Err("table exceeds maximum size allowed")
+				}
+			}
+		}
+		Ok(())
+	}
+
+	/// Ensures that no floating point types are in use.
+	fn ensure_no_floating_types(&self) -> Result<(), &'static str> {
+		if let Some(global_section) = self.module.global_section() {
+			for global in global_section.entries() {
+				match global.global_type().content_type() {
+					ValueType::F32 | ValueType::F64 =>
+						return Err("use of floating point type in globals is forbidden"),
+					_ => {}
+				}
+			}
+		}
+
+		if let Some(code_section) = self.module.code_section() {
+			for func_body in code_section.bodies() {
+				for local in func_body.locals() {
+					match local.value_type() {
+						ValueType::F32 | ValueType::F64 =>
+							return Err("use of floating point type in locals is forbidden"),
+						_ => {}
+					}
+				}
+			}
+		}
+
+		if let Some(type_section) = self.module.type_section() {
+			for wasm_type in type_section.types() {
+				match wasm_type {
+					Type::Function(func_type) => {
+						let return_type = func_type.return_type();
+						for value_type in func_type.params().iter().chain(return_type.iter()) {
+							match value_type {
+								ValueType::F32 | ValueType::F64 =>
+									return Err("use of floating point type in function types is forbidden"),
+								_ => {}
+							}
+						}
+					}
+				}
+			}
+		}
+
+		Ok(())
+	}
+
+	fn inject_gas_metering(self) -> Result<Self, &'static str> {
+		let gas_rules =
+			rules::Set::new(
+				self.schedule.regular_op_cost.clone().saturated_into(),
+				Default::default(),
+			)
+			.with_grow_cost(self.schedule.grow_mem_cost.clone().saturated_into())
+			.with_forbidden_floats();
+
+		let contract_module = pwasm_utils::inject_gas_counter(self.module, &gas_rules)
+			.map_err(|_| "gas instrumentation failed")?;
+		Ok(ContractModule {
+			module: contract_module,
+			schedule: self.schedule,
+		})
+	}
+
+	fn inject_stack_height_metering(self) -> Result<Self, &'static str> {
+		let contract_module =
+			pwasm_utils::stack_height::inject_limiter(self.module, self.schedule.max_stack_height)
+				.map_err(|_| "stack height instrumentation failed")?;
+		Ok(ContractModule {
+			module: contract_module,
+			schedule: self.schedule,
+		})
+	}
+
+	/// Check that the module has required exported functions. For now
+	/// these are just entrypoints:
+	///
+	/// - 'call'
+	/// - 'deploy'
+	///
+	/// Any other exports are not allowed.
+	fn scan_exports(&self) -> Result<(), &'static str> {
+		let mut deploy_found = false;
+		let mut call_found = false;
+
+		let module = &self.module;
+
+		let types = module.type_section().map(|ts| ts.types()).unwrap_or(&[]);
+		let export_entries = module
+			.export_section()
+			.map(|is| is.entries())
+			.unwrap_or(&[]);
+		let func_entries = module
+			.function_section()
+			.map(|fs| fs.entries())
+			.unwrap_or(&[]);
+
+		// Function index space consists of imported function following by
+		// declared functions. Calculate the total number of imported functions so
+		// we can use it to convert indexes from function space to declared function space.
+		let fn_space_offset = module
+			.import_section()
+			.map(|is| is.entries())
+			.unwrap_or(&[])
+			.iter()
+			.filter(|entry| {
+				match *entry.external() {
+					External::Function(_) => true,
+					_ => false,
+				}
+			})
+			.count();
+
+		for export in export_entries {
+			match export.field() {
+				"call" => call_found = true,
+				"deploy" => deploy_found = true,
+				_ => return Err("unknown export: expecting only deploy and call functions"),
+			}
+
+			// Then check the export kind. "call" and "deploy" are
+			// functions.
+			let fn_idx = match export.internal() {
+				Internal::Function(ref fn_idx) => *fn_idx,
+				_ => return Err("expected a function"),
+			};
+
+			// convert index from function index space to declared index space.
+			let fn_idx = match fn_idx.checked_sub(fn_space_offset as u32) {
+				Some(fn_idx) => fn_idx,
+				None => {
+					// Underflow here means fn_idx points to imported function which we don't allow!
+					return Err("entry point points to an imported function");
+				}
+			};
+
+			// Then check the signature.
+			// Both "call" and "deploy" has a [] -> [] or [] -> [i32] function type.
+			//
+			// The [] -> [] signature predates the [] -> [i32] signature and is supported for
+			// backwards compatibility. This will likely be removed once ink! is updated to
+			// generate modules with the new function signatures.
+			let func_ty_idx = func_entries.get(fn_idx as usize)
+				.ok_or_else(|| "export refers to non-existent function")?
+				.type_ref();
+			let Type::Function(ref func_ty) = types
+				.get(func_ty_idx as usize)
+				.ok_or_else(|| "function has a non-existent type")?;
+			if !func_ty.params().is_empty() ||
+				!(func_ty.return_type().is_none() ||
+					func_ty.return_type() == Some(ValueType::I32)) {
+				return Err("entry point has wrong signature");
+			}
+		}
+
+		if !deploy_found {
+			return Err("deploy function isn't exported");
+		}
+		if !call_found {
+			return Err("call function isn't exported");
+		}
+
+		Ok(())
+	}
+
+	/// Scan an import section if any.
+	///
+	/// This accomplishes two tasks:
+	///
+	/// - checks any imported function against defined host functions set, incl.
+	///   their signatures.
+	/// - if there is a memory import, returns it's descriptor
+	fn scan_imports<C: ImportSatisfyCheck>(&self) -> Result<Option<&MemoryType>, &'static str> {
+		let module = &self.module;
+
+		let types = module.type_section().map(|ts| ts.types()).unwrap_or(&[]);
+		let import_entries = module
+			.import_section()
+			.map(|is| is.entries())
+			.unwrap_or(&[]);
+
+		let mut imported_mem_type = None;
+
+		for import in import_entries {
+			if import.module() != "env" {
+				// This import tries to import something from non-"env" module,
+				// but all imports are located in "env" at the moment.
+				return Err("module has imports from a non-'env' namespace");
+			}
+
+			let type_idx = match import.external() {
+				&External::Table(_) => return Err("Cannot import tables"),
+				&External::Global(_) => return Err("Cannot import globals"),
+				&External::Function(ref type_idx) => type_idx,
+				&External::Memory(ref memory_type) => {
+					if import.field() != "memory" {
+						return Err("Memory import must have the field name 'memory'")
+					}
+					if imported_mem_type.is_some() {
+						return Err("Multiple memory imports defined")
+					}
+					imported_mem_type = Some(memory_type);
+					continue;
+				}
+			};
+
+			let Type::Function(ref func_ty) = types
+				.get(*type_idx as usize)
+				.ok_or_else(|| "validation: import entry points to a non-existent type")?;
+
+			// We disallow importing `ext_println` unless debug features are enabled,
+			// which should only be allowed on a dev chain
+			if !self.schedule.enable_println && import.field().as_bytes() == b"ext_println" {
+				return Err("module imports `ext_println` but debug features disabled");
+			}
+
+			// We disallow importing `gas` function here since it is treated as implementation detail.
+			if import.field().as_bytes() == b"gas"
+				|| !C::can_satisfy(import.field().as_bytes(), func_ty)
+			{
+				return Err("module imports a non-existent function");
+			}
+		}
+		Ok(imported_mem_type)
+	}
+
+	fn into_wasm_code(self) -> Result<Vec<u8>, &'static str> {
+		elements::serialize(self.module)
+			.map_err(|_| "error serializing instrumented module")
+	}
+}
+
+/// Loads the given module given in `original_code`, performs some checks on it and
+/// does some preprocessing.
+///
+/// The checks are:
+///
+/// - provided code is a valid wasm module.
+/// - the module doesn't define an internal memory instance,
+/// - imported memory (if any) doesn't reserve more memory than permitted by the `schedule`,
+/// - all imported functions from the external environment matches defined by `env` module,
+///
+/// The preprocessing includes injecting code for gas metering and metering the height of stack.
+pub fn prepare_contract<C: ImportSatisfyCheck>(
+	original_code: &[u8],
+	schedule: &Schedule,
+) -> Result<PrefabWasmModule, &'static str> {
+	let mut contract_module = ContractModule::new(original_code, schedule)?;
+	contract_module.scan_exports()?;
+	contract_module.ensure_no_internal_memory()?;
+	contract_module.ensure_table_size_limit(schedule.max_table_size)?;
+	contract_module.ensure_no_floating_types()?;
+
+	struct MemoryDefinition {
+		initial: u32,
+		maximum: u32,
+	}
+
+	let memory_def = if let Some(memory_type) = contract_module.scan_imports::<C>()? {
+		// Inspect the module to extract the initial and maximum page count.
+		let limits = memory_type.limits();
+		match (limits.initial(), limits.maximum()) {
+			(initial, Some(maximum)) if initial > maximum => {
+				return Err(
+					"Requested initial number of pages should not exceed the requested maximum",
+				);
+			}
+			(_, Some(maximum)) if maximum > schedule.max_memory_pages => {
+				return Err("Maximum number of pages should not exceed the configured maximum.");
+			}
+			(initial, Some(maximum)) => MemoryDefinition { initial, maximum },
+			(_, None) => {
+				// Maximum number of pages should be always declared.
+				// This isn't a hard requirement and can be treated as a maximum set
+				// to configured maximum.
+				return Err("Maximum number of pages should be always declared.");
+			}
+		}
+	} else {
+		// If none memory imported then just crate an empty placeholder.
+		// Any access to it will lead to out of bounds trap.
+		MemoryDefinition {
+			initial: 0,
+			maximum: 0,
+		}
+	};
+
+	contract_module = contract_module
+		.inject_gas_metering()?
+		.inject_stack_height_metering()?;
+
+	Ok(PrefabWasmModule {
+		schedule_version: schedule.version,
+		initial: memory_def.initial,
+		maximum: memory_def.maximum,
+		_reserved: None,
+		code: contract_module.into_wasm_code()?,
+	})
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use crate::exec::Ext;
+	use std::fmt;
+	use wabt;
+	use assert_matches::assert_matches;
+
+	impl fmt::Debug for PrefabWasmModule {
+		fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+			write!(f, "PreparedContract {{ .. }}")
+		}
+	}
+
+	// Define test environment for tests. We need ImportSatisfyCheck
+	// implementation from it. So actual implementations doesn't matter.
+	define_env!(TestEnv, <E: Ext>,
+		panic(_ctx) => { unreachable!(); },
+
+		// gas is an implementation defined function and a contract can't import it.
+		gas(_ctx, _amount: u32) => { unreachable!(); },
+
+		nop(_ctx, _unused: u64) => { unreachable!(); },
+
+		ext_println(_ctx, _ptr: u32, _len: u32) => { unreachable!(); },
+	);
+
+	macro_rules! prepare_test {
+		($name:ident, $wat:expr, $($expected:tt)*) => {
+			#[test]
+			fn $name() {
+				let wasm = wabt::Wat2Wasm::new().validate(false).convert($wat).unwrap();
+				let schedule = Schedule::default();
+				let r = prepare_contract::<TestEnv>(wasm.as_ref(), &schedule);
+				assert_matches!(r, $($expected)*);
+			}
+		};
+	}
+
+	prepare_test!(no_floats,
+		r#"
+		(module
+			(func (export "call")
+				(drop
+					(f32.add
+						(f32.const 0)
+						(f32.const 1)
+					)
+				)
+			)
+			(func (export "deploy"))
+		)"#,
+		Err("gas instrumentation failed")
+	);
+
+	mod memories {
+		use super::*;
+
+		// Tests below assumes that maximum page number is configured to a certain number.
+		#[test]
+		fn assume_memory_size() {
+			assert_eq!(Schedule::default().max_memory_pages, 16);
+		}
+
+		prepare_test!(memory_with_one_page,
+			r#"
+			(module
+				(import "env" "memory" (memory 1 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Ok(_)
+		);
+
+		prepare_test!(internal_memory_declaration,
+			r#"
+			(module
+				(memory 1 1)
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module declares internal memory")
+		);
+
+		prepare_test!(no_memory_import,
+			r#"
+			(module
+				;; no memory imported
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)"#,
+			Ok(_)
+		);
+
+		prepare_test!(initial_exceeds_maximum,
+			r#"
+			(module
+				(import "env" "memory" (memory 16 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Module is not valid")
+		);
+
+		prepare_test!(no_maximum,
+			r#"
+			(module
+				(import "env" "memory" (memory 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Maximum number of pages should be always declared.")
+		);
+
+		prepare_test!(requested_maximum_exceeds_configured_maximum,
+			r#"
+			(module
+				(import "env" "memory" (memory 1 17))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Maximum number of pages should not exceed the configured maximum.")
+		);
+
+		prepare_test!(field_name_not_memory,
+			r#"
+			(module
+				(import "env" "forgetit" (memory 1 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Memory import must have the field name 'memory'")
+		);
+
+		prepare_test!(multiple_memory_imports,
+			r#"
+			(module
+				(import "env" "memory" (memory 1 1))
+				(import "env" "memory" (memory 1 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Module is not valid")
+		);
+
+		prepare_test!(table_import,
+			r#"
+			(module
+				(import "env" "table" (table 1 anyfunc))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Cannot import tables")
+		);
+
+		prepare_test!(global_import,
+			r#"
+			(module
+				(global $g (import "env" "global") i32)
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("Cannot import globals")
+		);
+	}
+
+	mod tables {
+		use super::*;
+
+		// Tests below assumes that maximum table size is configured to a certain number.
+		#[test]
+		fn assume_table_size() {
+			assert_eq!(Schedule::default().max_table_size, 16384);
+		}
+
+		prepare_test!(no_tables,
+			r#"
+			(module
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Ok(_)
+		);
+
+		prepare_test!(table_valid_size,
+			r#"
+			(module
+				(table 10000 funcref)
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Ok(_)
+		);
+
+		prepare_test!(table_too_big,
+			r#"
+			(module
+				(table 20000 funcref)
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)"#,
+			Err("table exceeds maximum size allowed")
+		);
+	}
+
+	mod imports {
+		use super::*;
+
+		prepare_test!(can_import_legit_function,
+			r#"
+			(module
+				(import "env" "nop" (func (param i64)))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Ok(_)
+		);
+
+		// even though gas is defined the contract can't import it since
+		// it is an implementation defined.
+		prepare_test!(can_not_import_gas_function,
+			r#"
+			(module
+				(import "env" "gas" (func (param i32)))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module imports a non-existent function")
+		);
+
+		// nothing can be imported from non-"env" module for now.
+		prepare_test!(non_env_import,
+			r#"
+			(module
+				(import "another_module" "memory" (memory 1 1))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module has imports from a non-'env' namespace")
+		);
+
+		// wrong signature
+		prepare_test!(wrong_signature,
+			r#"
+			(module
+				(import "env" "gas" (func (param i64)))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module imports a non-existent function")
+		);
+
+		prepare_test!(unknown_func_name,
+			r#"
+			(module
+				(import "env" "unknown_func" (func))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module imports a non-existent function")
+		);
+
+		prepare_test!(ext_println_debug_disabled,
+			r#"
+			(module
+				(import "env" "ext_println" (func $ext_println (param i32 i32)))
+
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("module imports `ext_println` but debug features disabled")
+		);
+
+		#[test]
+		fn ext_println_debug_enabled() {
+			let wasm = wabt::Wat2Wasm::new().validate(false).convert(
+				r#"
+				(module
+					(import "env" "ext_println" (func $ext_println (param i32 i32)))
+
+					(func (export "call"))
+					(func (export "deploy"))
+				)
+				"#
+			).unwrap();
+			let mut schedule = Schedule::default();
+			schedule.enable_println = true;
+			let r = prepare_contract::<TestEnv>(wasm.as_ref(), &schedule);
+			assert_matches!(r, Ok(_));
+		}
+	}
+
+	mod entrypoints {
+		use super::*;
+
+		prepare_test!(it_works,
+			r#"
+			(module
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Ok(_)
+		);
+
+		prepare_test!(omit_deploy,
+			r#"
+			(module
+				(func (export "call"))
+			)
+			"#,
+			Err("deploy function isn't exported")
+		);
+
+		prepare_test!(omit_call,
+			r#"
+			(module
+				(func (export "deploy"))
+			)
+			"#,
+			Err("call function isn't exported")
+		);
+
+		// Try to use imported function as an entry point.
+		prepare_test!(try_sneak_export_as_entrypoint,
+			r#"
+			(module
+				(import "env" "panic" (func))
+
+				(func (export "deploy"))
+
+				(export "call" (func 0))
+			)
+			"#,
+			Err("entry point points to an imported function")
+		);
+
+		// Try to use imported function as an entry point.
+		prepare_test!(try_sneak_export_as_global,
+			r#"
+			(module
+				(func (export "deploy"))
+				(global (export "call") i32 (i32.const 0))
+			)
+			"#,
+			Err("expected a function")
+		);
+
+		prepare_test!(wrong_signature,
+			r#"
+			(module
+				(func (export "deploy"))
+				(func (export "call") (param i32))
+			)
+			"#,
+			Err("entry point has wrong signature")
+		);
+
+		prepare_test!(unknown_exports,
+			r#"
+			(module
+				(func (export "call"))
+				(func (export "deploy"))
+				(func (export "whatevs"))
+			)
+			"#,
+			Err("unknown export: expecting only deploy and call functions")
+		);
+
+		prepare_test!(global_float,
+			r#"
+			(module
+				(global $x f32 (f32.const 0))
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("use of floating point type in globals is forbidden")
+		);
+
+		prepare_test!(local_float,
+			r#"
+			(module
+				(func $foo (local f32))
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("use of floating point type in locals is forbidden")
+		);
+
+		prepare_test!(param_float,
+			r#"
+			(module
+				(func $foo (param f32))
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("use of floating point type in function types is forbidden")
+		);
+
+		prepare_test!(result_float,
+			r#"
+			(module
+				(func $foo (result f32) (f32.const 0))
+				(func (export "call"))
+				(func (export "deploy"))
+			)
+			"#,
+			Err("use of floating point type in function types is forbidden")
+		);
+	}
+}

substrate/frame/contracts/src/wasm/runtime.rs

@@ -0,0 +1,882 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate. If not, see <http://www.gnu.org/licenses/>.
+
+//! Environment definition of the wasm smart-contract runtime.
+
+use crate::{Schedule, Trait, CodeHash, ComputeDispatchFee, BalanceOf};
+use crate::exec::{
+	Ext, ExecResult, ExecError, ExecReturnValue, StorageKey, TopicOf, STATUS_SUCCESS,
+};
+use crate::gas::{Gas, GasMeter, Token, GasMeterResult, approx_gas_for_balance};
+use sandbox;
+use system;
+use rstd::prelude::*;
+use rstd::convert::TryInto;
+use rstd::mem;
+use codec::{Decode, Encode};
+use sr_primitives::traits::{Bounded, SaturatedConversion};
+
+/// The value returned from ext_call and ext_instantiate contract external functions if the call or
+/// instantiation traps. This value is chosen as if the execution does not trap, the return value
+/// will always be an 8-bit integer, so 0x0100 is the smallest value that could not be returned.
+const TRAP_RETURN_CODE: u32 = 0x0100;
+
+/// Enumerates all possible *special* trap conditions.
+///
+/// In this runtime traps used not only for signaling about errors but also
+/// to just terminate quickly in some cases.
+enum SpecialTrap {
+	/// Signals that trap was generated in response to call `ext_return` host function.
+	Return(Vec<u8>),
+}
+
+/// Can only be used for one call.
+pub(crate) struct Runtime<'a, E: Ext + 'a> {
+	ext: &'a mut E,
+	scratch_buf: Vec<u8>,
+	schedule: &'a Schedule,
+	memory: sandbox::Memory,
+	gas_meter: &'a mut GasMeter<E::T>,
+	special_trap: Option<SpecialTrap>,
+}
+impl<'a, E: Ext + 'a> Runtime<'a, E> {
+	pub(crate) fn new(
+		ext: &'a mut E,
+		input_data: Vec<u8>,
+		schedule: &'a Schedule,
+		memory: sandbox::Memory,
+		gas_meter: &'a mut GasMeter<E::T>,
+	) -> Self {
+		Runtime {
+			ext,
+			// Put the input data into the scratch buffer immediately.
+			scratch_buf: input_data,
+			schedule,
+			memory,
+			gas_meter,
+			special_trap: None,
+		}
+	}
+}
+
+pub(crate) fn to_execution_result<E: Ext>(
+	runtime: Runtime<E>,
+	sandbox_result: Result<sandbox::ReturnValue, sandbox::Error>,
+) -> ExecResult {
+	// Special case. The trap was the result of the execution `return` host function.
+	if let Some(SpecialTrap::Return(data)) = runtime.special_trap {
+		return Ok(ExecReturnValue { status: STATUS_SUCCESS, data });
+	}
+
+	// Check the exact type of the error.
+	match sandbox_result {
+		// No traps were generated. Proceed normally.
+		Ok(sandbox::ReturnValue::Unit) => {
+			let mut buffer = runtime.scratch_buf;
+			buffer.clear();
+			Ok(ExecReturnValue { status: STATUS_SUCCESS, data: buffer })
+		}
+		Ok(sandbox::ReturnValue::Value(sandbox::TypedValue::I32(exit_code))) => {
+			let status = (exit_code & 0xFF).try_into()
+				.expect("exit_code is masked into the range of a u8; qed");
+			Ok(ExecReturnValue { status, data: runtime.scratch_buf })
+		}
+		// This should never happen as the return type of exported functions should have been
+		// validated by the code preparation process. However, because panics are really
+		// undesirable in the runtime code, we treat this as a trap for now. Eventually, we might
+		// want to revisit this.
+		Ok(_) => Err(ExecError { reason: "return type error", buffer: runtime.scratch_buf }),
+		// `Error::Module` is returned only if instantiation or linking failed (i.e.
+		// wasm binary tried to import a function that is not provided by the host).
+		// This shouldn't happen because validation process ought to reject such binaries.
+		//
+		// Because panics are really undesirable in the runtime code, we treat this as
+		// a trap for now. Eventually, we might want to revisit this.
+		Err(sandbox::Error::Module) =>
+			Err(ExecError { reason: "validation error", buffer: runtime.scratch_buf }),
+		// Any other kind of a trap should result in a failure.
+		Err(sandbox::Error::Execution) | Err(sandbox::Error::OutOfBounds) =>
+			Err(ExecError { reason: "during execution", buffer: runtime.scratch_buf }),
+	}
+}
+
+#[cfg_attr(test, derive(Debug, PartialEq, Eq))]
+#[derive(Copy, Clone)]
+pub enum RuntimeToken {
+	/// Explicit call to the `gas` function. Charge the gas meter
+	/// with the value provided.
+	Explicit(u32),
+	/// The given number of bytes is read from the sandbox memory.
+	ReadMemory(u32),
+	/// The given number of bytes is written to the sandbox memory.
+	WriteMemory(u32),
+	/// The given number of bytes is read from the sandbox memory and
+	/// is returned as the return data buffer of the call.
+	ReturnData(u32),
+	/// Dispatch fee calculated by `T::ComputeDispatchFee`.
+	ComputedDispatchFee(Gas),
+	/// (topic_count, data_bytes): A buffer of the given size is posted as an event indexed with the
+	/// given number of topics.
+	DepositEvent(u32, u32),
+}
+
+impl<T: Trait> Token<T> for RuntimeToken {
+	type Metadata = Schedule;
+
+	fn calculate_amount(&self, metadata: &Schedule) -> Gas {
+		use self::RuntimeToken::*;
+		let value = match *self {
+			Explicit(amount) => Some(amount.into()),
+			ReadMemory(byte_count) => metadata
+				.sandbox_data_read_cost
+				.checked_mul(byte_count.into()),
+			WriteMemory(byte_count) => metadata
+				.sandbox_data_write_cost
+				.checked_mul(byte_count.into()),
+			ReturnData(byte_count) => metadata
+				.return_data_per_byte_cost
+				.checked_mul(byte_count.into()),
+			DepositEvent(topic_count, data_byte_count) => {
+				let data_cost = metadata
+					.event_data_per_byte_cost
+					.checked_mul(data_byte_count.into());
+
+				let topics_cost = metadata
+					.event_per_topic_cost
+					.checked_mul(topic_count.into());
+
+				data_cost
+					.and_then(|data_cost| {
+						topics_cost.and_then(|topics_cost| {
+							data_cost.checked_add(topics_cost)
+						})
+					})
+					.and_then(|data_and_topics_cost|
+						data_and_topics_cost.checked_add(metadata.event_base_cost)
+					)
+			},
+			ComputedDispatchFee(gas) => Some(gas),
+		};
+
+		value.unwrap_or_else(|| Bounded::max_value())
+	}
+}
+
+/// Charge the gas meter with the specified token.
+///
+/// Returns `Err(HostError)` if there is not enough gas.
+fn charge_gas<T: Trait, Tok: Token<T>>(
+	gas_meter: &mut GasMeter<T>,
+	metadata: &Tok::Metadata,
+	token: Tok,
+) -> Result<(), sandbox::HostError> {
+	match gas_meter.charge(metadata, token) {
+		GasMeterResult::Proceed => Ok(()),
+		GasMeterResult::OutOfGas => Err(sandbox::HostError),
+	}
+}
+
+/// Read designated chunk from the sandbox memory, consuming an appropriate amount of
+/// gas.
+///
+/// Returns `Err` if one of the following conditions occurs:
+///
+/// - calculating the gas cost resulted in overflow.
+/// - out of gas
+/// - requested buffer is not within the bounds of the sandbox memory.
+fn read_sandbox_memory<E: Ext>(
+	ctx: &mut Runtime<E>,
+	ptr: u32,
+	len: u32,
+) -> Result<Vec<u8>, sandbox::HostError> {
+	charge_gas(ctx.gas_meter, ctx.schedule, RuntimeToken::ReadMemory(len))?;
+
+	let mut buf = vec![0u8; len as usize];
+	ctx.memory.get(ptr, buf.as_mut_slice()).map_err(|_| sandbox::HostError)?;
+	Ok(buf)
+}
+
+/// Read designated chunk from the sandbox memory into the scratch buffer, consuming an
+/// appropriate amount of gas. Resizes the scratch buffer to the specified length on success.
+///
+/// Returns `Err` if one of the following conditions occurs:
+///
+/// - calculating the gas cost resulted in overflow.
+/// - out of gas
+/// - requested buffer is not within the bounds of the sandbox memory.
+fn read_sandbox_memory_into_scratch<E: Ext>(
+	ctx: &mut Runtime<E>,
+	ptr: u32,
+	len: u32,
+) -> Result<(), sandbox::HostError> {
+	charge_gas(ctx.gas_meter, ctx.schedule, RuntimeToken::ReadMemory(len))?;
+
+	ctx.scratch_buf.resize(len as usize, 0);
+	ctx.memory.get(ptr, ctx.scratch_buf.as_mut_slice()).map_err(|_| sandbox::HostError)?;
+	Ok(())
+}
+
+/// Read designated chunk from the sandbox memory into the supplied buffer, consuming
+/// an appropriate amount of gas.
+///
+/// Returns `Err` if one of the following conditions occurs:
+///
+/// - calculating the gas cost resulted in overflow.
+/// - out of gas
+/// - requested buffer is not within the bounds of the sandbox memory.
+fn read_sandbox_memory_into_buf<E: Ext>(
+	ctx: &mut Runtime<E>,
+	ptr: u32,
+	buf: &mut [u8],
+) -> Result<(), sandbox::HostError> {
+	charge_gas(ctx.gas_meter, ctx.schedule, RuntimeToken::ReadMemory(buf.len() as u32))?;
+
+	ctx.memory.get(ptr, buf).map_err(Into::into)
+}
+
+/// Read designated chunk from the sandbox memory, consuming an appropriate amount of
+/// gas, and attempt to decode into the specified type.
+///
+/// Returns `Err` if one of the following conditions occurs:
+///
+/// - calculating the gas cost resulted in overflow.
+/// - out of gas
+/// - requested buffer is not within the bounds of the sandbox memory.
+/// - the buffer contents cannot be decoded as the required type.
+fn read_sandbox_memory_as<E: Ext, D: Decode>(
+	ctx: &mut Runtime<E>,
+	ptr: u32,
+	len: u32,
+) -> Result<D, sandbox::HostError> {
+	let buf = read_sandbox_memory(ctx, ptr, len)?;
+	D::decode(&mut &buf[..]).map_err(|_| sandbox::HostError)
+}
+
+/// Write the given buffer to the designated location in the sandbox memory, consuming
+/// an appropriate amount of gas.
+///
+/// Returns `Err` if one of the following conditions occurs:
+///
+/// - calculating the gas cost resulted in overflow.
+/// - out of gas
+/// - designated area is not within the bounds of the sandbox memory.
+fn write_sandbox_memory<T: Trait>(
+	schedule: &Schedule,
+	gas_meter: &mut GasMeter<T>,
+	memory: &sandbox::Memory,
+	ptr: u32,
+	buf: &[u8],
+) -> Result<(), sandbox::HostError> {
+	charge_gas(gas_meter, schedule, RuntimeToken::WriteMemory(buf.len() as u32))?;
+
+	memory.set(ptr, buf)?;
+
+	Ok(())
+}
+
+// ***********************************************************
+// * AFTER MAKING A CHANGE MAKE SURE TO UPDATE COMPLEXITY.MD *
+// ***********************************************************
+
+// Define a function `fn init_env<E: Ext>() -> HostFunctionSet<E>` that returns
+// a function set which can be imported by an executed contract.
+define_env!(Env, <E: Ext>,
+
+	// Account for used gas. Traps if gas used is greater than gas limit.
+	//
+	// NOTE: This is a implementation defined call and is NOT a part of the public API.
+	// This call is supposed to be called only by instrumentation injected code.
+	//
+	// - amount: How much gas is used.
+	gas(ctx, amount: u32) => {
+		charge_gas(&mut ctx.gas_meter, ctx.schedule, RuntimeToken::Explicit(amount))?;
+		Ok(())
+	},
+
+	// Change the value at the given key in the storage or remove the entry.
+	// The value length must not exceed the maximum defined by the Contracts module parameters.
+	//
+	// - key_ptr: pointer into the linear
+	//   memory where the location of the requested value is placed.
+	// - value_non_null: if set to 0, then the entry
+	//   at the given location will be removed.
+	// - value_ptr: pointer into the linear memory
+	//   where the value to set is placed. If `value_non_null` is set to 0, then this parameter is ignored.
+	// - value_len: the length of the value. If `value_non_null` is set to 0, then this parameter is ignored.
+	ext_set_storage(ctx, key_ptr: u32, value_non_null: u32, value_ptr: u32, value_len: u32) => {
+		if value_non_null != 0 && ctx.ext.max_value_size() < value_len {
+			return Err(sandbox::HostError);
+		}
+		let mut key: StorageKey = [0; 32];
+		read_sandbox_memory_into_buf(ctx, key_ptr, &mut key)?;
+		let value =
+			if value_non_null != 0 {
+				Some(read_sandbox_memory(ctx, value_ptr, value_len)?)
+			} else {
+				None
+			};
+		ctx.ext.set_storage(key, value).map_err(|_| sandbox::HostError)?;
+
+		Ok(())
+	},
+
+	// Retrieve the value under the given key from the storage and return 0.
+	// If there is no entry under the given key then this function will return 1 and
+	// clear the scratch buffer.
+	//
+	// - key_ptr: pointer into the linear memory where the key
+	//   of the requested value is placed.
+	ext_get_storage(ctx, key_ptr: u32) -> u32 => {
+		let mut key: StorageKey = [0; 32];
+		read_sandbox_memory_into_buf(ctx, key_ptr, &mut key)?;
+		if let Some(value) = ctx.ext.get_storage(&key) {
+			ctx.scratch_buf = value;
+			Ok(0)
+		} else {
+			ctx.scratch_buf.clear();
+			Ok(1)
+		}
+	},
+
+	// Make a call to another contract.
+	//
+	// If the called contract runs to completion, then this returns the status code the callee
+	// returns on exit in the bottom 8 bits of the return value. The top 24 bits are 0s. A status
+	// code of 0 indicates success, and any other code indicates a failure. On failure, any state
+	// changes made by the called contract are reverted. The scratch buffer is filled with the
+	// output data returned by the called contract, even in the case of a failure status.
+	//
+	// If the contract traps during execution or otherwise fails to complete successfully, then
+	// this function clears the scratch buffer and returns 0x0100. As with a failure status, any
+	// state changes made by the called contract are reverted.
+	//
+	// - callee_ptr: a pointer to the address of the callee contract.
+	//   Should be decodable as an `T::AccountId`. Traps otherwise.
+	// - callee_len: length of the address buffer.
+	// - gas: how much gas to devote to the execution.
+	// - value_ptr: a pointer to the buffer with value, how much value to send.
+	//   Should be decodable as a `T::Balance`. Traps otherwise.
+	// - value_len: length of the value buffer.
+	// - input_data_ptr: a pointer to a buffer to be used as input data to the callee.
+	// - input_data_len: length of the input data buffer.
+	ext_call(
+		ctx,
+		callee_ptr: u32,
+		callee_len: u32,
+		gas: u64,
+		value_ptr: u32,
+		value_len: u32,
+		input_data_ptr: u32,
+		input_data_len: u32
+	) -> u32 => {
+		let callee: <<E as Ext>::T as system::Trait>::AccountId =
+			read_sandbox_memory_as(ctx, callee_ptr, callee_len)?;
+		let value: BalanceOf<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, value_ptr, value_len)?;
+
+		// Read input data into the scratch buffer, then take ownership of it.
+		read_sandbox_memory_into_scratch(ctx, input_data_ptr, input_data_len)?;
+		let input_data = mem::replace(&mut ctx.scratch_buf, Vec::new());
+
+		let nested_gas_limit = if gas == 0 {
+			ctx.gas_meter.gas_left()
+		} else {
+			gas.saturated_into()
+		};
+		let ext = &mut ctx.ext;
+		let call_outcome = ctx.gas_meter.with_nested(nested_gas_limit, |nested_meter| {
+			match nested_meter {
+				Some(nested_meter) => {
+					ext.call(
+						&callee,
+						value,
+						nested_meter,
+						input_data,
+					)
+					.map_err(|err| err.buffer)
+				}
+				// there is not enough gas to allocate for the nested call.
+				None => Err(input_data),
+			}
+		});
+
+		match call_outcome {
+			Ok(output) => {
+				ctx.scratch_buf = output.data;
+				Ok(output.status.into())
+			},
+			Err(buffer) => {
+				ctx.scratch_buf = buffer;
+				ctx.scratch_buf.clear();
+				Ok(TRAP_RETURN_CODE)
+			},
+		}
+	},
+
+	// Instantiate a contract with the specified code hash.
+	//
+	// This function creates an account and executes the constructor defined in the code specified
+	// by the code hash.
+	//
+	// If the constructor runs to completion, then this returns the status code that the newly
+	// instantiated contract returns on exit in the bottom 8 bits of the return value. The top 24
+	// bits are 0s. A status code of 0 indicates success, and any other code indicates a failure.
+	// On failure, any state changes made by the called contract are reverted and the contract is
+	// not instantiated. On a success status, the scratch buffer is filled with the encoded address
+	// of the newly instantiated contract. In the case of a failure status, the scratch buffer is
+	// cleared.
+	//
+	// If the contract traps during execution or otherwise fails to complete successfully, then
+	// this function clears the scratch buffer and returns 0x0100. As with a failure status, any
+	// state changes made by the called contract are reverted.
+
+	// This function creates an account and executes initializer code. After the execution,
+	// the returned buffer is saved as the code of the created account.
+	//
+	// Returns 0 on the successful contract instantiation and puts the address of the instantiated
+	// contract into the scratch buffer. Otherwise, returns non-zero value and clears the scratch
+	// buffer.
+	//
+	// - code_hash_ptr: a pointer to the buffer that contains the initializer code.
+	// - code_hash_len: length of the initializer code buffer.
+	// - gas: how much gas to devote to the execution of the initializer code.
+	// - value_ptr: a pointer to the buffer with value, how much value to send.
+	//   Should be decodable as a `T::Balance`. Traps otherwise.
+	// - value_len: length of the value buffer.
+	// - input_data_ptr: a pointer to a buffer to be used as input data to the initializer code.
+	// - input_data_len: length of the input data buffer.
+	ext_instantiate(
+		ctx,
+		code_hash_ptr: u32,
+		code_hash_len: u32,
+		gas: u64,
+		value_ptr: u32,
+		value_len: u32,
+		input_data_ptr: u32,
+		input_data_len: u32
+	) -> u32 => {
+		let code_hash: CodeHash<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, code_hash_ptr, code_hash_len)?;
+		let value: BalanceOf<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, value_ptr, value_len)?;
+
+		// Read input data into the scratch buffer, then take ownership of it.
+		read_sandbox_memory_into_scratch(ctx, input_data_ptr, input_data_len)?;
+		let input_data = mem::replace(&mut ctx.scratch_buf, Vec::new());
+
+		let nested_gas_limit = if gas == 0 {
+			ctx.gas_meter.gas_left()
+		} else {
+			gas.saturated_into()
+		};
+		let ext = &mut ctx.ext;
+		let instantiate_outcome = ctx.gas_meter.with_nested(nested_gas_limit, |nested_meter| {
+			match nested_meter {
+				Some(nested_meter) => {
+					ext.instantiate(
+						&code_hash,
+						value,
+						nested_meter,
+						input_data
+					)
+					.map_err(|err| err.buffer)
+				}
+				// there is not enough gas to allocate for the nested call.
+				None => Err(input_data),
+			}
+		});
+		match instantiate_outcome {
+			Ok((address, output)) => {
+				let is_success = output.is_success();
+				ctx.scratch_buf = output.data;
+				ctx.scratch_buf.clear();
+				if is_success {
+					// Write the address to the scratch buffer.
+					address.encode_to(&mut ctx.scratch_buf);
+				}
+				Ok(output.status.into())
+			},
+			Err(buffer) => {
+				ctx.scratch_buf = buffer;
+				ctx.scratch_buf.clear();
+				Ok(TRAP_RETURN_CODE)
+			},
+		}
+	},
+
+	// Save a data buffer as a result of the execution, terminate the execution and return a
+	// successful result to the caller.
+	//
+	// This is the only way to return a data buffer to the caller.
+	ext_return(ctx, data_ptr: u32, data_len: u32) => {
+		charge_gas(ctx.gas_meter, ctx.schedule, RuntimeToken::ReturnData(data_len))?;
+
+		read_sandbox_memory_into_scratch(ctx, data_ptr, data_len)?;
+		let output_buf = mem::replace(&mut ctx.scratch_buf, Vec::new());
+
+		ctx.special_trap = Some(SpecialTrap::Return(output_buf));
+
+		// The trap mechanism is used to immediately terminate the execution.
+		// This trap should be handled appropriately before returning the result
+		// to the user of this crate.
+		Err(sandbox::HostError)
+	},
+
+	// Stores the address of the caller into the scratch buffer.
+	//
+	// If this is a top-level call (i.e. initiated by an extrinsic) the origin address of the
+	// extrinsic will be returned. Otherwise, if this call is initiated by another contract then the
+	// address of the contract will be returned.
+	ext_caller(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.caller().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the address of the current contract into the scratch buffer.
+	ext_address(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.address().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the gas price for the current transaction into the scratch buffer.
+	//
+	// The data is encoded as T::Balance. The current contents of the scratch buffer are overwritten.
+	ext_gas_price(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.gas_meter.gas_price().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the amount of gas left into the scratch buffer.
+	//
+	// The data is encoded as Gas. The current contents of the scratch buffer are overwritten.
+	ext_gas_left(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.gas_meter.gas_left().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the balance of the current account into the scratch buffer.
+	//
+	// The data is encoded as T::Balance. The current contents of the scratch buffer are overwritten.
+	ext_balance(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.balance().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the value transferred along with this call or as endowment into the scratch buffer.
+	//
+	// The data is encoded as T::Balance. The current contents of the scratch buffer are overwritten.
+	ext_value_transferred(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.value_transferred().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the random number for the current block for the given subject into the scratch
+	// buffer.
+	//
+	// The data is encoded as T::Hash. The current contents of the scratch buffer are
+	// overwritten.
+	ext_random(ctx, subject_ptr: u32, subject_len: u32) => {
+		// The length of a subject can't exceed `max_subject_len`.
+		if subject_len > ctx.schedule.max_subject_len {
+			return Err(sandbox::HostError);
+		}
+
+		let subject_buf = read_sandbox_memory(ctx, subject_ptr, subject_len)?;
+		ctx.scratch_buf.clear();
+		ctx.ext.random(&subject_buf).encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Load the latest block timestamp into the scratch buffer
+	ext_now(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.now().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Stores the minimum balance (a.k.a. existential deposit) into the scratch buffer.
+	//
+	// The data is encoded as T::Balance. The current contents of the scratch buffer are
+	// overwritten.
+	ext_minimum_balance(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.minimum_balance().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Decodes the given buffer as a `T::Call` and adds it to the list
+	// of to-be-dispatched calls.
+	//
+	// All calls made it to the top-level context will be dispatched before
+	// finishing the execution of the calling extrinsic.
+	ext_dispatch_call(ctx, call_ptr: u32, call_len: u32) => {
+		let call: <<E as Ext>::T as Trait>::Call =
+			read_sandbox_memory_as(ctx, call_ptr, call_len)?;
+
+		// Charge gas for dispatching this call.
+		let fee = {
+			let balance_fee = <<E as Ext>::T as Trait>::ComputeDispatchFee::compute_dispatch_fee(&call);
+			approx_gas_for_balance(ctx.gas_meter.gas_price(), balance_fee)
+		};
+		charge_gas(&mut ctx.gas_meter, ctx.schedule, RuntimeToken::ComputedDispatchFee(fee))?;
+
+		ctx.ext.note_dispatch_call(call);
+
+		Ok(())
+	},
+
+	// Record a request to restore the caller contract to the specified contract.
+	//
+	// At the finalization stage, i.e. when all changes from the extrinsic that invoked this
+	// contract are commited, this function will compute a tombstone hash from the caller's
+	// storage and the given code hash and if the hash matches the hash found in the tombstone at
+	// the specified address - kill the caller contract and restore the destination contract and set
+	// the specified `rent_allowance`. All caller's funds are transfered to the destination.
+	//
+	// This function doesn't perform restoration right away but defers it to the end of the
+	// transaction. If there is no tombstone in the destination address or if the hashes don't match
+	// then restoration is cancelled and no changes are made.
+	//
+	// `dest_ptr`, `dest_len` - the pointer and the length of a buffer that encodes `T::AccountId`
+	// with the address of the to be restored contract.
+	// `code_hash_ptr`, `code_hash_len` - the pointer and the length of a buffer that encodes
+	// a code hash of the to be restored contract.
+	// `rent_allowance_ptr`, `rent_allowance_len` - the pointer and the length of a buffer that
+	// encodes the rent allowance that must be set in the case of successful restoration.
+	// `delta_ptr` is the pointer to the start of a buffer that has `delta_count` storage keys
+	// laid out sequentially.
+	ext_restore_to(
+		ctx,
+		dest_ptr: u32,
+		dest_len: u32,
+		code_hash_ptr: u32,
+		code_hash_len: u32,
+		rent_allowance_ptr: u32,
+		rent_allowance_len: u32,
+		delta_ptr: u32,
+		delta_count: u32
+	) => {
+		let dest: <<E as Ext>::T as system::Trait>::AccountId =
+			read_sandbox_memory_as(ctx, dest_ptr, dest_len)?;
+		let code_hash: CodeHash<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, code_hash_ptr, code_hash_len)?;
+		let rent_allowance: BalanceOf<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, rent_allowance_ptr, rent_allowance_len)?;
+		let delta = {
+			// We don't use `with_capacity` here to not eagerly allocate the user specified amount
+			// of memory.
+			let mut delta = Vec::new();
+			let mut key_ptr = delta_ptr;
+
+			for _ in 0..delta_count {
+				const KEY_SIZE: usize = 32;
+
+				// Read the delta into the provided buffer and collect it into the buffer.
+				let mut delta_key: StorageKey = [0; KEY_SIZE];
+				read_sandbox_memory_into_buf(ctx, key_ptr, &mut delta_key)?;
+				delta.push(delta_key);
+
+				// Offset key_ptr to the next element.
+				key_ptr = key_ptr.checked_add(KEY_SIZE as u32).ok_or_else(|| sandbox::HostError)?;
+			}
+
+			delta
+		};
+
+		ctx.ext.note_restore_to(
+			dest,
+			code_hash,
+			rent_allowance,
+			delta,
+		);
+
+		Ok(())
+	},
+
+	// Returns the size of the scratch buffer.
+	//
+	// For more details on the scratch buffer see `ext_scratch_read`.
+	ext_scratch_size(ctx) -> u32 => {
+		Ok(ctx.scratch_buf.len() as u32)
+	},
+
+	// Copy data from the scratch buffer starting from `offset` with length `len` into the contract
+	// memory. The region at which the data should be put is specified by `dest_ptr`.
+	//
+	// In order to get size of the scratch buffer use `ext_scratch_size`. At the start of contract
+	// execution, the scratch buffer is filled with the input data. Whenever a contract calls
+	// function that uses the scratch buffer the contents of the scratch buffer are overwritten.
+	ext_scratch_read(ctx, dest_ptr: u32, offset: u32, len: u32) => {
+		let offset = offset as usize;
+		if offset > ctx.scratch_buf.len() {
+			// Offset can't be larger than scratch buffer length.
+			return Err(sandbox::HostError);
+		}
+
+		// This can't panic since `offset <= ctx.scratch_buf.len()`.
+		let src = &ctx.scratch_buf[offset..];
+		if src.len() != len as usize {
+			return Err(sandbox::HostError);
+		}
+
+		// Finally, perform the write.
+		write_sandbox_memory(
+			ctx.schedule,
+			ctx.gas_meter,
+			&ctx.memory,
+			dest_ptr,
+			src,
+		)?;
+
+		Ok(())
+	},
+
+	// Copy data from contract memory starting from `src_ptr` with length `len` into the scratch
+	// buffer. This overwrites the entire scratch buffer and resizes to `len`. Specifying a `len`
+	// of zero clears the scratch buffer.
+	//
+	// This should be used before exiting a call or instantiation in order to set the return data.
+	ext_scratch_write(ctx, src_ptr: u32, len: u32) => {
+		read_sandbox_memory_into_scratch(ctx, src_ptr, len)
+	},
+
+	// Deposit a contract event with the data buffer and optional list of topics. There is a limit
+	// on the maximum number of topics specified by `max_event_topics`.
+	//
+	// - topics_ptr - a pointer to the buffer of topics encoded as `Vec<T::Hash>`. The value of this
+	//   is ignored if `topics_len` is set to 0. The topics list can't contain duplicates.
+	// - topics_len - the length of the topics buffer. Pass 0 if you want to pass an empty vector.
+	// - data_ptr - a pointer to a raw data buffer which will saved along the event.
+	// - data_len - the length of the data buffer.
+	ext_deposit_event(ctx, topics_ptr: u32, topics_len: u32, data_ptr: u32, data_len: u32) => {
+		let mut topics: Vec::<TopicOf<<E as Ext>::T>> = match topics_len {
+			0 => Vec::new(),
+			_ => read_sandbox_memory_as(ctx, topics_ptr, topics_len)?,
+		};
+
+		// If there are more than `max_event_topics`, then trap.
+		if topics.len() > ctx.schedule.max_event_topics as usize {
+			return Err(sandbox::HostError);
+		}
+
+		// Check for duplicate topics. If there are any, then trap.
+		if has_duplicates(&mut topics) {
+			return Err(sandbox::HostError);
+		}
+
+		let event_data = read_sandbox_memory(ctx, data_ptr, data_len)?;
+
+		charge_gas(
+			ctx.gas_meter,
+			ctx.schedule,
+			RuntimeToken::DepositEvent(topics.len() as u32, data_len)
+		)?;
+		ctx.ext.deposit_event(topics, event_data);
+
+		Ok(())
+	},
+
+	// Set rent allowance of the contract
+	//
+	// - value_ptr: a pointer to the buffer with value, how much to allow for rent
+	//   Should be decodable as a `T::Balance`. Traps otherwise.
+	// - value_len: length of the value buffer.
+	ext_set_rent_allowance(ctx, value_ptr: u32, value_len: u32) => {
+		let value: BalanceOf<<E as Ext>::T> =
+			read_sandbox_memory_as(ctx, value_ptr, value_len)?;
+		ctx.ext.set_rent_allowance(value);
+
+		Ok(())
+	},
+
+	// Stores the rent allowance into the scratch buffer.
+	//
+	// The data is encoded as T::Balance. The current contents of the scratch buffer are overwritten.
+	ext_rent_allowance(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.rent_allowance().encode_to(&mut ctx.scratch_buf);
+
+		Ok(())
+	},
+
+	// Prints utf8 encoded string from the data buffer.
+	// Only available on `--dev` chains.
+	// This function may be removed at any time, superseded by a more general contract debugging feature.
+	ext_println(ctx, str_ptr: u32, str_len: u32) => {
+		let data = read_sandbox_memory(ctx, str_ptr, str_len)?;
+		if let Ok(utf8) = core::str::from_utf8(&data) {
+			sr_primitives::print(utf8);
+		}
+		Ok(())
+	},
+
+	// Stores the current block number of the current contract into the scratch buffer.
+	ext_block_number(ctx) => {
+		ctx.scratch_buf.clear();
+		ctx.ext.block_number().encode_to(&mut ctx.scratch_buf);
+		Ok(())
+	},
+
+	// Retrieve the value under the given key from the **runtime** storage and return 0.
+	// If there is no entry under the given key then this function will return 1 and
+	// clear the scratch buffer.
+	//
+	// - key_ptr: the pointer into the linear memory where the requested value is placed.
+	// - key_len: the length of the key in bytes.
+	ext_get_runtime_storage(ctx, key_ptr: u32, key_len: u32) -> u32 => {
+		// Steal the scratch buffer so that we hopefully save an allocation for the `key_buf`.
+		read_sandbox_memory_into_scratch(ctx, key_ptr, key_len)?;
+		let key_buf = mem::replace(&mut ctx.scratch_buf, Vec::new());
+
+		match ctx.ext.get_runtime_storage(&key_buf) {
+			Some(value_buf) => {
+				// The given value exists.
+				ctx.scratch_buf = value_buf;
+				Ok(0)
+			}
+			None => {
+				// Put back the `key_buf` and allow its allocation to be reused.
+				ctx.scratch_buf = key_buf;
+				ctx.scratch_buf.clear();
+				Ok(1)
+			}
+		}
+	},
+);
+
+/// Finds duplicates in a given vector.
+///
+/// This function has complexity of O(n log n) and no additional memory is required, although
+/// the order of items is not preserved.
+fn has_duplicates<T: PartialEq + AsRef<[u8]>>(items: &mut Vec<T>) -> bool {
+	// Sort the vector
+	items.sort_unstable_by(|a, b| {
+		Ord::cmp(a.as_ref(), b.as_ref())
+	});
+	// And then find any two consecutive equal elements.
+	items.windows(2).any(|w| {
+		match w {
+			&[ref a, ref b] => a == b,
+			_ => false,
+		}
+	})
+}

substrate/frame/democracy/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "pallet-democracy"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+balances = { package = "pallet-balances", path = "../balances" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"safe-mix/std",
+	"codec/std",
+	"rstd/std",
+	"runtime-io/std",
+	"support/std",
+	"sr-primitives/std",
+	"system/std",
+]

substrate/frame/democracy/src/vote_threshold.rs

@@ -0,0 +1,102 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Voting thresholds.
+
+#[cfg(feature = "std")]
+use serde::{Serialize, Deserialize};
+use codec::{Encode, Decode};
+use sr_primitives::traits::{Zero, IntegerSquareRoot};
+use rstd::ops::{Add, Mul, Div, Rem};
+
+/// A means of determining if a vote is past pass threshold.
+#[derive(Clone, Copy, PartialEq, Eq, Encode, Decode, sr_primitives::RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Serialize, Deserialize))]
+pub enum VoteThreshold {
+	/// A supermajority of approvals is needed to pass this vote.
+	SuperMajorityApprove,
+	/// A supermajority of rejects is needed to fail this vote.
+	SuperMajorityAgainst,
+	/// A simple majority of approvals is needed to pass this vote.
+	SimpleMajority,
+}
+
+pub trait Approved<Balance> {
+	/// Given `approve` votes for and `against` votes against from a total electorate size of
+	/// `electorate` (`electorate - (approve + against)` are abstainers), then returns true if the
+	/// overall outcome is in favor of approval.
+	fn approved(&self, approve: Balance, against: Balance, voters: Balance, electorate: Balance) -> bool;
+}
+
+/// Return `true` iff `n1 / d1 < n2 / d2`. `d1` and `d2` may not be zero.
+fn compare_rationals<T: Zero + Mul<T, Output = T> + Div<T, Output = T> + Rem<T, Output = T> + Ord + Copy>(mut n1: T, mut d1: T, mut n2: T, mut d2: T) -> bool {
+	// Uses a continued fractional representation for a non-overflowing compare.
+	// Detailed at https://janmr.com/blog/2014/05/comparing-rational-numbers-without-overflow/.
+	loop {
+		let q1 = n1 / d1;
+		let q2 = n2 / d2;
+		if q1 < q2 {
+			return true;
+		}
+		if q2 < q1 {
+			return false;
+		}
+		let r1 = n1 % d1;
+		let r2 = n2 % d2;
+		if r2.is_zero() {
+			return false;
+		}
+		if r1.is_zero() {
+			return true;
+		}
+		n1 = d2;
+		n2 = d1;
+		d1 = r2;
+		d2 = r1;
+	}
+}
+
+impl<Balance: IntegerSquareRoot + Zero + Ord + Add<Balance, Output = Balance> + Mul<Balance, Output = Balance> + Div<Balance, Output = Balance> + Rem<Balance, Output = Balance> + Copy> Approved<Balance> for VoteThreshold {
+	/// Given `approve` votes for and `against` votes against from a total electorate size of
+	/// `electorate` of whom `voters` voted (`electorate - voters` are abstainers) then returns true if the
+	/// overall outcome is in favor of approval.
+	///
+	/// We assume each *voter* may cast more than one *vote*, hence `voters` is not necessarily equal to
+	/// `approve + against`.
+	fn approved(&self, approve: Balance, against: Balance, voters: Balance, electorate: Balance) -> bool {
+		let sqrt_voters = voters.integer_sqrt();
+		let sqrt_electorate = electorate.integer_sqrt();
+		if sqrt_voters.is_zero() { return false; }
+		match *self {
+			VoteThreshold::SuperMajorityApprove =>
+				compare_rationals(against, sqrt_voters, approve, sqrt_electorate),
+			VoteThreshold::SuperMajorityAgainst =>
+				compare_rationals(against, sqrt_electorate, approve, sqrt_voters),
+			VoteThreshold::SimpleMajority => approve > against,
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	#[test]
+	fn should_work() {
+		assert_eq!(VoteThreshold::SuperMajorityApprove.approved(60, 50, 110, 210), false);
+		assert_eq!(VoteThreshold::SuperMajorityApprove.approved(100, 50, 150, 210), true);
+	}
+}

substrate/frame/elections-phragmen/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "pallet-elections-phragmen"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+phragmen = { package = "substrate-phragmen", path = "../../primitives/phragmen", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+
+[dev-dependencies]
+runtime_io = { package = "sr-io", path = "../../primitives/sr-io" }
+hex-literal = "0.2.1"
+balances = { package = "pallet-balances", path = "../balances" }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+serde = { version = "1.0.101" }
+
+[features]
+default = ["std"]
+std = [
+	"codec/std",
+	"support/std",
+	"sr-primitives/std",
+	"phragmen/std",
+	"system/std",
+	"rstd/std",
+]

substrate/frame/elections/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "pallet-elections"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+hex-literal = "0.2.1"
+balances = { package = "pallet-balances", path = "../balances" }
+
+[features]
+default = ["std"]
+std = [
+	"safe-mix/std",
+	"codec/std",
+	"primitives/std",
+	"rstd/std",
+	"serde",
+	"runtime-io/std",
+	"support/std",
+	"sr-primitives/std",
+	"system/std",
+]

substrate/frame/elections/src/mock.rs

@@ -0,0 +1,284 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Mock file for election module.
+
+#![cfg(test)]
+
+use std::cell::RefCell;
+use support::{
+	StorageValue, StorageMap, parameter_types, assert_ok,
+	traits::{Get, ChangeMembers, Currency}
+};
+use primitives::H256;
+use sr_primitives::{
+	Perbill, BuildStorage, testing::Header, traits::{BlakeTwo256, IdentityLookup, Block as BlockT},
+};
+use crate as elections;
+
+
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = Event;
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+
+parameter_types! {
+	pub const ExistentialDeposit: u64 = 0;
+	pub const TransferFee: u64 = 0;
+	pub const CreationFee: u64 = 0;
+}
+impl balances::Trait for Test {
+	type Balance = u64;
+	type OnNewAccount = ();
+	type OnFreeBalanceZero = ();
+	type Event = Event;
+	type TransferPayment = ();
+	type DustRemoval = ();
+	type ExistentialDeposit = ExistentialDeposit;
+	type TransferFee = TransferFee;
+	type CreationFee = CreationFee;
+}
+
+parameter_types! {
+	pub const CandidacyBond: u64 = 3;
+	pub const CarryCount: u32 = 2;
+	pub const InactiveGracePeriod: u32 = 1;
+	pub const VotingPeriod: u64 = 4;
+	pub const MinimumVotingLock: u64 = 5;
+}
+
+thread_local! {
+	static VOTER_BOND: RefCell<u64> = RefCell::new(0);
+	static VOTING_FEE: RefCell<u64> = RefCell::new(0);
+	static PRESENT_SLASH_PER_VOTER: RefCell<u64> = RefCell::new(0);
+	static DECAY_RATIO: RefCell<u32> = RefCell::new(0);
+	static MEMBERS: RefCell<Vec<u64>> = RefCell::new(vec![]);
+}
+
+pub struct VotingBond;
+impl Get<u64> for VotingBond {
+	fn get() -> u64 { VOTER_BOND.with(|v| *v.borrow()) }
+}
+
+pub struct VotingFee;
+impl Get<u64> for VotingFee {
+	fn get() -> u64 { VOTING_FEE.with(|v| *v.borrow()) }
+}
+
+pub struct PresentSlashPerVoter;
+impl Get<u64> for PresentSlashPerVoter {
+	fn get() -> u64 { PRESENT_SLASH_PER_VOTER.with(|v| *v.borrow()) }
+}
+
+pub struct DecayRatio;
+impl Get<u32> for DecayRatio {
+	fn get() -> u32 { DECAY_RATIO.with(|v| *v.borrow()) }
+}
+
+pub struct TestChangeMembers;
+impl ChangeMembers<u64> for TestChangeMembers {
+	fn change_members_sorted(incoming: &[u64], outgoing: &[u64], new: &[u64]) {
+		let mut old_plus_incoming = MEMBERS.with(|m| m.borrow().to_vec());
+		old_plus_incoming.extend_from_slice(incoming);
+		old_plus_incoming.sort();
+		let mut new_plus_outgoing = new.to_vec();
+		new_plus_outgoing.extend_from_slice(outgoing);
+		new_plus_outgoing.sort();
+		assert_eq!(old_plus_incoming, new_plus_outgoing);
+
+		MEMBERS.with(|m| *m.borrow_mut() = new.to_vec());
+	}
+}
+
+impl elections::Trait for Test {
+	type Event = Event;
+	type Currency = Balances;
+	type BadPresentation = ();
+	type BadReaper = ();
+	type BadVoterIndex = ();
+	type LoserCandidate = ();
+	type ChangeMembers = TestChangeMembers;
+	type CandidacyBond = CandidacyBond;
+	type VotingBond = VotingBond;
+	type VotingFee = VotingFee;
+	type MinimumVotingLock = MinimumVotingLock;
+	type PresentSlashPerVoter = PresentSlashPerVoter;
+	type CarryCount = CarryCount;
+	type InactiveGracePeriod = InactiveGracePeriod;
+	type VotingPeriod = VotingPeriod;
+	type DecayRatio = DecayRatio;
+}
+
+pub type Block = sr_primitives::generic::Block<Header, UncheckedExtrinsic>;
+pub type UncheckedExtrinsic = sr_primitives::generic::UncheckedExtrinsic<u32, u64, Call, ()>;
+
+support::construct_runtime!(
+	pub enum Test where
+		Block = Block,
+		NodeBlock = Block,
+		UncheckedExtrinsic = UncheckedExtrinsic
+	{
+		System: system::{Module, Call, Event},
+		Balances: balances::{Module, Call, Event<T>, Config<T>, Error},
+		Elections: elections::{Module, Call, Event<T>, Config<T>},
+	}
+);
+
+pub struct ExtBuilder {
+	balance_factor: u64,
+	decay_ratio: u32,
+	desired_seats: u32,
+	voting_fee: u64,
+	voter_bond: u64,
+	bad_presentation_punishment: u64,
+}
+
+impl Default for ExtBuilder {
+	fn default() -> Self {
+		Self {
+			balance_factor: 1,
+			decay_ratio: 24,
+			desired_seats: 2,
+			voting_fee: 0,
+			voter_bond: 0,
+			bad_presentation_punishment: 1,
+		}
+	}
+}
+
+impl ExtBuilder {
+	pub fn balance_factor(mut self, factor: u64) -> Self {
+		self.balance_factor = factor;
+		self
+	}
+	pub fn decay_ratio(mut self, ratio: u32) -> Self {
+		self.decay_ratio = ratio;
+		self
+	}
+	pub fn voting_fee(mut self, fee: u64) -> Self {
+		self.voting_fee = fee;
+		self
+	}
+	pub fn bad_presentation_punishment(mut self, fee: u64) -> Self {
+		self.bad_presentation_punishment = fee;
+		self
+	}
+	pub fn voter_bond(mut self, fee: u64) -> Self {
+		self.voter_bond = fee;
+		self
+	}
+	pub fn desired_seats(mut self, seats: u32) -> Self {
+		self.desired_seats = seats;
+		self
+	}
+	pub fn build(self) -> runtime_io::TestExternalities {
+		VOTER_BOND.with(|v| *v.borrow_mut() = self.voter_bond);
+		VOTING_FEE.with(|v| *v.borrow_mut() = self.voting_fee);
+		PRESENT_SLASH_PER_VOTER.with(|v| *v.borrow_mut() = self.bad_presentation_punishment);
+		DECAY_RATIO.with(|v| *v.borrow_mut() = self.decay_ratio);
+		GenesisConfig {
+			balances: Some(balances::GenesisConfig::<Test>{
+				balances: vec![
+					(1, 10 * self.balance_factor),
+					(2, 20 * self.balance_factor),
+					(3, 30 * self.balance_factor),
+					(4, 40 * self.balance_factor),
+					(5, 50 * self.balance_factor),
+					(6, 60 * self.balance_factor)
+				],
+				vesting: vec![],
+			}),
+			elections: Some(elections::GenesisConfig::<Test>{
+				members: vec![],
+				desired_seats: self.desired_seats,
+				presentation_duration: 2,
+				term_duration: 5,
+			}),
+		}.build_storage().unwrap().into()
+	}
+}
+
+pub(crate) fn voter_ids() -> Vec<u64> {
+	Elections::all_voters().iter().map(|v| v.unwrap_or(0) ).collect::<Vec<u64>>()
+}
+
+pub(crate) fn vote(i: u64, l: usize) {
+	let _ = Balances::make_free_balance_be(&i, 20);
+	assert_ok!(
+		Elections::set_approvals(
+			Origin::signed(i),
+			(0..l).map(|_| true).collect::<Vec<bool>>(),
+			0,
+			0,
+			20,
+		)
+	);
+}
+
+pub(crate) fn vote_at(i: u64, l: usize, index: elections::VoteIndex) {
+	let _ = Balances::make_free_balance_be(&i, 20);
+	assert_ok!(
+		Elections::set_approvals(
+			Origin::signed(i),
+			(0..l).map(|_| true).collect::<Vec<bool>>(),
+			0,
+			index,
+			20,
+		)
+	);
+}
+
+pub(crate) fn create_candidate(i: u64, index: u32) {
+	let _ = Balances::make_free_balance_be(&i, 20);
+	assert_ok!(Elections::submit_candidacy(Origin::signed(i), index));
+}
+
+pub(crate) fn balances(who: &u64) -> (u64, u64) {
+	(Balances::free_balance(who), Balances::reserved_balance(who))
+}
+
+pub(crate) fn locks(who: &u64) -> Vec<u64> {
+	Balances::locks(who).iter().map(|l| l.amount).collect::<Vec<u64>>()
+}
+
+pub(crate) fn new_test_ext_with_candidate_holes() -> runtime_io::TestExternalities {
+	let mut t = ExtBuilder::default().build();
+	t.execute_with(|| {
+		<elections::Candidates<Test>>::put(vec![0, 0, 1]);
+		elections::CandidateCount::put(1);
+		<elections::RegisterInfoOf<Test>>::insert(1, (0, 2));
+	});
+	t
+}

substrate/frame/evm/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "pallet-evm"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+timestamp = { package = "pallet-timestamp", path = "../timestamp", default-features = false }
+balances = { package = "pallet-balances", path = "../balances", default-features = false }
+primitives = { package = "substrate-primitives", path = "../../primitives/core", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+primitive-types = { version = "0.6", default-features = false, features = ["rlp"] }
+rlp = { version = "0.4", default-features = false }
+evm = { version = "0.14", default-features = false }
+sha3 = { version = "0.8", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"primitives/std",
+	"sr-primitives/std",
+	"support/std",
+	"system/std",
+	"balances/std",
+	"runtime-io/std",
+	"rstd/std",
+	"sha3/std",
+	"rlp/std",
+	"primitive-types/std",
+	"evm/std",
+	"timestamp/std",
+]

substrate/frame/evm/src/backend.rs

@@ -0,0 +1,187 @@
+use rstd::marker::PhantomData;
+use rstd::vec::Vec;
+#[cfg(feature = "std")]
+use serde::{Serialize, Deserialize};
+use codec::{Encode, Decode};
+use primitives::{U256, H256, H160};
+use sr_primitives::traits::UniqueSaturatedInto;
+use support::storage::{StorageMap, StorageDoubleMap};
+use sha3::{Keccak256, Digest};
+use evm::Config;
+use evm::backend::{Backend as BackendT, ApplyBackend, Apply};
+use crate::{Trait, Accounts, AccountStorages, AccountCodes, Module, Event};
+
+#[derive(Clone, Eq, PartialEq, Encode, Decode, Default)]
+#[cfg_attr(feature = "std", derive(Debug, Serialize, Deserialize))]
+/// Ethereum account nonce, balance and code. Used by storage.
+pub struct Account {
+	/// Account nonce.
+	pub nonce: U256,
+	/// Account balance.
+	pub balance: U256,
+}
+
+#[derive(Clone, Eq, PartialEq, Encode, Decode)]
+#[cfg_attr(feature = "std", derive(Debug, Serialize, Deserialize))]
+/// Ethereum log. Used for `deposit_event`.
+pub struct Log {
+	/// Source address of the log.
+	pub address: H160,
+	/// Topics of the log.
+	pub topics: Vec<H256>,
+	/// Bytearray data of the log.
+	pub data: Vec<u8>,
+}
+
+#[derive(Clone, Eq, PartialEq, Encode, Decode, Default)]
+#[cfg_attr(feature = "std", derive(Debug, Serialize, Deserialize))]
+/// External input from the transaction.
+pub struct Vicinity {
+	/// Current transaction gas price.
+	pub gas_price: U256,
+	/// Origin of the transaction.
+	pub origin: H160,
+}
+
+/// Gasometer config used for executor. Currently this is hard-coded to
+/// Istanbul hard fork.
+pub static GASOMETER_CONFIG: Config = Config::istanbul();
+
+/// Substrate backend for EVM.
+pub struct Backend<'vicinity, T> {
+	vicinity: &'vicinity Vicinity,
+	_marker: PhantomData<T>,
+}
+
+impl<'vicinity, T> Backend<'vicinity, T> {
+	/// Create a new backend with given vicinity.
+	pub fn new(vicinity: &'vicinity Vicinity) -> Self {
+		Self { vicinity, _marker: PhantomData }
+	}
+}
+
+impl<'vicinity, T: Trait> BackendT for Backend<'vicinity, T> {
+	fn gas_price(&self) -> U256 { self.vicinity.gas_price }
+	fn origin(&self) -> H160 { self.vicinity.origin }
+
+	fn block_hash(&self, number: U256) -> H256 {
+		if number > U256::from(u32::max_value()) {
+			H256::default()
+		} else {
+			let number = T::BlockNumber::from(number.as_u32());
+			H256::from_slice(system::Module::<T>::block_hash(number).as_ref())
+		}
+	}
+
+	fn block_number(&self) -> U256 {
+		let number: u128 = system::Module::<T>::block_number().unique_saturated_into();
+		U256::from(number)
+	}
+
+	fn block_coinbase(&self) -> H160 {
+		H160::default()
+	}
+
+	fn block_timestamp(&self) -> U256 {
+		let now: u128 = timestamp::Module::<T>::get().unique_saturated_into();
+		U256::from(now)
+	}
+
+	fn block_difficulty(&self) -> U256 {
+		U256::zero()
+	}
+
+	fn block_gas_limit(&self) -> U256 {
+		U256::zero()
+	}
+
+	fn chain_id(&self) -> U256 {
+		U256::from(runtime_io::misc::chain_id())
+	}
+
+	fn exists(&self, _address: H160) -> bool {
+		true
+	}
+
+	fn basic(&self, address: H160) -> evm::backend::Basic {
+		let account = Accounts::get(&address);
+
+		evm::backend::Basic {
+			balance: account.balance,
+			nonce: account.nonce,
+		}
+	}
+
+	fn code_size(&self, address: H160) -> usize {
+		AccountCodes::decode_len(&address).unwrap_or(0)
+	}
+
+	fn code_hash(&self, address: H160) -> H256 {
+		H256::from_slice(Keccak256::digest(&AccountCodes::get(&address)).as_slice())
+	}
+
+	fn code(&self, address: H160) -> Vec<u8> {
+		AccountCodes::get(&address)
+	}
+
+	fn storage(&self, address: H160, index: H256) -> H256 {
+		AccountStorages::get(address, index)
+	}
+}
+
+impl<'vicinity, T: Trait> ApplyBackend for Backend<'vicinity, T> {
+	fn apply<A, I, L>(
+		&mut self,
+		values: A,
+		logs: L,
+		delete_empty: bool,
+	) where
+		A: IntoIterator<Item=Apply<I>>,
+		I: IntoIterator<Item=(H256, H256)>,
+		L: IntoIterator<Item=evm::backend::Log>,
+	{
+		for apply in values {
+			match apply {
+				Apply::Modify {
+					address, basic, code, storage, reset_storage,
+				} => {
+					Accounts::mutate(&address, |account| {
+						account.balance = basic.balance;
+						account.nonce = basic.nonce;
+					});
+
+					if let Some(code) = code {
+						AccountCodes::insert(address, code);
+					}
+
+					if reset_storage {
+						AccountStorages::remove_prefix(address);
+					}
+
+					for (index, value) in storage {
+						if value == H256::default() {
+							AccountStorages::remove(address, index);
+						} else {
+							AccountStorages::insert(address, index, value);
+						}
+					}
+
+					if delete_empty {
+						Module::<T>::remove_account_if_empty(&address);
+					}
+				},
+				Apply::Delete { address } => {
+					Module::<T>::remove_account(&address)
+				},
+			}
+		}
+
+		for log in logs {
+			Module::<T>::deposit_event(Event::Log(Log {
+				address: log.address,
+				topics: log.topics,
+				data: log.data,
+			}));
+		}
+	}
+}

substrate/frame/evm/src/lib.rs

@@ -0,0 +1,299 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! EVM execution module for Substrate
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+mod backend;
+
+pub use crate::backend::{Account, Log, Vicinity, Backend};
+
+use rstd::vec::Vec;
+use support::{dispatch::Result, decl_module, decl_storage, decl_event};
+use support::traits::{Currency, WithdrawReason, ExistenceRequirement};
+use system::ensure_signed;
+use sr_primitives::ModuleId;
+use support::weights::SimpleDispatchInfo;
+use sr_primitives::traits::{UniqueSaturatedInto, AccountIdConversion};
+use primitives::{U256, H256, H160};
+use evm::{ExitReason, ExitSucceed, ExitError};
+use evm::executor::StackExecutor;
+use evm::backend::ApplyBackend;
+
+const MODULE_ID: ModuleId = ModuleId(*b"py/ethvm");
+
+/// Type alias for currency balance.
+pub type BalanceOf<T> = <<T as Trait>::Currency as Currency<<T as system::Trait>::AccountId>>::Balance;
+
+/// Trait that outputs the current transaction gas price.
+pub trait FeeCalculator {
+	/// Return the current gas price.
+	fn gas_price() -> U256;
+}
+
+/// Trait for converting account ids of `balances` module into
+/// `H160` for EVM module.
+///
+/// Accounts and contracts of this module are stored in its own
+/// storage, in an Ethereum-compatible format. In order to communicate
+/// with the rest of Substrate module, we require an one-to-one
+/// mapping of Substrate account to Ethereum address.
+pub trait ConvertAccountId<A> {
+	/// Given a Substrate address, return the corresponding Ethereum address.
+	fn convert_account_id(account_id: &A) -> H160;
+}
+
+/// Custom precompiles to be used by EVM engine.
+pub trait Precompiles {
+	/// Try to execute the code address as precompile. If the code address is not
+	/// a precompile or the precompile is not yet available, return `None`.
+	/// Otherwise, calculate the amount of gas needed with given `input` and
+	/// `target_gas`. Return `Some(Ok(status, output, gas_used))` if the execution
+	/// is successful. Otherwise return `Some(Err(_))`.
+	fn execute(
+		address: H160,
+		input: &[u8],
+		target_gas: Option<usize>
+	) -> Option<core::result::Result<(ExitSucceed, Vec<u8>, usize), ExitError>>;
+}
+
+impl Precompiles for () {
+	fn execute(
+		_address: H160,
+		_input: &[u8],
+		_target_gas: Option<usize>
+	) -> Option<core::result::Result<(ExitSucceed, Vec<u8>, usize), ExitError>> {
+		None
+	}
+}
+
+/// EVM module trait
+pub trait Trait: system::Trait + timestamp::Trait {
+	/// Calculator for current gas price.
+	type FeeCalculator: FeeCalculator;
+	/// Convert account ID to H160;
+	type ConvertAccountId: ConvertAccountId<Self::AccountId>;
+	/// Currency type for deposit and withdraw.
+	type Currency: Currency<Self::AccountId>;
+	/// The overarching event type.
+	type Event: From<Event> + Into<<Self as system::Trait>::Event>;
+	/// Precompiles associated with this EVM engine.
+	type Precompiles: Precompiles;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Example {
+		Accounts get(fn accounts) config(): map H160 => Account;
+		AccountCodes: map H160 => Vec<u8>;
+		AccountStorages: double_map H160, blake2_256(H256) => H256;
+	}
+}
+
+decl_event!(
+	/// EVM events
+	pub enum Event {
+		/// Ethereum events from contracts.
+		Log(Log),
+	}
+);
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+
+		#[weight = SimpleDispatchInfo::FixedNormal(10_000)]
+		fn deposit_balance(origin, value: BalanceOf<T>) -> Result {
+			let sender = ensure_signed(origin)?;
+
+			let imbalance = T::Currency::withdraw(
+				&sender,
+				value,
+				WithdrawReason::Reserve.into(),
+				ExistenceRequirement::AllowDeath,
+			)?;
+			T::Currency::resolve_creating(&Self::account_id(), imbalance);
+
+			let bvalue = U256::from(UniqueSaturatedInto::<u128>::unique_saturated_into(value));
+			let address = T::ConvertAccountId::convert_account_id(&sender);
+			Accounts::mutate(&address, |account| {
+				account.balance += bvalue;
+			});
+
+			Ok(())
+		}
+
+		#[weight = SimpleDispatchInfo::FixedNormal(10_000)]
+		fn withdraw_balance(origin, value: BalanceOf<T>) -> Result {
+			let sender = ensure_signed(origin)?;
+			let address = T::ConvertAccountId::convert_account_id(&sender);
+			let bvalue = U256::from(UniqueSaturatedInto::<u128>::unique_saturated_into(value));
+
+			let mut account = Accounts::get(&address);
+			account.balance = account.balance.checked_sub(bvalue)
+				.ok_or("Not enough balance to withdraw")?;
+
+			let imbalance = T::Currency::withdraw(
+				&Self::account_id(),
+				value,
+				WithdrawReason::Reserve.into(),
+				ExistenceRequirement::AllowDeath
+			)?;
+
+			Accounts::insert(&address, account);
+
+			T::Currency::resolve_creating(&sender, imbalance);
+
+			Ok(())
+		}
+
+		#[weight = SimpleDispatchInfo::FixedNormal(10_000)]
+		fn call(origin, target: H160, input: Vec<u8>, value: U256, gas_limit: u32) -> Result {
+			let sender = ensure_signed(origin)?;
+			let source = T::ConvertAccountId::convert_account_id(&sender);
+			let gas_price = T::FeeCalculator::gas_price();
+
+			let vicinity = Vicinity {
+				gas_price,
+				origin: source,
+			};
+
+			let mut backend = Backend::<T>::new(&vicinity);
+			let mut executor = StackExecutor::new_with_precompile(
+				&backend,
+				gas_limit as usize,
+				&backend::GASOMETER_CONFIG,
+				T::Precompiles::execute,
+			);
+
+			let total_fee = gas_price.checked_mul(U256::from(gas_limit))
+				.ok_or("Calculating total fee overflowed")?;
+			if Accounts::get(&source).balance <
+				value.checked_add(total_fee).ok_or("Calculating total payment overflowed")?
+			{
+				return Err("Not enough balance to pay transaction fee")
+			}
+			executor.withdraw(source, total_fee).map_err(|_| "Withdraw fee failed")?;
+
+			let reason = executor.transact_call(
+				source,
+				target,
+				value,
+				input,
+				gas_limit as usize,
+			);
+
+			let ret = match reason {
+				ExitReason::Succeed(_) => Ok(()),
+				ExitReason::Error(_) => Err("Execute message call failed"),
+				ExitReason::Revert(_) => Err("Execute message call reverted"),
+				ExitReason::Fatal(_) => Err("Execute message call returned VM fatal error"),
+			};
+			let actual_fee = executor.fee(gas_price);
+			executor.deposit(source, total_fee.saturating_sub(actual_fee));
+
+			let (values, logs) = executor.deconstruct();
+			backend.apply(values, logs, true);
+
+			ret
+		}
+
+		#[weight = SimpleDispatchInfo::FixedNormal(10_000)]
+		fn create(origin, init: Vec<u8>, value: U256, gas_limit: u32) -> Result {
+			let sender = ensure_signed(origin)?;
+			let source = T::ConvertAccountId::convert_account_id(&sender);
+			let gas_price = T::FeeCalculator::gas_price();
+
+			let vicinity = Vicinity {
+				gas_price,
+				origin: source,
+			};
+
+			let mut backend = Backend::<T>::new(&vicinity);
+			let mut executor = StackExecutor::new_with_precompile(
+				&backend,
+				gas_limit as usize,
+				&backend::GASOMETER_CONFIG,
+				T::Precompiles::execute,
+			);
+
+			let total_fee = gas_price.checked_mul(U256::from(gas_limit))
+				.ok_or("Calculating total fee overflowed")?;
+			if Accounts::get(&source).balance <
+				value.checked_add(total_fee).ok_or("Calculating total payment overflowed")?
+			{
+				return Err("Not enough balance to pay transaction fee")
+			}
+			executor.withdraw(source, total_fee).map_err(|_| "Withdraw fee failed")?;
+
+			let reason = executor.transact_create(
+				source,
+				value,
+				init,
+				gas_limit as usize,
+			);
+
+			let ret = match reason {
+				ExitReason::Succeed(_) => Ok(()),
+				ExitReason::Error(_) => Err("Execute contract creation failed"),
+				ExitReason::Revert(_) => Err("Execute contract creation reverted"),
+				ExitReason::Fatal(_) => Err("Execute contract creation returned VM fatal error"),
+			};
+			let actual_fee = executor.fee(gas_price);
+			executor.deposit(source, total_fee.saturating_sub(actual_fee));
+
+			let (values, logs) = executor.deconstruct();
+			backend.apply(values, logs, true);
+
+			ret
+		}
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// The account ID of the EVM module.
+	///
+	/// This actually does computation. If you need to keep using it, then make sure you cache the
+	/// value and only call this once.
+	pub fn account_id() -> T::AccountId {
+		MODULE_ID.into_account()
+	}
+
+	/// Check whether an account is empty.
+	pub fn is_account_empty(address: &H160) -> bool {
+		let account = Accounts::get(address);
+		let code_len = AccountCodes::decode_len(address).unwrap_or(0);
+
+		account.nonce == U256::zero() &&
+			account.balance == U256::zero() &&
+			code_len == 0
+	}
+
+	/// Remove an account if its empty.
+	pub fn remove_account_if_empty(address: &H160) {
+		if Self::is_account_empty(address) {
+			Self::remove_account(address)
+		}
+	}
+
+	/// Remove an account from state.
+	fn remove_account(address: &H160) {
+		Accounts::remove(address);
+		AccountCodes::remove(address);
+		AccountStorages::remove_prefix(address);
+	}
+}

substrate/frame/example/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "pallet-example"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+balances = { package = "pallet-balances", path = "../balances", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"sr-primitives/std",
+	"support/std",
+	"system/std",
+	"balances/std",
+	"runtime-io/std",
+	"rstd/std"
+]

substrate/frame/example/src/lib.rs

@@ -0,0 +1,781 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Example Module
+//!
+//! <!-- Original author of paragraph: @gavofyork -->
+//! The Example: A simple example of a runtime module demonstrating
+//! concepts, APIs and structures common to most runtime modules.
+//!
+//! Run `cargo doc --package pallet-example --open` to view this module's documentation.
+//!
+//! ### Documentation Guidelines:
+//!
+//! <!-- Original author of paragraph: Various. Based on collation of review comments to PRs addressing issues with -->
+//! <!-- label 'S3-SRML' in https://github.com/paritytech/substrate-developer-hub/issues -->
+//! <ul>
+//!     <li>Documentation comments (i.e. <code>/// comment</code>) - should
+//!         accompany module functions and be restricted to the module interface,
+//!         not the internals of the module implementation. Only state inputs,
+//!         outputs, and a brief description that mentions whether calling it
+//!         requires root, but without repeating the source code details.
+//!         Capitalise the first word of each documentation comment and end it with
+//!         a full stop. See
+//!         <a href="https://github.com/paritytech/substrate#72-contributing-to-documentation-for-substrate-packages"
+//!         target="_blank"> Generic example of annotating source code with documentation comments</a></li>
+//!     <li>Self-documenting code - Try to refactor code to be self-documenting.</li>
+//!     <li>Code comments - Supplement complex code with a brief explanation, not every line of code.</li>
+//!     <li>Identifiers - surround by backticks (i.e. <code>INHERENT_IDENTIFIER</code>, <code>InherentType</code>,
+//!         <code>u64</code>)</li>
+//!     <li>Usage scenarios - should be simple doctests. The compiler should ensure they stay valid.</li>
+//!     <li>Extended tutorials - should be moved to external files and refer to.</li>
+//!     <!-- Original author of paragraph: @AmarRSingh -->
+//!     <li>Mandatory - include all of the sections/subsections where <b>MUST</b> is specified.</li>
+//!     <li>Optional - optionally include sections/subsections where <b>CAN</b> is specified.</li>
+//! </ul>
+//!
+//! ### Documentation Template:<br>
+//!
+//! Copy and paste this template from frame/example/src/lib.rs into file
+//! `frame/<INSERT_CUSTOM_MODULE_NAME>/src/lib.rs` of your own custom module and complete it.
+//! <details><p><pre>
+//! // Add heading with custom module name
+//!
+//! \# <INSERT_CUSTOM_MODULE_NAME> Module
+//!
+//! // Add simple description
+//!
+//! // Include the following links that shows what trait needs to be implemented to use the module
+//! // and the supported dispatchables that are documented in the Call enum.
+//!
+//! - \[`<INSERT_CUSTOM_MODULE_NAME>::Trait`](./trait.Trait.html)
+//! - \[`Call`](./enum.Call.html)
+//! - \[`Module`](./struct.Module.html)
+//!
+//! \## Overview
+//!
+//! <!-- Original author of paragraph: Various. See https://github.com/paritytech/substrate-developer-hub/issues/44 -->
+//! // Short description of module purpose.
+//! // Links to Traits that should be implemented.
+//! // What this module is for.
+//! // What functionality the module provides.
+//! // When to use the module (use case examples).
+//! // How it is used.
+//! // Inputs it uses and the source of each input.
+//! // Outputs it produces.
+//!
+//! <!-- Original author of paragraph: @Kianenigma in PR https://github.com/paritytech/substrate/pull/1951 -->
+//! <!-- and comment https://github.com/paritytech/substrate-developer-hub/issues/44#issuecomment-471982710 -->
+//!
+//! \## Terminology
+//!
+//! // Add terminology used in the custom module. Include concepts, storage items, or actions that you think
+//! // deserve to be noted to give context to the rest of the documentation or module usage. The author needs to
+//! // use some judgment about what is included. We don't want a list of every storage item nor types - the user
+//! // can go to the code for that. For example, "transfer fee" is obvious and should not be included, but
+//! // "free balance" and "reserved balance" should be noted to give context to the module.
+//! // Please do not link to outside resources. The reference docs should be the ultimate source of truth.
+//!
+//! <!-- Original author of heading: @Kianenigma in PR https://github.com/paritytech/substrate/pull/1951 -->
+//!
+//! \## Goals
+//!
+//! // Add goals that the custom module is designed to achieve.
+//!
+//! <!-- Original author of heading: @Kianenigma in PR https://github.com/paritytech/substrate/pull/1951 -->
+//!
+//! \### Scenarios
+//!
+//! <!-- Original author of paragraph: @Kianenigma. Based on PR https://github.com/paritytech/substrate/pull/1951 -->
+//!
+//! \#### <INSERT_SCENARIO_NAME>
+//!
+//! // Describe requirements prior to interacting with the custom module.
+//! // Describe the process of interacting with the custom module for this scenario and public API functions used.
+//!
+//! \## Interface
+//!
+//! \### Supported Origins
+//!
+//! // What origins are used and supported in this module (root, signed, none)
+//! // i.e. root when <code>\`ensure_root\`</code> used
+//! // i.e. none when <code>\`ensure_none\`</code> used
+//! // i.e. signed when <code>\`ensure_signed\`</code> used
+//!
+//! <code>\`inherent\`</code> <INSERT_DESCRIPTION>
+//!
+//! <!-- Original author of paragraph: @Kianenigma in comment -->
+//! <!-- https://github.com/paritytech/substrate-developer-hub/issues/44#issuecomment-471982710 -->
+//!
+//! \### Types
+//!
+//! // Type aliases. Include any associated types and where the user would typically define them.
+//!
+//! <code>\`ExampleType\`</code> <INSERT_DESCRIPTION>
+//!
+//! <!-- Original author of paragraph: ??? -->
+//!
+//! // Reference documentation of aspects such as `storageItems` and `dispatchable` functions should only be
+//! // included in the https://docs.rs Rustdocs for Substrate and not repeated in the README file.
+//!
+//! \### Dispatchable Functions
+//!
+//! <!-- Original author of paragraph: @AmarRSingh & @joepetrowski -->
+//!
+//! // A brief description of dispatchable functions and a link to the rustdoc with their actual documentation.
+//!
+//! // <b>MUST</b> have link to Call enum
+//! // <b>MUST</b> have origin information included in function doc
+//! // <b>CAN</b> have more info up to the user
+//!
+//! \### Public Functions
+//!
+//! <!-- Original author of paragraph: @joepetrowski -->
+//!
+//! // A link to the rustdoc and any notes about usage in the module, not for specific functions.
+//! // For example, in the balances module: "Note that when using the publicly exposed functions,
+//! // you (the runtime developer) are responsible for implementing any necessary checks
+//! // (e.g. that the sender is the signer) before calling a function that will affect storage."
+//!
+//! <!-- Original author of paragraph: @AmarRSingh -->
+//!
+//! // It is up to the writer of the respective module (with respect to how much information to provide).
+//!
+//! \#### Public Inspection functions - Immutable (getters)
+//!
+//! // Insert a subheading for each getter function signature
+//!
+//! \##### <code>\`example_getter_name()\`</code>
+//!
+//! // What it returns
+//! // Why, when, and how often to call it
+//! // When it could panic or error
+//! // When safety issues to consider
+//!
+//! \#### Public Mutable functions (changing state)
+//!
+//! // Insert a subheading for each setter function signature
+//!
+//! \##### <code>\`example_setter_name(origin, parameter_name: T::ExampleType)\`</code>
+//!
+//! // What state it changes
+//! // Why, when, and how often to call it
+//! // When it could panic or error
+//! // When safety issues to consider
+//! // What parameter values are valid and why
+//!
+//! \### Storage Items
+//!
+//! // Explain any storage items included in this module
+//!
+//! \### Digest Items
+//!
+//! // Explain any digest items included in this module
+//!
+//! \### Inherent Data
+//!
+//! // Explain what inherent data (if any) is defined in the module and any other related types
+//!
+//! \### Events:
+//!
+//! // Insert events for this module if any
+//!
+//! \### Errors:
+//!
+//! // Explain what generates errors
+//!
+//! \## Usage
+//!
+//! // Insert 2-3 examples of usage and code snippets that show how to
+//! // use <INSERT_CUSTOM_MODULE_NAME> module in a custom module.
+//!
+//! \### Prerequisites
+//!
+//! // Show how to include necessary imports for <INSERT_CUSTOM_MODULE_NAME> and derive
+//! // your module configuration trait with the `INSERT_CUSTOM_MODULE_NAME` trait.
+//!
+//! \```rust
+//! use <INSERT_CUSTOM_MODULE_NAME>;
+//!
+//! pub trait Trait: <INSERT_CUSTOM_MODULE_NAME>::Trait { }
+//! \```
+//!
+//! \### Simple Code Snippet
+//!
+//! // Show a simple example (e.g. how to query a public getter function of <INSERT_CUSTOM_MODULE_NAME>)
+//!
+//! \### Example from SRML
+//!
+//! // Show a usage example in an actual runtime
+//!
+//! // See:
+//! // - Substrate TCR https://github.com/parity-samples/substrate-tcr
+//! // - Substrate Kitties https://shawntabrizi.github.io/substrate-collectables-workshop/#/
+//!
+//! \## Genesis Config
+//!
+//! <!-- Original author of paragraph: @joepetrowski -->
+//!
+//! \## Dependencies
+//!
+//! // Dependencies on other SRML modules and the genesis config should be mentioned,
+//! // but not the Rust Standard Library.
+//! // Genesis configuration modifications that may be made to incorporate this module
+//! // Interaction with other modules
+//!
+//! <!-- Original author of heading: @AmarRSingh -->
+//!
+//! \## Related Modules
+//!
+//! // Interaction with other modules in the form of a bullet point list
+//!
+//! \## References
+//!
+//! <!-- Original author of paragraph: @joepetrowski -->
+//!
+//! // Links to reference material, if applicable. For example, Phragmen, W3F research, etc.
+//! // that the implementation is based on.
+//! </pre></p></details>
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::marker::PhantomData;
+use support::{
+	dispatch::Result, decl_module, decl_storage, decl_event,
+	weights::{SimpleDispatchInfo, DispatchInfo, DispatchClass, ClassifyDispatch, WeighData, Weight},
+};
+use system::{ensure_signed, ensure_root};
+use codec::{Encode, Decode};
+use sr_primitives::{
+	traits::{SignedExtension, Bounded, SaturatedConversion},
+	transaction_validity::{
+		ValidTransaction, TransactionValidityError, InvalidTransaction, TransactionValidity,
+	},
+};
+
+// A custom weight calculator tailored for the dispatch call `set_dummy()`. This actually examines
+// the arguments and makes a decision based upon them.
+//
+// The `WeightData<T>` trait has access to the arguments of the dispatch that it wants to assign a
+// weight to. Nonetheless, the trait itself can not make any assumptions about what the generic type
+// of the arguments (`T`) is. Based on our needs, we could replace `T` with a more concrete type
+// while implementing the trait. The `decl_module!` expects whatever implements `WeighData<T>` to
+// replace `T` with a tuple of the dispatch arguments. This is exactly how we will craft the
+// implementation below.
+//
+// The rules of `WeightForSetDummy` are as follows:
+// - The final weight of each dispatch is calculated as the argument of the call multiplied by the
+//   parameter given to the `WeightForSetDummy`'s constructor.
+// - assigns a dispatch class `operational` if the argument of the call is more than 1000.
+struct WeightForSetDummy<T: balances::Trait>(BalanceOf<T>);
+
+impl<T: balances::Trait> WeighData<(&BalanceOf<T>,)> for WeightForSetDummy<T>
+{
+	fn weigh_data(&self, target: (&BalanceOf<T>,)) -> Weight {
+		let multiplier = self.0;
+		(*target.0 * multiplier).saturated_into::<u32>()
+	}
+}
+
+impl<T: balances::Trait> ClassifyDispatch<(&BalanceOf<T>,)> for WeightForSetDummy<T> {
+	fn classify_dispatch(&self, target: (&BalanceOf<T>,)) -> DispatchClass {
+		if *target.0 > <BalanceOf<T>>::from(1000u32) {
+			DispatchClass::Operational
+		} else {
+			DispatchClass::Normal
+		}
+	}
+}
+
+/// A type alias for the balance type from this module's point of view.
+type BalanceOf<T> = <T as balances::Trait>::Balance;
+
+/// Our module's configuration trait. All our types and constants go in here. If the
+/// module is dependent on specific other modules, then their configuration traits
+/// should be added to our implied traits list.
+///
+/// `system::Trait` should always be included in our implied traits.
+pub trait Trait: balances::Trait {
+	/// The overarching event type.
+	type Event: From<Event<Self>> + Into<<Self as system::Trait>::Event>;
+}
+
+decl_storage! {
+	// A macro for the Storage trait, and its implementation, for this module.
+	// This allows for type-safe usage of the Substrate storage database, so you can
+	// keep things around between blocks.
+	trait Store for Module<T: Trait> as Example {
+		// Any storage declarations of the form:
+		//   `pub? Name get(fn getter_name)? [config()|config(myname)] [build(|_| {...})] : <type> (= <new_default_value>)?;`
+		// where `<type>` is either:
+		//   - `Type` (a basic value item); or
+		//   - `map KeyType => ValueType` (a map item).
+		//
+		// Note that there are two optional modifiers for the storage type declaration.
+		// - `Foo: Option<u32>`:
+		//   - `Foo::put(1); Foo::get()` returns `Some(1)`;
+		//   - `Foo::kill(); Foo::get()` returns `None`.
+		// - `Foo: u32`:
+		//   - `Foo::put(1); Foo::get()` returns `1`;
+		//   - `Foo::kill(); Foo::get()` returns `0` (u32::default()).
+		// e.g. Foo: u32;
+		// e.g. pub Bar get(fn bar): map T::AccountId => Vec<(T::Balance, u64)>;
+		//
+		// For basic value items, you'll get a type which implements
+		// `support::StorageValue`. For map items, you'll get a type which
+		// implements `support::StorageMap`.
+		//
+		// If they have a getter (`get(getter_name)`), then your module will come
+		// equipped with `fn getter_name() -> Type` for basic value items or
+		// `fn getter_name(key: KeyType) -> ValueType` for map items.
+		Dummy get(fn dummy) config(): Option<T::Balance>;
+
+		// A map that has enumerable entries.
+		Bar get(fn bar) config(): linked_map T::AccountId => T::Balance;
+
+		// this one uses the default, we'll demonstrate the usage of 'mutate' API.
+		Foo get(fn foo) config(): T::Balance;
+	}
+}
+
+decl_event!(
+	/// Events are a simple means of reporting specific conditions and
+	/// circumstances that have happened that users, Dapps and/or chain explorers would find
+	/// interesting and otherwise difficult to detect.
+	pub enum Event<T> where B = <T as balances::Trait>::Balance {
+		// Just a normal `enum`, here's a dummy event to ensure it compiles.
+		/// Dummy event, just here so there's a generic type that's used.
+		Dummy(B),
+	}
+);
+
+// The module declaration. This states the entry points that we handle. The
+// macro takes care of the marshalling of arguments and dispatch.
+//
+// Anyone can have these functions execute by signing and submitting
+// an extrinsic. Ensure that calls into each of these execute in a time, memory and
+// using storage space proportional to any costs paid for by the caller or otherwise the
+// difficulty of forcing the call to happen.
+//
+// Generally you'll want to split these into three groups:
+// - Public calls that are signed by an external account.
+// - Root calls that are allowed to be made only by the governance system.
+// - Unsigned calls that can be of two kinds:
+//   * "Inherent extrinsics" that are opinions generally held by the block
+//     authors that build child blocks.
+//   * Unsigned Transactions that are of intrinsic recognisable utility to the
+//     network, and are validated by the runtime.
+//
+// Information about where this dispatch initiated from is provided as the first argument
+// "origin". As such functions must always look like:
+//
+// `fn foo(origin, bar: Bar, baz: Baz) -> Result;`
+//
+// The `Result` is required as part of the syntax (and expands to the conventional dispatch
+// result of `Result<(), &'static str>`).
+//
+// When you come to `impl` them later in the module, you must specify the full type for `origin`:
+//
+// `fn foo(origin: T::Origin, bar: Bar, baz: Baz) { ... }`
+//
+// There are three entries in the `system::Origin` enum that correspond
+// to the above bullets: `::Signed(AccountId)`, `::Root` and `::None`. You should always match
+// against them as the first thing you do in your function. There are three convenience calls
+// in system that do the matching for you and return a convenient result: `ensure_signed`,
+// `ensure_root` and `ensure_none`.
+decl_module! {
+	// Simple declaration of the `Module` type. Lets the macro know what its working on.
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		/// Deposit one of this module's events by using the default implementation.
+		/// It is also possible to provide a custom implementation.
+		/// For non-generic events, the generic parameter just needs to be dropped, so that it
+		/// looks like: `fn deposit_event() = default;`.
+		fn deposit_event() = default;
+		/// This is your public interface. Be extremely careful.
+		/// This is just a simple example of how to interact with the module from the external
+		/// world.
+		// This just increases the value of `Dummy` by `increase_by`.
+		//
+		// Since this is a dispatched function there are two extremely important things to
+		// remember:
+		//
+		// - MUST NOT PANIC: Under no circumstances (save, perhaps, storage getting into an
+		// irreparably damaged state) must this function panic.
+		// - NO SIDE-EFFECTS ON ERROR: This function must either complete totally (and return
+		// `Ok(())` or it must have no side-effects on storage and return `Err('Some reason')`.
+		//
+		// The first is relatively easy to audit for - just ensure all panickers are removed from
+		// logic that executes in production (which you do anyway, right?!). To ensure the second
+		// is followed, you should do all tests for validity at the top of your function. This
+		// is stuff like checking the sender (`origin`) or that state is such that the operation
+		// makes sense.
+		//
+		// Once you've determined that it's all good, then enact the operation and change storage.
+		// If you can't be certain that the operation will succeed without substantial computation
+		// then you have a classic blockchain attack scenario. The normal way of managing this is
+		// to attach a bond to the operation. As the first major alteration of storage, reserve
+		// some value from the sender's account (`Balances` module has a `reserve` function for
+		// exactly this scenario). This amount should be enough to cover any costs of the
+		// substantial execution in case it turns out that you can't proceed with the operation.
+		//
+		// If it eventually transpires that the operation is fine and, therefore, that the
+		// expense of the checks should be borne by the network, then you can refund the reserved
+		// deposit. If, however, the operation turns out to be invalid and the computation is
+		// wasted, then you can burn it or repatriate elsewhere.
+		//
+		// Security bonds ensure that attackers can't game it by ensuring that anyone interacting
+		// with the system either progresses it or pays for the trouble of faffing around with
+		// no progress.
+		//
+		// If you don't respect these rules, it is likely that your chain will be attackable.
+		//
+		// Each transaction can define an optional `#[weight]` attribute to convey a set of static
+		// information about its dispatch. The `system` and `executive` module then use this
+		// information to properly execute the transaction, whilst keeping the total load of the
+		// chain in a moderate rate.
+		//
+		// The _right-hand-side_ value of the `#[weight]` attribute can be any type that implements
+		// a set of traits, namely [`WeighData`] and [`ClassifyDispatch`]. The former conveys the
+		// weight (a numeric representation of pure execution time and difficulty) of the
+		// transaction and the latter demonstrates the [`DispatchClass`] of the call. A higher
+		// weight means a larger transaction (less of which can be placed in a single block).
+		#[weight = SimpleDispatchInfo::FixedNormal(10_000)]
+		fn accumulate_dummy(origin, increase_by: T::Balance) -> Result {
+			// This is a public call, so we ensure that the origin is some signed account.
+			let _sender = ensure_signed(origin)?;
+
+			// Read the value of dummy from storage.
+			// let dummy = Self::dummy();
+			// Will also work using the `::get` on the storage item type itself:
+			// let dummy = <Dummy<T>>::get();
+
+			// Calculate the new value.
+			// let new_dummy = dummy.map_or(increase_by, |dummy| dummy + increase_by);
+
+			// Put the new value into storage.
+			// <Dummy<T>>::put(new_dummy);
+			// Will also work with a reference:
+			// <Dummy<T>>::put(&new_dummy);
+
+			// Here's the new one of read and then modify the value.
+			<Dummy<T>>::mutate(|dummy| {
+				let new_dummy = dummy.map_or(increase_by, |dummy| dummy + increase_by);
+				*dummy = Some(new_dummy);
+			});
+
+			// Let's deposit an event to let the outside world know this happened.
+			Self::deposit_event(RawEvent::Dummy(increase_by));
+
+			// All good.
+			Ok(())
+		}
+
+		/// A privileged call; in this case it resets our dummy value to something new.
+		// Implementation of a privileged call. The `origin` parameter is ROOT because
+		// it's not (directly) from an extrinsic, but rather the system as a whole has decided
+		// to execute it. Different runtimes have different reasons for allow privileged
+		// calls to be executed - we don't need to care why. Because it's privileged, we can
+		// assume it's a one-off operation and substantial processing/storage/memory can be used
+		// without worrying about gameability or attack scenarios.
+		// If you do not specify `Result` explicitly as return value, it will be added automatically
+		// for you and `Ok(())` will be returned.
+		#[weight = WeightForSetDummy::<T>(<BalanceOf<T>>::from(100u32))]
+		fn set_dummy(origin, #[compact] new_value: T::Balance) {
+			ensure_root(origin)?;
+			// Put the new value into storage.
+			<Dummy<T>>::put(new_value);
+		}
+
+		// The signature could also look like: `fn on_initialize()`.
+		// This function could also very well have a weight annotation, similar to any other. The
+		// only difference being that if it is not annotated, the default is
+		// `SimpleDispatchInfo::zero()`, which resolves into no weight.
+		#[weight = SimpleDispatchInfo::FixedNormal(1000)]
+		fn on_initialize(_n: T::BlockNumber) {
+			// Anything that needs to be done at the start of the block.
+			// We don't do anything here.
+		}
+
+		// The signature could also look like: `fn on_finalize()`
+		#[weight = SimpleDispatchInfo::FixedNormal(2000)]
+		fn on_finalize(_n: T::BlockNumber) {
+			// Anything that needs to be done at the end of the block.
+			// We just kill our dummy storage item.
+			<Dummy<T>>::kill();
+		}
+
+		// A runtime code run after every block and have access to extended set of APIs.
+		//
+		// For instance you can generate extrinsics for the upcoming produced block.
+		fn offchain_worker(_n: T::BlockNumber) {
+			// We don't do anything here.
+			// but we could dispatch extrinsic (transaction/unsigned/inherent) using
+			// runtime_io::submit_extrinsic
+		}
+	}
+}
+
+// The main implementation block for the module. Functions here fall into three broad
+// categories:
+// - Public interface. These are functions that are `pub` and generally fall into inspector
+// functions that do not write to storage and operation functions that do.
+// - Private functions. These are your usual private utilities unavailable to other modules.
+impl<T: Trait> Module<T> {
+	// Add public immutables and private mutables.
+	#[allow(dead_code)]
+	fn accumulate_foo(origin: T::Origin, increase_by: T::Balance) -> Result {
+		let _sender = ensure_signed(origin)?;
+
+		let prev = <Foo<T>>::get();
+		// Because Foo has 'default', the type of 'foo' in closure is the raw type instead of an Option<> type.
+		let result = <Foo<T>>::mutate(|foo| {
+			*foo = *foo + increase_by;
+			*foo
+		});
+		assert!(prev + increase_by == result);
+
+		Ok(())
+	}
+}
+
+// Similar to other SRML modules, your module can also define a signed extension and perform some
+// checks and [pre/post]processing [before/after] the transaction. A signed extension can be any
+// decodable type that implements `SignedExtension`. See the trait definition for the full list of
+// bounds. As a convention, you can follow this approach to create an extension for your module:
+//   - If the extension does not carry any data, then use a tuple struct with just a `marker`
+//     (needed for the compiler to accept `T: Trait`) will suffice.
+//   - Otherwise, create a tuple struct which contains the external data. Of course, for the entire
+//     struct to be decodable, each individual item also needs to be decodable.
+//
+// Note that a signed extension can also indicate that a particular data must be present in the
+// _signing payload_ of a transaction by providing an implementation for the `additional_signed`
+// method. This example will not cover this type of extension. See `CheckRuntime` in system module
+// for an example.
+//
+// Using the extension, you can add some hooks to the lifecycle of each transaction. Note that by
+// default, an extension is applied to all `Call` functions (i.e. all transactions). the `Call` enum
+// variant is given to each function of `SignedExtension`. Hence, you can filter based on module or
+// a particular call if needed.
+//
+// Some extra information, such as encoded length, some static dispatch info like weight and the
+// sender of the transaction (if signed) are also provided.
+//
+// The full list of hooks that can be added to a signed extension can be found
+// [here](https://crates.parity.io/sr_primitives/traits/trait.SignedExtension.html).
+//
+// The signed extensions are aggregated in the runtime file of a substrate chain. All extensions
+// should be aggregated in a tuple and passed to the `CheckedExtrinsic` and `UncheckedExtrinsic`
+// types defined in the runtime. Lookup `pub type SignedExtra = (...)` in `node/runtime` and
+// `node-template` for an example of this.
+
+/// A simple signed extension that checks for the `set_dummy` call. In that case, it increases the
+/// priority and prints some log.
+///
+/// Additionally, it drops any transaction with an encoded length higher than 200 bytes. No
+/// particular reason why, just to demonstrate the power of signed extensions.
+#[derive(Encode, Decode, Clone, Eq, PartialEq)]
+pub struct WatchDummy<T: Trait + Send + Sync>(PhantomData<T>);
+
+impl<T: Trait + Send + Sync> rstd::fmt::Debug for WatchDummy<T> {
+	fn fmt(&self, f: &mut rstd::fmt::Formatter) -> rstd::fmt::Result {
+		write!(f, "WatchDummy")
+	}
+}
+
+impl<T: Trait + Send + Sync> SignedExtension for WatchDummy<T> {
+	type AccountId = T::AccountId;
+	// Note that this could also be assigned to the top-level call enum. It is passed into the
+	// balances module directly and since `Trait: balances::Trait`, you could also use `T::Call`.
+	// In that case, you would have had access to all call variants and could match on variants from
+	// other modules.
+	type Call = Call<T>;
+	type AdditionalSigned = ();
+	type DispatchInfo = DispatchInfo;
+	type Pre = ();
+
+	fn additional_signed(&self) -> rstd::result::Result<(), TransactionValidityError> { Ok(()) }
+
+	fn validate(
+		&self,
+		_who: &Self::AccountId,
+		call: &Self::Call,
+		_info: Self::DispatchInfo,
+		len: usize,
+	) -> TransactionValidity {
+		// if the transaction is too big, just drop it.
+		if len > 200 {
+			return InvalidTransaction::ExhaustsResources.into()
+		}
+
+		// check for `set_dummy`
+		match call {
+			Call::set_dummy(..) => {
+				sr_primitives::print("set_dummy was received.");
+
+				let mut valid_tx = ValidTransaction::default();
+				valid_tx.priority = Bounded::max_value();
+				Ok(valid_tx)
+			}
+			_ => Ok(Default::default()),
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	use support::{assert_ok, impl_outer_origin, parameter_types, weights::GetDispatchInfo};
+	use primitives::H256;
+	// The testing primitives are very useful for avoiding having to work with signatures
+	// or public keys. `u64` is used as the `AccountId` and no `Signature`s are required.
+	use sr_primitives::{
+		Perbill, testing::Header,
+		traits::{BlakeTwo256, OnInitialize, OnFinalize, IdentityLookup},
+	};
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	// For testing the module, we construct most of a mock runtime. This means
+	// first constructing a configuration type (`Test`) which `impl`s each of the
+	// configuration traits of modules we want to use.
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Hash = H256;
+		type Call = ();
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type MaximumBlockLength = MaximumBlockLength;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type Version = ();
+	}
+	parameter_types! {
+		pub const ExistentialDeposit: u64 = 0;
+		pub const TransferFee: u64 = 0;
+		pub const CreationFee: u64 = 0;
+	}
+	impl balances::Trait for Test {
+		type Balance = u64;
+		type OnFreeBalanceZero = ();
+		type OnNewAccount = ();
+		type Event = ();
+		type TransferPayment = ();
+		type DustRemoval = ();
+		type ExistentialDeposit = ExistentialDeposit;
+		type TransferFee = TransferFee;
+		type CreationFee = CreationFee;
+	}
+	impl Trait for Test {
+		type Event = ();
+	}
+	type Example = Module<Test>;
+
+	// This function basically just builds a genesis storage key/value store according to
+	// our desired mockup.
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		// We use default for brevity, but you can configure as desired if needed.
+		balances::GenesisConfig::<Test>::default().assimilate_storage(&mut t).unwrap();
+		GenesisConfig::<Test>{
+			dummy: 42,
+			// we configure the map with (key, value) pairs.
+			bar: vec![(1, 2), (2, 3)],
+			foo: 24,
+		}.assimilate_storage(&mut t).unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn it_works_for_optional_value() {
+		new_test_ext().execute_with(|| {
+			// Check that GenesisBuilder works properly.
+			assert_eq!(Example::dummy(), Some(42));
+
+			// Check that accumulate works when we have Some value in Dummy already.
+			assert_ok!(Example::accumulate_dummy(Origin::signed(1), 27));
+			assert_eq!(Example::dummy(), Some(69));
+
+			// Check that finalizing the block removes Dummy from storage.
+			<Example as OnFinalize<u64>>::on_finalize(1);
+			assert_eq!(Example::dummy(), None);
+
+			// Check that accumulate works when we Dummy has None in it.
+			<Example as OnInitialize<u64>>::on_initialize(2);
+			assert_ok!(Example::accumulate_dummy(Origin::signed(1), 42));
+			assert_eq!(Example::dummy(), Some(42));
+		});
+	}
+
+	#[test]
+	fn it_works_for_default_value() {
+		new_test_ext().execute_with(|| {
+			assert_eq!(Example::foo(), 24);
+			assert_ok!(Example::accumulate_foo(Origin::signed(1), 1));
+			assert_eq!(Example::foo(), 25);
+		});
+	}
+
+	#[test]
+	fn signed_ext_watch_dummy_works() {
+		new_test_ext().execute_with(|| {
+			let call = <Call<Test>>::set_dummy(10);
+			let info = DispatchInfo::default();
+
+			assert_eq!(
+				WatchDummy::<Test>(PhantomData).validate(&1, &call, info, 150)
+					.unwrap()
+					.priority,
+				Bounded::max_value(),
+			);
+			assert_eq!(
+				WatchDummy::<Test>(PhantomData).validate(&1, &call, info, 250),
+				InvalidTransaction::ExhaustsResources.into(),
+			);
+		})
+	}
+
+	#[test]
+	fn weights_work() {
+		// must have a default weight.
+		let default_call = <Call<Test>>::accumulate_dummy(10);
+		let info = default_call.get_dispatch_info();
+		// aka. `let info = <Call<Test> as GetDispatchInfo>::get_dispatch_info(&default_call);`
+		assert_eq!(info.weight, 10_000);
+
+		// must have a custom weight of `100 * arg = 2000`
+		let custom_call = <Call<Test>>::set_dummy(20);
+		let info = custom_call.get_dispatch_info();
+		assert_eq!(info.weight, 2000);
+	}
+}

substrate/frame/executive/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "frame-executive"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+hex-literal = "0.2.1"
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+pallet-indices = { path = "../indices" }
+balances = { package = "pallet-balances", path = "../balances" }
+transaction-payment = { package = "pallet-transaction-payment", path = "../transaction-payment" }
+
+[features]
+default = ["std"]
+std = [
+	"rstd/std",
+	"support/std",
+	"serde",
+	"codec/std",
+	"sr-primitives/std",
+	"runtime-io/std",
+	"system/std",
+]

substrate/frame/executive/src/lib.rs

@@ -0,0 +1,726 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Executive Module
+//!
+//! The Executive module acts as the orchestration layer for the runtime. It dispatches incoming
+//! extrinsic calls to the respective modules in the runtime.
+//!
+//! ## Overview
+//!
+//! The executive module is not a typical SRML module providing functionality around a specific feature.
+//! It is a cross-cutting framework component for the SRML. It works in conjunction with the
+//! [SRML System module](../frame_system/index.html) to perform these cross-cutting functions.
+//!
+//! The Executive module provides functions to:
+//!
+//! - Check transaction validity.
+//! - Initialize a block.
+//! - Apply extrinsics.
+//! - Execute a block.
+//! - Finalize a block.
+//! - Start an off-chain worker.
+//!
+//! ### Implementations
+//!
+//! The Executive module provides the following implementations:
+//!
+//! - `ExecuteBlock`: Trait that can be used to execute a block.
+//! - `Executive`: Type that can be used to make the SRML available from the runtime.
+//!
+//! ## Usage
+//!
+//! The default Substrate node template declares the [`Executive`](./struct.Executive.html) type in its library.
+//!
+//! ### Example
+//!
+//! `Executive` type declaration from the node template.
+//!
+//! ```
+//! # use sr_primitives::generic;
+//! # use frame_executive as executive;
+//! # pub struct UncheckedExtrinsic {};
+//! # pub struct Header {};
+//! # type Context = system::ChainContext<Runtime>;
+//! # pub type Block = generic::Block<Header, UncheckedExtrinsic>;
+//! # pub type Balances = u64;
+//! # pub type AllModules = u64;
+//! # pub enum Runtime {};
+//! # use sr_primitives::transaction_validity::{TransactionValidity, UnknownTransaction};
+//!	# #[allow(deprecated)]
+//! # use sr_primitives::traits::ValidateUnsigned;
+//!	# #[allow(deprecated)]
+//! # impl ValidateUnsigned for Runtime {
+//! # 	type Call = ();
+//! #
+//! # 	fn validate_unsigned(_call: &Self::Call) -> TransactionValidity {
+//! # 		UnknownTransaction::NoUnsignedValidator.into()
+//! # 	}
+//! # }
+//! /// Executive: handles dispatch to the various modules.
+//! pub type Executive = executive::Executive<Runtime, Block, Context, Runtime, AllModules>;
+//! ```
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::{prelude::*, marker::PhantomData};
+use support::weights::{GetDispatchInfo, WeighBlock, DispatchInfo};
+use sr_primitives::{
+	generic::Digest, ApplyExtrinsicResult,
+	traits::{
+		self, Header, Zero, One, Checkable, Applyable, CheckEqual, OnFinalize, OnInitialize,
+		NumberFor, Block as BlockT, OffchainWorker, Dispatchable,
+	},
+	transaction_validity::TransactionValidity,
+};
+#[allow(deprecated)]
+use sr_primitives::traits::ValidateUnsigned;
+use codec::{Codec, Encode};
+use system::{extrinsics_root, DigestOf};
+
+/// Trait that can be used to execute a block.
+pub trait ExecuteBlock<Block: BlockT> {
+	/// Actually execute all transitions for `block`.
+	fn execute_block(block: Block);
+}
+
+pub type CheckedOf<E, C> = <E as Checkable<C>>::Checked;
+pub type CallOf<E, C> = <CheckedOf<E, C> as Applyable>::Call;
+pub type OriginOf<E, C> = <CallOf<E, C> as Dispatchable>::Origin;
+
+pub struct Executive<System, Block, Context, UnsignedValidator, AllModules>(
+	PhantomData<(System, Block, Context, UnsignedValidator, AllModules)>
+);
+
+#[allow(deprecated)] // Allow ValidateUnsigned, remove the attribute when the trait is removed.
+impl<
+	System: system::Trait,
+	Block: traits::Block<Header=System::Header, Hash=System::Hash>,
+	Context: Default,
+	UnsignedValidator,
+	AllModules:
+		OnInitialize<System::BlockNumber> +
+		OnFinalize<System::BlockNumber> +
+		OffchainWorker<System::BlockNumber> +
+		WeighBlock<System::BlockNumber>,
+> ExecuteBlock<Block> for Executive<System, Block, Context, UnsignedValidator, AllModules>
+where
+	Block::Extrinsic: Checkable<Context> + Codec,
+	CheckedOf<Block::Extrinsic, Context>:
+		Applyable<AccountId=System::AccountId, DispatchInfo=DispatchInfo> +
+		GetDispatchInfo,
+	CallOf<Block::Extrinsic, Context>: Dispatchable,
+	OriginOf<Block::Extrinsic, Context>: From<Option<System::AccountId>>,
+	UnsignedValidator: ValidateUnsigned<Call=CallOf<Block::Extrinsic, Context>>,
+{
+	fn execute_block(block: Block) {
+		Executive::<System, Block, Context, UnsignedValidator, AllModules>::execute_block(block);
+	}
+}
+
+#[allow(deprecated)] // Allow ValidateUnsigned, remove the attribute when the trait is removed.
+impl<
+	System: system::Trait,
+	Block: traits::Block<Header=System::Header, Hash=System::Hash>,
+	Context: Default,
+	UnsignedValidator,
+	AllModules:
+		OnInitialize<System::BlockNumber> +
+		OnFinalize<System::BlockNumber> +
+		OffchainWorker<System::BlockNumber> +
+		WeighBlock<System::BlockNumber>,
+> Executive<System, Block, Context, UnsignedValidator, AllModules>
+where
+	Block::Extrinsic: Checkable<Context> + Codec,
+	CheckedOf<Block::Extrinsic, Context>:
+		Applyable<AccountId=System::AccountId, DispatchInfo=DispatchInfo> +
+		GetDispatchInfo,
+	CallOf<Block::Extrinsic, Context>: Dispatchable,
+	OriginOf<Block::Extrinsic, Context>: From<Option<System::AccountId>>,
+	UnsignedValidator: ValidateUnsigned<Call=CallOf<Block::Extrinsic, Context>>,
+{
+	/// Start the execution of a particular block.
+	pub fn initialize_block(header: &System::Header) {
+		let mut digests = <DigestOf<System>>::default();
+		header.digest().logs().iter().for_each(|d| if d.as_pre_runtime().is_some() { digests.push(d.clone()) });
+		Self::initialize_block_impl(header.number(), header.parent_hash(), header.extrinsics_root(), &digests);
+	}
+
+	fn initialize_block_impl(
+		block_number: &System::BlockNumber,
+		parent_hash: &System::Hash,
+		extrinsics_root: &System::Hash,
+		digest: &Digest<System::Hash>,
+	) {
+		<system::Module<System>>::initialize(block_number, parent_hash, extrinsics_root, digest);
+		<AllModules as OnInitialize<System::BlockNumber>>::on_initialize(*block_number);
+		<system::Module<System>>::register_extra_weight_unchecked(
+			<AllModules as WeighBlock<System::BlockNumber>>::on_initialize(*block_number)
+		);
+		<system::Module<System>>::register_extra_weight_unchecked(
+			<AllModules as WeighBlock<System::BlockNumber>>::on_finalize(*block_number)
+		);
+	}
+
+	fn initial_checks(block: &Block) {
+		let header = block.header();
+
+		// Check that `parent_hash` is correct.
+		let n = header.number().clone();
+		assert!(
+			n > System::BlockNumber::zero()
+			&& <system::Module<System>>::block_hash(n - System::BlockNumber::one()) == *header.parent_hash(),
+			"Parent hash should be valid."
+		);
+
+		// Check that transaction trie root represents the transactions.
+		let xts_root = extrinsics_root::<System::Hashing, _>(&block.extrinsics());
+		header.extrinsics_root().check_equal(&xts_root);
+		assert!(header.extrinsics_root() == &xts_root, "Transaction trie root must be valid.");
+	}
+
+	/// Actually execute all transitions for `block`.
+	pub fn execute_block(block: Block) {
+		Self::initialize_block(block.header());
+
+		// any initial checks
+		Self::initial_checks(&block);
+
+		// execute extrinsics
+		let (header, extrinsics) = block.deconstruct();
+		Self::execute_extrinsics_with_book_keeping(extrinsics, *header.number());
+
+		// any final checks
+		Self::final_checks(&header);
+	}
+
+	/// Execute given extrinsics and take care of post-extrinsics book-keeping.
+	fn execute_extrinsics_with_book_keeping(extrinsics: Vec<Block::Extrinsic>, block_number: NumberFor<Block>) {
+
+		extrinsics.into_iter().for_each(Self::apply_extrinsic_no_note);
+
+		// post-extrinsics book-keeping
+		<system::Module<System>>::note_finished_extrinsics();
+		<AllModules as OnFinalize<System::BlockNumber>>::on_finalize(block_number);
+	}
+
+	/// Finalize the block - it is up the caller to ensure that all header fields are valid
+	/// except state-root.
+	pub fn finalize_block() -> System::Header {
+		<system::Module<System>>::note_finished_extrinsics();
+		<AllModules as OnFinalize<System::BlockNumber>>::on_finalize(<system::Module<System>>::block_number());
+
+		// set up extrinsics
+		<system::Module<System>>::derive_extrinsics();
+		<system::Module<System>>::finalize()
+	}
+
+	/// Apply extrinsic outside of the block execution function.
+	///
+	/// This doesn't attempt to validate anything regarding the block, but it builds a list of uxt
+	/// hashes.
+	pub fn apply_extrinsic(uxt: Block::Extrinsic) -> ApplyExtrinsicResult {
+		let encoded = uxt.encode();
+		let encoded_len = encoded.len();
+		Self::apply_extrinsic_with_len(uxt, encoded_len, Some(encoded))
+	}
+
+	/// Apply an extrinsic inside the block execution function.
+	fn apply_extrinsic_no_note(uxt: Block::Extrinsic) {
+		let l = uxt.encode().len();
+		match Self::apply_extrinsic_with_len(uxt, l, None) {
+			Ok(Ok(())) => (),
+			Ok(Err(e)) => sr_primitives::print(e),
+			Err(e) => { let err: &'static str = e.into(); panic!(err) },
+		}
+	}
+
+	/// Actually apply an extrinsic given its `encoded_len`; this doesn't note its hash.
+	fn apply_extrinsic_with_len(
+		uxt: Block::Extrinsic,
+		encoded_len: usize,
+		to_note: Option<Vec<u8>>,
+	) -> ApplyExtrinsicResult {
+		// Verify that the signature is good.
+		let xt = uxt.check(&Default::default())?;
+
+		// We don't need to make sure to `note_extrinsic` only after we know it's going to be
+		// executed to prevent it from leaking in storage since at this point, it will either
+		// execute or panic (and revert storage changes).
+		if let Some(encoded) = to_note {
+			<system::Module<System>>::note_extrinsic(encoded);
+		}
+
+		// AUDIT: Under no circumstances may this function panic from here onwards.
+
+		// Decode parameters and dispatch
+		let dispatch_info = xt.get_dispatch_info();
+		let r = Applyable::apply::<UnsignedValidator>(xt, dispatch_info, encoded_len)?;
+
+		<system::Module<System>>::note_applied_extrinsic(&r, encoded_len as u32, dispatch_info);
+
+		Ok(r)
+	}
+
+	fn final_checks(header: &System::Header) {
+		// remove temporaries
+		let new_header = <system::Module<System>>::finalize();
+
+		// check digest
+		assert_eq!(
+			header.digest().logs().len(),
+			new_header.digest().logs().len(),
+			"Number of digest items must match that calculated."
+		);
+		let items_zip = header.digest().logs().iter().zip(new_header.digest().logs().iter());
+		for (header_item, computed_item) in items_zip {
+			header_item.check_equal(&computed_item);
+			assert!(header_item == computed_item, "Digest item must match that calculated.");
+		}
+
+		// check storage root.
+		let storage_root = new_header.state_root();
+		header.state_root().check_equal(&storage_root);
+		assert!(header.state_root() == storage_root, "Storage root must match that calculated.");
+	}
+
+	/// Check a given signed transaction for validity. This doesn't execute any
+	/// side-effects; it merely checks whether the transaction would panic if it were included or not.
+	///
+	/// Changes made to storage should be discarded.
+	pub fn validate_transaction(uxt: Block::Extrinsic) -> TransactionValidity {
+		let encoded_len = uxt.using_encoded(|d| d.len());
+		let xt = uxt.check(&Default::default())?;
+
+		let dispatch_info = xt.get_dispatch_info();
+		xt.validate::<UnsignedValidator>(dispatch_info, encoded_len)
+	}
+
+	/// Start an offchain worker and generate extrinsics.
+	pub fn offchain_worker(n: System::BlockNumber) {
+		<AllModules as OffchainWorker<System::BlockNumber>>::generate_extrinsics(n)
+	}
+}
+
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use primitives::H256;
+	use sr_primitives::{
+		generic::Era, Perbill, DispatchError, testing::{Digest, Header, Block},
+		traits::{Bounded, Header as HeaderT, BlakeTwo256, IdentityLookup, ConvertInto},
+		transaction_validity::{InvalidTransaction, UnknownTransaction, TransactionValidityError},
+	};
+	use support::{
+		impl_outer_event, impl_outer_origin, parameter_types, impl_outer_dispatch,
+		weights::Weight,
+		traits::{Currency, LockIdentifier, LockableCurrency, WithdrawReasons, WithdrawReason},
+	};
+	use system::{Call as SystemCall, ChainContext};
+	use balances::Call as BalancesCall;
+	use hex_literal::hex;
+
+	mod custom {
+		use support::weights::SimpleDispatchInfo;
+
+		pub trait Trait: system::Trait {}
+
+		support::decl_module! {
+			pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+				#[weight = SimpleDispatchInfo::FixedNormal(100)]
+				fn some_function(origin) {
+					// NOTE: does not make any different.
+					let _ = system::ensure_signed(origin);
+				}
+				#[weight = SimpleDispatchInfo::FixedOperational(200)]
+				fn some_root_operation(origin) {
+					let _ = system::ensure_root(origin);
+				}
+				#[weight = SimpleDispatchInfo::FreeNormal]
+				fn some_unsigned_message(origin) {
+					let _ = system::ensure_none(origin);
+				}
+
+				// module hooks.
+				// one with block number arg and one without
+				#[weight = SimpleDispatchInfo::FixedNormal(25)]
+				fn on_initialize(n: T::BlockNumber) {
+					println!("on_initialize({})", n);
+				}
+				#[weight = SimpleDispatchInfo::FixedNormal(150)]
+				fn on_finalize() {
+					println!("on_finalize(?)");
+				}
+			}
+		}
+	}
+
+	type System = system::Module<Runtime>;
+	type Balances = balances::Module<Runtime>;
+	type Custom = custom::Module<Runtime>;
+
+	impl_outer_origin! {
+		pub enum Origin for Runtime { }
+	}
+
+	impl_outer_event!{
+		pub enum MetaEvent for Runtime {
+			balances<T>,
+		}
+	}
+	impl_outer_dispatch! {
+		pub enum Call for Runtime where origin: Origin {
+			system::System,
+			balances::Balances,
+		}
+	}
+
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Runtime;
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Runtime {
+		type Origin = Origin;
+		type Index = u64;
+		type Call = Call;
+		type BlockNumber = u64;
+		type Hash = primitives::H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<u64>;
+		type Header = Header;
+		type Event = MetaEvent;
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+	parameter_types! {
+		pub const ExistentialDeposit: u64 = 0;
+		pub const TransferFee: u64 = 0;
+		pub const CreationFee: u64 = 0;
+	}
+	impl balances::Trait for Runtime {
+		type Balance = u64;
+		type OnFreeBalanceZero = ();
+		type OnNewAccount = ();
+		type Event = MetaEvent;
+		type DustRemoval = ();
+		type TransferPayment = ();
+		type ExistentialDeposit = ExistentialDeposit;
+		type TransferFee = TransferFee;
+		type CreationFee = CreationFee;
+	}
+
+	parameter_types! {
+		pub const TransactionBaseFee: u64 = 10;
+		pub const TransactionByteFee: u64 = 0;
+	}
+	impl transaction_payment::Trait for Runtime {
+		type Currency = Balances;
+		type OnTransactionPayment = ();
+		type TransactionBaseFee = TransactionBaseFee;
+		type TransactionByteFee = TransactionByteFee;
+		type WeightToFee = ConvertInto;
+		type FeeMultiplierUpdate = ();
+	}
+	impl custom::Trait for Runtime {}
+
+	#[allow(deprecated)]
+	impl ValidateUnsigned for Runtime {
+		type Call = Call;
+
+		fn pre_dispatch(_call: &Self::Call) -> Result<(), TransactionValidityError> {
+			Ok(())
+		}
+
+		fn validate_unsigned(call: &Self::Call) -> TransactionValidity {
+			match call {
+				Call::Balances(BalancesCall::set_balance(_, _, _)) => Ok(Default::default()),
+				_ => UnknownTransaction::NoUnsignedValidator.into(),
+			}
+		}
+	}
+
+	type SignedExtra = (
+		system::CheckEra<Runtime>,
+		system::CheckNonce<Runtime>,
+		system::CheckWeight<Runtime>,
+		transaction_payment::ChargeTransactionPayment<Runtime>
+	);
+	type AllModules = (System, Balances, Custom);
+	type TestXt = sr_primitives::testing::TestXt<Call, SignedExtra>;
+	type Executive = super::Executive<Runtime, Block<TestXt>, ChainContext<Runtime>, Runtime, AllModules>;
+
+	fn extra(nonce: u64, fee: u64) -> SignedExtra {
+		(
+			system::CheckEra::from(Era::Immortal),
+			system::CheckNonce::from(nonce),
+			system::CheckWeight::new(),
+			transaction_payment::ChargeTransactionPayment::from(fee)
+		)
+	}
+
+	fn sign_extra(who: u64, nonce: u64, fee: u64) -> Option<(u64, SignedExtra)> {
+		Some((who, extra(nonce, fee)))
+	}
+
+	#[test]
+	fn balance_transfer_dispatch_works() {
+		let mut t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+		balances::GenesisConfig::<Runtime> {
+			balances: vec![(1, 211)],
+			vesting: vec![],
+		}.assimilate_storage(&mut t).unwrap();
+		let xt = sr_primitives::testing::TestXt(sign_extra(1, 0, 0), Call::Balances(BalancesCall::transfer(2, 69)));
+		let weight = xt.get_dispatch_info().weight as u64;
+		let mut t = runtime_io::TestExternalities::new(t);
+		t.execute_with(|| {
+			Executive::initialize_block(&Header::new(
+				1,
+				H256::default(),
+				H256::default(),
+				[69u8; 32].into(),
+				Digest::default(),
+			));
+			let r = Executive::apply_extrinsic(xt);
+			assert!(r.is_ok());
+			assert_eq!(<balances::Module<Runtime>>::total_balance(&1), 142 - 10 - weight);
+			assert_eq!(<balances::Module<Runtime>>::total_balance(&2), 69);
+		});
+	}
+
+	fn new_test_ext(balance_factor: u64) -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+		balances::GenesisConfig::<Runtime> {
+			balances: vec![(1, 111 * balance_factor)],
+			vesting: vec![],
+		}.assimilate_storage(&mut t).unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn block_import_works() {
+		new_test_ext(1).execute_with(|| {
+			Executive::execute_block(Block {
+				header: Header {
+					parent_hash: [69u8; 32].into(),
+					number: 1,
+					state_root: hex!("f0d1d66255c2e5b40580eb8b93ddbe732491478487f85e358e1d167d369e398e").into(),
+					extrinsics_root: hex!("03170a2e7597b7b7e3d84c05391d139a62b157e78786d8c082f29dcf4c111314").into(),
+					digest: Digest { logs: vec![], },
+				},
+				extrinsics: vec![],
+			});
+		});
+	}
+
+	#[test]
+	#[should_panic]
+	fn block_import_of_bad_state_root_fails() {
+		new_test_ext(1).execute_with(|| {
+			Executive::execute_block(Block {
+				header: Header {
+					parent_hash: [69u8; 32].into(),
+					number: 1,
+					state_root: [0u8; 32].into(),
+					extrinsics_root: hex!("03170a2e7597b7b7e3d84c05391d139a62b157e78786d8c082f29dcf4c111314").into(),
+					digest: Digest { logs: vec![], },
+				},
+				extrinsics: vec![],
+			});
+		});
+	}
+
+	#[test]
+	#[should_panic]
+	fn block_import_of_bad_extrinsic_root_fails() {
+		new_test_ext(1).execute_with(|| {
+			Executive::execute_block(Block {
+				header: Header {
+					parent_hash: [69u8; 32].into(),
+					number: 1,
+					state_root: hex!("49cd58a254ccf6abc4a023d9a22dcfc421e385527a250faec69f8ad0d8ed3e48").into(),
+					extrinsics_root: [0u8; 32].into(),
+					digest: Digest { logs: vec![], },
+				},
+				extrinsics: vec![],
+			});
+		});
+	}
+
+	#[test]
+	fn bad_extrinsic_not_inserted() {
+		let mut t = new_test_ext(1);
+		// bad nonce check!
+		let xt = sr_primitives::testing::TestXt(sign_extra(1, 30, 0), Call::Balances(BalancesCall::transfer(33, 69)));
+		t.execute_with(|| {
+			Executive::initialize_block(&Header::new(
+				1,
+				H256::default(),
+				H256::default(),
+				[69u8; 32].into(),
+				Digest::default(),
+			));
+			assert!(Executive::apply_extrinsic(xt).is_err());
+			assert_eq!(<system::Module<Runtime>>::extrinsic_index(), Some(0));
+		});
+	}
+
+	#[test]
+	fn block_weight_limit_enforced() {
+		let mut t = new_test_ext(10000);
+		// given: TestXt uses the encoded len as fixed Len:
+		let xt = sr_primitives::testing::TestXt(sign_extra(1, 0, 0), Call::Balances(BalancesCall::transfer(33, 0)));
+		let encoded = xt.encode();
+		let encoded_len = encoded.len() as Weight;
+		let limit = AvailableBlockRatio::get() * MaximumBlockWeight::get() - 175;
+		let num_to_exhaust_block = limit / encoded_len;
+		t.execute_with(|| {
+			Executive::initialize_block(&Header::new(
+				1,
+				H256::default(),
+				H256::default(),
+				[69u8; 32].into(),
+				Digest::default(),
+			));
+			// Initial block weight form the custom module.
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 175);
+
+			for nonce in 0..=num_to_exhaust_block {
+				let xt = sr_primitives::testing::TestXt(
+					sign_extra(1, nonce.into(), 0), Call::Balances(BalancesCall::transfer(33, 0)),
+				);
+				let res = Executive::apply_extrinsic(xt);
+				if nonce != num_to_exhaust_block {
+					assert!(res.is_ok());
+					assert_eq!(
+						<system::Module<Runtime>>::all_extrinsics_weight(),
+						encoded_len * (nonce + 1) + 175,
+					);
+					assert_eq!(<system::Module<Runtime>>::extrinsic_index(), Some(nonce as u32 + 1));
+				} else {
+					assert_eq!(res, Err(InvalidTransaction::ExhaustsResources.into()));
+				}
+			}
+		});
+	}
+
+	#[test]
+	fn block_weight_and_size_is_stored_per_tx() {
+		let xt = sr_primitives::testing::TestXt(sign_extra(1, 0, 0), Call::Balances(BalancesCall::transfer(33, 0)));
+		let x1 = sr_primitives::testing::TestXt(sign_extra(1, 1, 0), Call::Balances(BalancesCall::transfer(33, 0)));
+		let x2 = sr_primitives::testing::TestXt(sign_extra(1, 2, 0), Call::Balances(BalancesCall::transfer(33, 0)));
+		let len = xt.clone().encode().len() as u32;
+		let mut t = new_test_ext(1);
+		t.execute_with(|| {
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 0);
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 0);
+
+			assert!(Executive::apply_extrinsic(xt.clone()).unwrap().is_ok());
+			assert!(Executive::apply_extrinsic(x1.clone()).unwrap().is_ok());
+			assert!(Executive::apply_extrinsic(x2.clone()).unwrap().is_ok());
+
+			// default weight for `TestXt` == encoded length.
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), (3 * len) as u32);
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_len(), 3 * len);
+
+			let _ = <system::Module<Runtime>>::finalize();
+
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 0);
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 0);
+		});
+	}
+
+	#[test]
+	fn validate_unsigned() {
+		let xt = sr_primitives::testing::TestXt(None, Call::Balances(BalancesCall::set_balance(33, 69, 69)));
+		let mut t = new_test_ext(1);
+
+		t.execute_with(|| {
+			assert_eq!(Executive::validate_transaction(xt.clone()), Ok(Default::default()));
+			assert_eq!(
+				Executive::apply_extrinsic(xt),
+				Ok(
+					Err(
+						DispatchError { module: Some(1), error: 0, message: Some("RequireRootOrigin") }
+					)
+				)
+			);
+		});
+	}
+
+	#[test]
+	fn can_pay_for_tx_fee_on_full_lock() {
+		let id: LockIdentifier = *b"0       ";
+		let execute_with_lock = |lock: WithdrawReasons| {
+			let mut t = new_test_ext(1);
+			t.execute_with(|| {
+				<balances::Module<Runtime> as LockableCurrency<u64>>::set_lock(
+					id,
+					&1,
+					110,
+					Bounded::max_value(),
+					lock,
+				);
+				let xt = sr_primitives::testing::TestXt(
+					sign_extra(1, 0, 0),
+					Call::System(SystemCall::remark(vec![1u8])),
+				);
+				let weight = xt.get_dispatch_info().weight as u64;
+				Executive::initialize_block(&Header::new(
+					1,
+					H256::default(),
+					H256::default(),
+					[69u8; 32].into(),
+					Digest::default(),
+				));
+
+				if lock == WithdrawReasons::except(WithdrawReason::TransactionPayment) {
+					assert!(Executive::apply_extrinsic(xt).unwrap().is_ok());
+					// tx fee has been deducted.
+					assert_eq!(<balances::Module<Runtime>>::total_balance(&1), 111 - 10 - weight);
+				} else {
+					assert_eq!(
+						Executive::apply_extrinsic(xt),
+						Err(InvalidTransaction::Payment.into()),
+					);
+					assert_eq!(<balances::Module<Runtime>>::total_balance(&1), 111);
+				}
+			});
+		};
+
+		execute_with_lock(WithdrawReasons::all());
+		execute_with_lock(WithdrawReasons::except(WithdrawReason::TransactionPayment));
+	}
+
+	#[test]
+	fn block_hooks_weight_is_stored() {
+		new_test_ext(1).execute_with(|| {
+
+			Executive::initialize_block(&Header::new_from_number(1));
+			// NOTE: might need updates over time if system and balance introduce new weights. For
+			// now only accounts for the custom module.
+			assert_eq!(<system::Module<Runtime>>::all_extrinsics_weight(), 150 + 25);
+		})
+	}
+}

substrate/frame/finality-tracker/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "pallet-finality-tracker"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", default-features = false, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false }
+inherents = { package = "substrate-inherents", path = "../../primitives/inherents", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sp-finality-tracker = { path = "../../primitives/finality-tracker", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+frame-system = { path = "../system", default-features = false }
+impl-trait-for-tuples = "0.1.3"
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"serde/std",
+	"codec/std",
+	"rstd/std",
+	"support/std",
+	"sr-primitives/std",
+	"frame-system/std",
+	"sp-finality-tracker/std",
+	"inherents/std",
+]

substrate/frame/finality-tracker/src/lib.rs

@@ -0,0 +1,315 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! SRML module that tracks the last finalized block, as perceived by block authors.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use inherents::{InherentIdentifier, ProvideInherent, InherentData, MakeFatalError};
+use sr_primitives::traits::{One, Zero, SaturatedConversion};
+use rstd::{prelude::*, result, cmp, vec};
+use support::{decl_module, decl_storage};
+use support::traits::Get;
+use frame_system::{ensure_none, Trait as SystemTrait};
+use sp_finality_tracker::{INHERENT_IDENTIFIER, FinalizedInherentData};
+
+pub const DEFAULT_WINDOW_SIZE: u32 = 101;
+pub const DEFAULT_REPORT_LATENCY: u32 = 1000;
+
+pub trait Trait: SystemTrait {
+	/// Something which can be notified when the timestamp is set. Set this to `()`
+	/// if not needed.
+	type OnFinalizationStalled: OnFinalizationStalled<Self::BlockNumber>;
+	/// The number of recent samples to keep from this chain. Default is 101.
+	type WindowSize: Get<Self::BlockNumber>;
+	/// The delay after which point things become suspicious. Default is 1000.
+	type ReportLatency: Get<Self::BlockNumber>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Timestamp {
+		/// Recent hints.
+		RecentHints get(fn recent_hints) build(|_| vec![T::BlockNumber::zero()]): Vec<T::BlockNumber>;
+		/// Ordered recent hints.
+		OrderedHints get(fn ordered_hints) build(|_| vec![T::BlockNumber::zero()]): Vec<T::BlockNumber>;
+		/// The median.
+		Median get(fn median) build(|_| T::BlockNumber::zero()): T::BlockNumber;
+
+		/// Final hint to apply in the block. `None` means "same as parent".
+		Update: Option<T::BlockNumber>;
+
+		// when initialized through config this is set in the beginning.
+		Initialized get(fn initialized) build(|_| false): bool;
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		/// The number of recent samples to keep from this chain. Default is 101.
+		const WindowSize: T::BlockNumber = T::WindowSize::get();
+
+		/// The delay after which point things become suspicious. Default is 1000.
+		const ReportLatency: T::BlockNumber = T::ReportLatency::get();
+
+		/// Hint that the author of this block thinks the best finalized
+		/// block is the given number.
+		fn final_hint(origin, #[compact] hint: T::BlockNumber) {
+			ensure_none(origin)?;
+			assert!(!<Self as Store>::Update::exists(), "Final hint must be updated only once in the block");
+			assert!(
+				frame_system::Module::<T>::block_number() >= hint,
+				"Finalized height above block number",
+			);
+			<Self as Store>::Update::put(hint);
+		}
+
+		fn on_finalize() {
+			Self::update_hint(<Self as Store>::Update::take())
+		}
+	}
+}
+
+impl<T: Trait> Module<T> {
+	fn update_hint(hint: Option<T::BlockNumber>) {
+		if !Self::initialized() {
+			<Self as Store>::RecentHints::put(vec![T::BlockNumber::zero()]);
+			<Self as Store>::OrderedHints::put(vec![T::BlockNumber::zero()]);
+			<Self as Store>::Median::put(T::BlockNumber::zero());
+
+			<Self as Store>::Initialized::put(true);
+		}
+
+		let mut recent = Self::recent_hints();
+		let mut ordered = Self::ordered_hints();
+		let window_size = cmp::max(T::BlockNumber::one(), T::WindowSize::get());
+
+		let hint = hint.unwrap_or_else(|| recent.last()
+			.expect("always at least one recent sample; qed").clone()
+		);
+
+		// prune off the front of the list -- typically 1 except for when
+		// the sample size has just been shrunk.
+		{
+			// take into account the item we haven't pushed yet.
+			let to_prune = (recent.len() + 1).saturating_sub(window_size.saturated_into::<usize>());
+
+			for drained in recent.drain(..to_prune) {
+				let idx = ordered.binary_search(&drained)
+					.expect("recent and ordered contain the same items; qed");
+
+				ordered.remove(idx);
+			}
+		}
+
+		// find the position in the ordered list where the new item goes.
+		let ordered_idx = ordered.binary_search(&hint)
+			.unwrap_or_else(|idx| idx);
+
+		ordered.insert(ordered_idx, hint);
+		recent.push(hint);
+
+		let two = T::BlockNumber::one() + T::BlockNumber::one();
+
+		let median = {
+			let len = ordered.len();
+			assert!(len > 0, "pruning dictated by window_size which is always saturated at 1; qed");
+
+			if len % 2 == 0 {
+				let a = ordered[len / 2];
+				let b = ordered[(len / 2) - 1];
+
+				// compute average.
+				(a + b) / two
+			} else {
+				ordered[len / 2]
+			}
+		};
+
+		let our_window_size = recent.len() as u32;
+
+		<Self as Store>::RecentHints::put(recent);
+		<Self as Store>::OrderedHints::put(ordered);
+		<Self as Store>::Median::put(median);
+
+		if T::BlockNumber::from(our_window_size) == window_size {
+			let now = frame_system::Module::<T>::block_number();
+			let latency = T::ReportLatency::get();
+
+			// the delay is the latency plus half the window size.
+			let delay = latency + (window_size / two);
+			// median may be at most n - delay
+			if median + delay <= now {
+				T::OnFinalizationStalled::on_stalled(window_size - T::BlockNumber::one(), median);
+			}
+		}
+	}
+}
+
+/// Called when finalization stalled at a given number.
+#[impl_trait_for_tuples::impl_for_tuples(30)]
+pub trait OnFinalizationStalled<N> {
+	/// The parameter here is how many more blocks to wait before applying
+	/// changes triggered by finality stalling.
+	fn on_stalled(further_wait: N, median: N);
+}
+
+impl<T: Trait> ProvideInherent for Module<T> {
+	type Call = Call<T>;
+	type Error = MakeFatalError<()>;
+	const INHERENT_IDENTIFIER: InherentIdentifier = INHERENT_IDENTIFIER;
+
+	fn create_inherent(data: &InherentData) -> Option<Self::Call> {
+		if let Ok(final_num) = data.finalized_number() {
+			// make hint only when not same as last to avoid bloat.
+			Self::recent_hints().last().and_then(|last| if last == &final_num {
+				None
+			} else {
+				Some(Call::final_hint(final_num))
+			})
+		} else {
+			None
+		}
+	}
+
+	fn check_inherent(_call: &Self::Call, _data: &InherentData) -> result::Result<(), Self::Error> {
+		Ok(())
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	use runtime_io::TestExternalities;
+	use primitives::H256;
+	use sr_primitives::{
+		testing::Header, Perbill,
+		traits::{BlakeTwo256, IdentityLookup, OnFinalize, Header as HeaderT},
+	};
+	use support::{assert_ok, impl_outer_origin, parameter_types};
+	use frame_system as system;
+	use std::cell::RefCell;
+
+	#[derive(Clone, PartialEq, Debug)]
+	pub struct StallEvent {
+		at: u64,
+		further_wait: u64,
+	}
+
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	thread_local! {
+		static NOTIFICATIONS: RefCell<Vec<StallEvent>> = Default::default();
+	}
+
+	pub struct StallTracker;
+	impl OnFinalizationStalled<u64> for StallTracker {
+		fn on_stalled(further_wait: u64, _median: u64) {
+			let now = System::block_number();
+			NOTIFICATIONS.with(|v| v.borrow_mut().push(StallEvent { at: now, further_wait }));
+		}
+	}
+
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Call = ();
+		type Hash = H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<u64>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+	parameter_types! {
+		pub const WindowSize: u64 = 11;
+		pub const ReportLatency: u64 = 100;
+	}
+	impl Trait for Test {
+		type OnFinalizationStalled = StallTracker;
+		type WindowSize = WindowSize;
+		type ReportLatency = ReportLatency;
+	}
+
+	type System = system::Module<Test>;
+	type FinalityTracker = Module<Test>;
+
+	#[test]
+	fn median_works() {
+		let t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		TestExternalities::new(t).execute_with(|| {
+			FinalityTracker::update_hint(Some(500));
+			assert_eq!(FinalityTracker::median(), 250);
+			assert!(NOTIFICATIONS.with(|n| n.borrow().is_empty()));
+		});
+	}
+
+	#[test]
+	fn notifies_when_stalled() {
+		let t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		TestExternalities::new(t).execute_with(|| {
+			let mut parent_hash = System::parent_hash();
+			for i in 2..106 {
+				System::initialize(&i, &parent_hash, &Default::default(), &Default::default());
+				FinalityTracker::on_finalize(i);
+				let hdr = System::finalize();
+				parent_hash = hdr.hash();
+			}
+
+			assert_eq!(
+				NOTIFICATIONS.with(|n| n.borrow().clone()),
+				vec![StallEvent { at: 105, further_wait: 10 }]
+			)
+		});
+	}
+
+	#[test]
+	fn recent_notifications_prevent_stalling() {
+		let t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		TestExternalities::new(t).execute_with(|| {
+			let mut parent_hash = System::parent_hash();
+			for i in 2..106 {
+				System::initialize(&i, &parent_hash, &Default::default(), &Default::default());
+				assert_ok!(FinalityTracker::dispatch(
+					Call::final_hint(i-1),
+					Origin::NONE,
+				));
+				FinalityTracker::on_finalize(i);
+				let hdr = System::finalize();
+				parent_hash = hdr.hash();
+			}
+
+			assert!(NOTIFICATIONS.with(|n| n.borrow().is_empty()));
+		});
+	}
+}

substrate/frame/generic-asset/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "pallet-generic-asset"
+version = "2.0.0"
+authors = ["Centrality Developers <support@centrality.ai>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io" }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+
+[features]
+default = ["std"]
+std =[
+    "serde/std",
+    "codec/std",
+    "rstd/std",
+    "sr-primitives/std",
+    "support/std",
+    "system/std",
+]

substrate/frame/generic-asset/src/mock.rs

@@ -0,0 +1,144 @@
+// Copyright 2019
+//     by  Centrality Investments Ltd.
+//     and Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Mocks for the module.
+
+#![cfg(test)]
+
+use sr_primitives::{
+	Perbill,
+	testing::Header,
+	traits::{BlakeTwo256, IdentityLookup},
+};
+use primitives::H256;
+use support::{parameter_types, impl_outer_event, impl_outer_origin};
+
+use super::*;
+
+impl_outer_origin! {
+	pub enum Origin for Test {}
+}
+
+// For testing the module, we construct most of a mock runtime. This means
+// first constructing a configuration type (`Test`) which `impl`s each of the
+// configuration traits of modules we want to use.
+#[derive(Clone, Eq, PartialEq)]
+pub struct Test;
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<u64>;
+	type Header = Header;
+	type Event = TestEvent;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type BlockHashCount = BlockHashCount;
+	type Version = ();
+}
+
+impl Trait for Test {
+	type Balance = u64;
+	type AssetId = u32;
+	type Event = TestEvent;
+}
+
+mod generic_asset {
+	pub use crate::Event;
+}
+
+impl_outer_event! {
+	pub enum TestEvent for Test {
+		generic_asset<T>,
+	}
+}
+
+pub type GenericAsset = Module<Test>;
+
+pub type System = system::Module<Test>;
+
+pub struct ExtBuilder {
+	asset_id: u32,
+	next_asset_id: u32,
+	accounts: Vec<u64>,
+	initial_balance: u64,
+}
+
+// Returns default values for genesis config
+impl Default for ExtBuilder {
+	fn default() -> Self {
+		Self {
+			asset_id: 0,
+			next_asset_id: 1000,
+			accounts: vec![0],
+			initial_balance: 0,
+		}
+	}
+}
+
+impl ExtBuilder {
+	// Sets free balance to genesis config
+	pub fn free_balance(mut self, free_balance: (u32, u64, u64)) -> Self {
+		self.asset_id = free_balance.0;
+		self.accounts = vec![free_balance.1];
+		self.initial_balance = free_balance.2;
+		self
+	}
+
+	pub fn next_asset_id(mut self, asset_id: u32) -> Self {
+		self.next_asset_id = asset_id;
+		self
+	}
+
+	// builds genesis config
+	pub fn build(self) -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+
+		GenesisConfig::<Test> {
+				assets: vec![self.asset_id],
+				endowed_accounts: self.accounts,
+				initial_balance: self.initial_balance,
+				next_asset_id: self.next_asset_id,
+				staking_asset_id: 16000,
+				spending_asset_id: 16001,
+			}
+			.assimilate_storage(&mut t).unwrap();
+
+		t.into()
+	}
+}
+
+// This function basically just builds a genesis storage key/value store according to
+// our desired mockup.
+pub fn new_test_ext() -> runtime_io::TestExternalities {
+	system::GenesisConfig::default()
+		.build_storage::<Test>()
+		.unwrap()
+		.into()
+}

substrate/frame/grandpa/Cargo.toml

@@ -0,0 +1,38 @@
+[package]
+name = "pallet-grandpa"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+substrate-finality-grandpa-primitives = { path = "../../primitives/finality-grandpa", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+session = { package = "pallet-session", path = "../session", default-features = false }
+finality-tracker = { package = "pallet-finality-tracker", path = "../finality-tracker", default-features = false }
+
+[dev-dependencies]
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"primitives/std",
+	"substrate-finality-grandpa-primitives/std",
+	"rstd/std",
+	"support/std",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"system/std",
+	"session/std",
+	"finality-tracker/std",
+]
+migrate-authorities = []

substrate/frame/grandpa/src/lib.rs

@@ -0,0 +1,510 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! GRANDPA Consensus module for runtime.
+//!
+//! This manages the GRANDPA authority set ready for the native code.
+//! These authorities are only for GRANDPA finality, not for consensus overall.
+//!
+//! In the future, it will also handle misbehavior reports, and on-chain
+//! finality notifications.
+//!
+//! For full integration with GRANDPA, the `GrandpaApi` should be implemented.
+//! The necessary items are re-exported via the `fg_primitives` crate.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+// re-export since this is necessary for `impl_apis` in runtime.
+pub use substrate_finality_grandpa_primitives as fg_primitives;
+
+use rstd::prelude::*;
+use codec::{self as codec, Encode, Decode, Error};
+use support::{decl_event, decl_storage, decl_module, dispatch::Result, storage};
+use sr_primitives::{
+	generic::{DigestItem, OpaqueDigestItemId}, traits::Zero, Perbill,
+};
+use sr_staking_primitives::{
+	SessionIndex,
+	offence::{Offence, Kind},
+};
+use fg_primitives::{
+	GRANDPA_AUTHORITIES_KEY, GRANDPA_ENGINE_ID, ScheduledChange, ConsensusLog, SetId, RoundNumber,
+};
+pub use fg_primitives::{AuthorityId, AuthorityList, AuthorityWeight, VersionedAuthorityList};
+use system::{ensure_signed, DigestOf};
+
+mod mock;
+mod tests;
+
+pub trait Trait: system::Trait {
+	/// The event type of this module.
+	type Event: From<Event> + Into<<Self as system::Trait>::Event>;
+}
+
+/// A stored pending change, old format.
+// TODO: remove shim
+// https://github.com/paritytech/substrate/issues/1614
+#[derive(Encode, Decode)]
+pub struct OldStoredPendingChange<N> {
+	/// The block number this was scheduled at.
+	pub scheduled_at: N,
+	/// The delay in blocks until it will be applied.
+	pub delay: N,
+	/// The next authority set.
+	pub next_authorities: AuthorityList,
+}
+
+/// A stored pending change.
+#[derive(Encode)]
+pub struct StoredPendingChange<N> {
+	/// The block number this was scheduled at.
+	pub scheduled_at: N,
+	/// The delay in blocks until it will be applied.
+	pub delay: N,
+	/// The next authority set.
+	pub next_authorities: AuthorityList,
+	/// If defined it means the change was forced and the given block number
+	/// indicates the median last finalized block when the change was signaled.
+	pub forced: Option<N>,
+}
+
+impl<N: Decode> Decode for StoredPendingChange<N> {
+	fn decode<I: codec::Input>(value: &mut I) -> core::result::Result<Self, Error> {
+		let old = OldStoredPendingChange::decode(value)?;
+		let forced = <Option<N>>::decode(value).unwrap_or(None);
+
+		Ok(StoredPendingChange {
+			scheduled_at: old.scheduled_at,
+			delay: old.delay,
+			next_authorities: old.next_authorities,
+			forced,
+		})
+	}
+}
+
+/// Current state of the GRANDPA authority set. State transitions must happen in
+/// the same order of states defined below, e.g. `Paused` implies a prior
+/// `PendingPause`.
+#[derive(Decode, Encode)]
+#[cfg_attr(test, derive(Debug, PartialEq))]
+pub enum StoredState<N> {
+	/// The current authority set is live, and GRANDPA is enabled.
+	Live,
+	/// There is a pending pause event which will be enacted at the given block
+	/// height.
+	PendingPause {
+		/// Block at which the intention to pause was scheduled.
+		scheduled_at: N,
+		/// Number of blocks after which the change will be enacted.
+		delay: N
+	},
+	/// The current GRANDPA authority set is paused.
+	Paused,
+	/// There is a pending resume event which will be enacted at the given block
+	/// height.
+	PendingResume {
+		/// Block at which the intention to resume was scheduled.
+		scheduled_at: N,
+		/// Number of blocks after which the change will be enacted.
+		delay: N,
+	},
+}
+
+decl_event!(
+	pub enum Event {
+		/// New authority set has been applied.
+		NewAuthorities(AuthorityList),
+		/// Current authority set has been paused.
+		Paused,
+		/// Current authority set has been resumed.
+		Resumed,
+	}
+);
+
+decl_storage! {
+	trait Store for Module<T: Trait> as GrandpaFinality {
+		/// DEPRECATED
+		///
+		/// This used to store the current authority set, which has been migrated to the well-known
+		/// GRANDPA_AUTHORITES_KEY unhashed key.
+		#[cfg(feature = "migrate-authorities")]
+		pub(crate) Authorities get(fn authorities): AuthorityList;
+
+		/// State of the current authority set.
+		State get(fn state): StoredState<T::BlockNumber> = StoredState::Live;
+
+		/// Pending change: (signaled at, scheduled change).
+		PendingChange: Option<StoredPendingChange<T::BlockNumber>>;
+
+		/// next block number where we can force a change.
+		NextForced get(fn next_forced): Option<T::BlockNumber>;
+
+		/// `true` if we are currently stalled.
+		Stalled get(fn stalled): Option<(T::BlockNumber, T::BlockNumber)>;
+
+		/// The number of changes (both in terms of keys and underlying economic responsibilities)
+		/// in the "set" of Grandpa validators from genesis.
+		CurrentSetId get(fn current_set_id) build(|_| fg_primitives::SetId::default()): SetId;
+
+		/// A mapping from grandpa set ID to the index of the *most recent* session for which its members were responsible.
+		SetIdSession get(fn session_for_set): map SetId => Option<SessionIndex>;
+	}
+	add_extra_genesis {
+		config(authorities): AuthorityList;
+		build(|config| Module::<T>::initialize_authorities(&config.authorities))
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+
+		/// Report some misbehavior.
+		fn report_misbehavior(origin, _report: Vec<u8>) {
+			ensure_signed(origin)?;
+			// FIXME: https://github.com/paritytech/substrate/issues/1112
+		}
+
+		fn on_initialize() {
+			#[cfg(feature = "migrate-authorities")]
+			Self::migrate_authorities();
+		}
+
+		fn on_finalize(block_number: T::BlockNumber) {
+			// check for scheduled pending authority set changes
+			if let Some(pending_change) = <PendingChange<T>>::get() {
+				// emit signal if we're at the block that scheduled the change
+				if block_number == pending_change.scheduled_at {
+					if let Some(median) = pending_change.forced {
+						Self::deposit_log(ConsensusLog::ForcedChange(
+							median,
+							ScheduledChange {
+								delay: pending_change.delay,
+								next_authorities: pending_change.next_authorities.clone(),
+							}
+						))
+					} else {
+						Self::deposit_log(ConsensusLog::ScheduledChange(
+							ScheduledChange{
+								delay: pending_change.delay,
+								next_authorities: pending_change.next_authorities.clone(),
+							}
+						));
+					}
+				}
+
+				// enact the change if we've reached the enacting block
+				if block_number == pending_change.scheduled_at + pending_change.delay {
+					Self::set_grandpa_authorities(&pending_change.next_authorities);
+					Self::deposit_event(
+						Event::NewAuthorities(pending_change.next_authorities)
+					);
+					<PendingChange<T>>::kill();
+				}
+			}
+
+			// check for scheduled pending state changes
+			match <State<T>>::get() {
+				StoredState::PendingPause { scheduled_at, delay } => {
+					// signal change to pause
+					if block_number == scheduled_at {
+						Self::deposit_log(ConsensusLog::Pause(delay));
+					}
+
+					// enact change to paused state
+					if block_number == scheduled_at + delay {
+						<State<T>>::put(StoredState::Paused);
+						Self::deposit_event(Event::Paused);
+					}
+				},
+				StoredState::PendingResume { scheduled_at, delay } => {
+					// signal change to resume
+					if block_number == scheduled_at {
+						Self::deposit_log(ConsensusLog::Resume(delay));
+					}
+
+					// enact change to live state
+					if block_number == scheduled_at + delay {
+						<State<T>>::put(StoredState::Live);
+						Self::deposit_event(Event::Resumed);
+					}
+				},
+				_ => {},
+			}
+		}
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Get the current set of authorities, along with their respective weights.
+	pub fn grandpa_authorities() -> AuthorityList {
+		storage::unhashed::get_or_default::<VersionedAuthorityList>(GRANDPA_AUTHORITIES_KEY).into()
+	}
+
+	/// Set the current set of authorities, along with their respective weights.
+	fn set_grandpa_authorities(authorities: &AuthorityList) {
+		storage::unhashed::put(
+			GRANDPA_AUTHORITIES_KEY,
+			&VersionedAuthorityList::from(authorities),
+		);
+	}
+
+	/// Schedule GRANDPA to pause starting in the given number of blocks.
+	/// Cannot be done when already paused.
+	pub fn schedule_pause(in_blocks: T::BlockNumber) -> Result {
+		if let StoredState::Live = <State<T>>::get() {
+			let scheduled_at = <system::Module<T>>::block_number();
+			<State<T>>::put(StoredState::PendingPause {
+				delay: in_blocks,
+				scheduled_at,
+			});
+
+			Ok(())
+		} else {
+			Err("Attempt to signal GRANDPA pause when the authority set isn't live \
+				(either paused or already pending pause).")
+		}
+	}
+
+	/// Schedule a resume of GRANDPA after pausing.
+	pub fn schedule_resume(in_blocks: T::BlockNumber) -> Result {
+		if let StoredState::Paused = <State<T>>::get() {
+			let scheduled_at = <system::Module<T>>::block_number();
+			<State<T>>::put(StoredState::PendingResume {
+				delay: in_blocks,
+				scheduled_at,
+			});
+
+			Ok(())
+		} else {
+			Err("Attempt to signal GRANDPA resume when the authority set isn't paused \
+				(either live or already pending resume).")
+		}
+	}
+
+	/// Schedule a change in the authorities.
+	///
+	/// The change will be applied at the end of execution of the block
+	/// `in_blocks` after the current block. This value may be 0, in which
+	/// case the change is applied at the end of the current block.
+	///
+	/// If the `forced` parameter is defined, this indicates that the current
+	/// set has been synchronously determined to be offline and that after
+	/// `in_blocks` the given change should be applied. The given block number
+	/// indicates the median last finalized block number and it should be used
+	/// as the canon block when starting the new grandpa voter.
+	///
+	/// No change should be signaled while any change is pending. Returns
+	/// an error if a change is already pending.
+	pub fn schedule_change(
+		next_authorities: AuthorityList,
+		in_blocks: T::BlockNumber,
+		forced: Option<T::BlockNumber>,
+	) -> Result {
+		if !<PendingChange<T>>::exists() {
+			let scheduled_at = <system::Module<T>>::block_number();
+
+			if let Some(_) = forced {
+				if Self::next_forced().map_or(false, |next| next > scheduled_at) {
+					return Err("Cannot signal forced change so soon after last.");
+				}
+
+				// only allow the next forced change when twice the window has passed since
+				// this one.
+				<NextForced<T>>::put(scheduled_at + in_blocks * 2.into());
+			}
+
+			<PendingChange<T>>::put(StoredPendingChange {
+				delay: in_blocks,
+				scheduled_at,
+				next_authorities,
+				forced,
+			});
+
+			Ok(())
+		} else {
+			Err("Attempt to signal GRANDPA change with one already pending.")
+		}
+	}
+
+	/// Deposit one of this module's logs.
+	fn deposit_log(log: ConsensusLog<T::BlockNumber>) {
+		let log: DigestItem<T::Hash> = DigestItem::Consensus(GRANDPA_ENGINE_ID, log.encode());
+		<system::Module<T>>::deposit_log(log.into());
+	}
+
+	fn initialize_authorities(authorities: &AuthorityList) {
+		if !authorities.is_empty() {
+			assert!(
+				Self::grandpa_authorities().is_empty(),
+				"Authorities are already initialized!"
+			);
+			Self::set_grandpa_authorities(authorities);
+		}
+	}
+
+	#[cfg(feature = "migrate-authorities")]
+	fn migrate_authorities() {
+		if Authorities::exists() {
+			Self::set_grandpa_authorities(&Authorities::take());
+		}
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Attempt to extract a GRANDPA log from a generic digest.
+	pub fn grandpa_log(digest: &DigestOf<T>) -> Option<ConsensusLog<T::BlockNumber>> {
+		let id = OpaqueDigestItemId::Consensus(&GRANDPA_ENGINE_ID);
+		digest.convert_first(|l| l.try_to::<ConsensusLog<T::BlockNumber>>(id))
+	}
+
+	/// Attempt to extract a pending set-change signal from a digest.
+	pub fn pending_change(digest: &DigestOf<T>)
+		-> Option<ScheduledChange<T::BlockNumber>>
+	{
+		Self::grandpa_log(digest).and_then(|signal| signal.try_into_change())
+	}
+
+	/// Attempt to extract a forced set-change signal from a digest.
+	pub fn forced_change(digest: &DigestOf<T>)
+		-> Option<(T::BlockNumber, ScheduledChange<T::BlockNumber>)>
+	{
+		Self::grandpa_log(digest).and_then(|signal| signal.try_into_forced_change())
+	}
+
+	/// Attempt to extract a pause signal from a digest.
+	pub fn pending_pause(digest: &DigestOf<T>)
+		-> Option<T::BlockNumber>
+	{
+		Self::grandpa_log(digest).and_then(|signal| signal.try_into_pause())
+	}
+
+	/// Attempt to extract a resume signal from a digest.
+	pub fn pending_resume(digest: &DigestOf<T>)
+		-> Option<T::BlockNumber>
+	{
+		Self::grandpa_log(digest).and_then(|signal| signal.try_into_resume())
+	}
+}
+
+impl<T: Trait> sr_primitives::BoundToRuntimeAppPublic for Module<T> {
+	type Public = AuthorityId;
+}
+
+impl<T: Trait> session::OneSessionHandler<T::AccountId> for Module<T>
+	where T: session::Trait
+{
+	type Key = AuthorityId;
+
+	fn on_genesis_session<'a, I: 'a>(validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, AuthorityId)>
+	{
+		let authorities = validators.map(|(_, k)| (k, 1)).collect::<Vec<_>>();
+		Self::initialize_authorities(&authorities);
+	}
+
+	fn on_new_session<'a, I: 'a>(changed: bool, validators: I, _queued_validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, AuthorityId)>
+	{
+		// Always issue a change if `session` says that the validators have changed.
+		// Even if their session keys are the same as before, the underyling economic
+		// identities have changed.
+		let current_set_id = if changed {
+			let next_authorities = validators.map(|(_, k)| (k, 1)).collect::<Vec<_>>();
+			if let Some((further_wait, median)) = <Stalled<T>>::take() {
+				let _ = Self::schedule_change(next_authorities, further_wait, Some(median));
+			} else {
+				let _ = Self::schedule_change(next_authorities, Zero::zero(), None);
+			}
+			CurrentSetId::mutate(|s| { *s += 1; *s })
+		} else {
+			// nothing's changed, neither economic conditions nor session keys. update the pointer
+			// of the current set.
+			Self::current_set_id()
+		};
+
+		// if we didn't issue a change, we update the mapping to note that the current
+		// set corresponds to the latest equivalent session (i.e. now).
+		let session_index = <session::Module<T>>::current_index();
+		SetIdSession::insert(current_set_id, &session_index);
+	}
+
+	fn on_disabled(i: usize) {
+		Self::deposit_log(ConsensusLog::OnDisabled(i as u64))
+	}
+}
+
+impl<T: Trait> finality_tracker::OnFinalizationStalled<T::BlockNumber> for Module<T> {
+	fn on_stalled(further_wait: T::BlockNumber, median: T::BlockNumber) {
+		// when we record old authority sets, we can use `finality_tracker::median`
+		// to figure out _who_ failed. until then, we can't meaningfully guard
+		// against `next == last` the way that normal session changes do.
+		<Stalled<T>>::put((further_wait, median));
+	}
+}
+
+/// A round number and set id which point on the time of an offence.
+#[derive(Copy, Clone, PartialOrd, Ord, Eq, PartialEq, Encode, Decode)]
+struct GrandpaTimeSlot {
+	// The order of these matters for `derive(Ord)`.
+	set_id: SetId,
+	round: RoundNumber,
+}
+
+// TODO [slashing]: Integrate this.
+/// A grandpa equivocation offence report.
+#[allow(dead_code)]
+struct GrandpaEquivocationOffence<FullIdentification> {
+	/// Time slot at which this incident happened.
+	time_slot: GrandpaTimeSlot,
+	/// The session index in which the incident happened.
+	session_index: SessionIndex,
+	/// The size of the validator set at the time of the offence.
+	validator_set_count: u32,
+	/// The authority which produced this equivocation.
+	offender: FullIdentification,
+}
+
+impl<FullIdentification: Clone> Offence<FullIdentification> for GrandpaEquivocationOffence<FullIdentification> {
+	const ID: Kind = *b"grandpa:equivoca";
+	type TimeSlot = GrandpaTimeSlot;
+
+	fn offenders(&self) -> Vec<FullIdentification> {
+		vec![self.offender.clone()]
+	}
+
+	fn session_index(&self) -> SessionIndex {
+		self.session_index
+	}
+
+	fn validator_set_count(&self) -> u32 {
+		self.validator_set_count
+	}
+
+	fn time_slot(&self) -> Self::TimeSlot {
+		self.time_slot
+	}
+
+	fn slash_fraction(
+		offenders_count: u32,
+		validator_set_count: u32,
+	) -> Perbill {
+		// the formula is min((3k / n)^2, 1)
+		let x = Perbill::from_rational_approximation(3 * offenders_count, validator_set_count);
+		// _ ^ 2
+		x.square()
+	}
+}

substrate/frame/grandpa/src/mock.rs

@@ -0,0 +1,93 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+#![cfg(test)]
+
+use sr_primitives::{Perbill, DigestItem, traits::IdentityLookup, testing::{Header, UintAuthorityId}};
+use runtime_io;
+use support::{impl_outer_origin, impl_outer_event, parameter_types};
+use primitives::H256;
+use codec::{Encode, Decode};
+use crate::{AuthorityId, AuthorityList, GenesisConfig, Trait, Module, ConsensusLog};
+use substrate_finality_grandpa_primitives::GRANDPA_ENGINE_ID;
+
+impl_outer_origin!{
+	pub enum Origin for Test {}
+}
+
+pub fn grandpa_log(log: ConsensusLog<u64>) -> DigestItem<H256> {
+	DigestItem::Consensus(GRANDPA_ENGINE_ID, log.encode())
+}
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug, Decode, Encode)]
+pub struct Test;
+
+impl Trait for Test {
+	type Event = TestEvent;
+}
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = sr_primitives::traits::BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = TestEvent;
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+
+mod grandpa {
+	pub use crate::Event;
+}
+
+impl_outer_event!{
+	pub enum TestEvent for Test {
+		grandpa,
+	}
+}
+
+pub fn to_authorities(vec: Vec<(u64, u64)>) -> AuthorityList {
+	vec.into_iter()
+		.map(|(id, weight)| (UintAuthorityId(id).to_public_key::<AuthorityId>(), weight))
+		.collect()
+}
+
+pub fn new_test_ext(authorities: Vec<(u64, u64)>) -> runtime_io::TestExternalities {
+	let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+	GenesisConfig {
+		authorities: to_authorities(authorities),
+	}.assimilate_storage::<Test>(&mut t).unwrap();
+	t.into()
+}
+
+pub type System = system::Module<Test>;
+pub type Grandpa = Module<Test>;

substrate/frame/grandpa/src/tests.rs

@@ -0,0 +1,328 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the module.
+
+#![cfg(test)]
+
+use sr_primitives::{testing::Digest, traits::{Header, OnFinalize}};
+use crate::mock::*;
+use system::{EventRecord, Phase};
+use codec::{Decode, Encode};
+use fg_primitives::ScheduledChange;
+use super::*;
+
+#[test]
+fn authorities_change_logged() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_change(to_authorities(vec![(4, 1), (5, 1), (6, 1)]), 0, None).unwrap();
+
+		System::note_finished_extrinsics();
+		Grandpa::on_finalize(1);
+
+		let header = System::finalize();
+		assert_eq!(header.digest, Digest {
+			logs: vec![
+				grandpa_log(ConsensusLog::ScheduledChange(
+					ScheduledChange { delay: 0, next_authorities: to_authorities(vec![(4, 1), (5, 1), (6, 1)]) }
+				)),
+			],
+		});
+
+		assert_eq!(System::events(), vec![
+			EventRecord {
+				phase: Phase::Finalization,
+				event: Event::NewAuthorities(to_authorities(vec![(4, 1), (5, 1), (6, 1)])).into(),
+				topics: vec![],
+			},
+		]);
+	});
+}
+
+#[test]
+fn authorities_change_logged_after_delay() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_change(to_authorities(vec![(4, 1), (5, 1), (6, 1)]), 1, None).unwrap();
+		Grandpa::on_finalize(1);
+		let header = System::finalize();
+		assert_eq!(header.digest, Digest {
+			logs: vec![
+				grandpa_log(ConsensusLog::ScheduledChange(
+					ScheduledChange { delay: 1, next_authorities: to_authorities(vec![(4, 1), (5, 1), (6, 1)]) }
+				)),
+			],
+		});
+
+		// no change at this height.
+		assert_eq!(System::events(), vec![]);
+
+		System::initialize(&2, &header.hash(), &Default::default(), &Default::default());
+		System::note_finished_extrinsics();
+		Grandpa::on_finalize(2);
+
+		let _header = System::finalize();
+		assert_eq!(System::events(), vec![
+			EventRecord {
+				phase: Phase::Finalization,
+				event: Event::NewAuthorities(to_authorities(vec![(4, 1), (5, 1), (6, 1)])).into(),
+				topics: vec![],
+			},
+		]);
+	});
+}
+
+#[test]
+fn cannot_schedule_change_when_one_pending() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_change(to_authorities(vec![(4, 1), (5, 1), (6, 1)]), 1, None).unwrap();
+		assert!(<PendingChange<Test>>::exists());
+		assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_err());
+
+		Grandpa::on_finalize(1);
+		let header = System::finalize();
+
+		System::initialize(&2, &header.hash(), &Default::default(), &Default::default());
+		assert!(<PendingChange<Test>>::exists());
+		assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_err());
+
+		Grandpa::on_finalize(2);
+		let header = System::finalize();
+
+		System::initialize(&3, &header.hash(), &Default::default(), &Default::default());
+		assert!(!<PendingChange<Test>>::exists());
+		assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_ok());
+
+		Grandpa::on_finalize(3);
+		let _header = System::finalize();
+	});
+}
+
+#[test]
+fn new_decodes_from_old() {
+	let old = OldStoredPendingChange {
+		scheduled_at: 5u32,
+		delay: 100u32,
+		next_authorities: to_authorities(vec![(1, 5), (2, 10), (3, 2)]),
+	};
+
+	let encoded = old.encode();
+	let new = StoredPendingChange::<u32>::decode(&mut &encoded[..]).unwrap();
+	assert!(new.forced.is_none());
+	assert_eq!(new.scheduled_at, old.scheduled_at);
+	assert_eq!(new.delay, old.delay);
+	assert_eq!(new.next_authorities, old.next_authorities);
+}
+
+#[test]
+fn dispatch_forced_change() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_change(
+			to_authorities(vec![(4, 1), (5, 1), (6, 1)]),
+			5,
+			Some(0),
+		).unwrap();
+
+		assert!(<PendingChange<Test>>::exists());
+		assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, Some(0)).is_err());
+
+		Grandpa::on_finalize(1);
+		let mut header = System::finalize();
+
+		for i in 2..7 {
+			System::initialize(&i, &header.hash(), &Default::default(), &Default::default());
+			assert!(<PendingChange<Test>>::get().unwrap().forced.is_some());
+			assert_eq!(Grandpa::next_forced(), Some(11));
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_err());
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, Some(0)).is_err());
+
+			Grandpa::on_finalize(i);
+			header = System::finalize();
+		}
+
+		// change has been applied at the end of block 6.
+		// add a normal change.
+		{
+			System::initialize(&7, &header.hash(), &Default::default(), &Default::default());
+			assert!(!<PendingChange<Test>>::exists());
+			assert_eq!(Grandpa::grandpa_authorities(), to_authorities(vec![(4, 1), (5, 1), (6, 1)]));
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_ok());
+			Grandpa::on_finalize(7);
+			header = System::finalize();
+		}
+
+		// run the normal change.
+		{
+			System::initialize(&8, &header.hash(), &Default::default(), &Default::default());
+			assert!(<PendingChange<Test>>::exists());
+			assert_eq!(Grandpa::grandpa_authorities(), to_authorities(vec![(4, 1), (5, 1), (6, 1)]));
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1)]), 1, None).is_err());
+			Grandpa::on_finalize(8);
+			header = System::finalize();
+		}
+
+		// normal change applied. but we can't apply a new forced change for some
+		// time.
+		for i in 9..11 {
+			System::initialize(&i, &header.hash(), &Default::default(), &Default::default());
+			assert!(!<PendingChange<Test>>::exists());
+			assert_eq!(Grandpa::grandpa_authorities(), to_authorities(vec![(5, 1)]));
+			assert_eq!(Grandpa::next_forced(), Some(11));
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1), (6, 1)]), 5, Some(0)).is_err());
+			Grandpa::on_finalize(i);
+			header = System::finalize();
+		}
+
+		{
+			System::initialize(&11, &header.hash(), &Default::default(), &Default::default());
+			assert!(!<PendingChange<Test>>::exists());
+			assert!(Grandpa::schedule_change(to_authorities(vec![(5, 1), (6, 1), (7, 1)]), 5, Some(0)).is_ok());
+			assert_eq!(Grandpa::next_forced(), Some(21));
+			Grandpa::on_finalize(11);
+			header = System::finalize();
+		}
+		let _ = header;
+	});
+}
+
+#[test]
+fn schedule_pause_only_when_live() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		// we schedule a pause at block 1 with delay of 1
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_pause(1).unwrap();
+
+		// we've switched to the pending pause state
+		assert_eq!(
+			Grandpa::state(),
+			StoredState::PendingPause {
+				scheduled_at: 1u64,
+				delay: 1,
+			},
+		);
+
+		Grandpa::on_finalize(1);
+		let _ = System::finalize();
+
+		System::initialize(&2, &Default::default(), &Default::default(), &Default::default());
+
+		// signaling a pause now should fail
+		assert!(Grandpa::schedule_pause(1).is_err());
+
+		Grandpa::on_finalize(2);
+		let _ = System::finalize();
+
+		// after finalizing block 2 the set should have switched to paused state
+		assert_eq!(
+			Grandpa::state(),
+			StoredState::Paused,
+		);
+	});
+}
+
+#[test]
+fn schedule_resume_only_when_paused() {
+	new_test_ext(vec![(1, 1), (2, 1), (3, 1)]).execute_with(|| {
+		System::initialize(&1, &Default::default(), &Default::default(), &Default::default());
+
+		// the set is currently live, resuming it is an error
+		assert!(Grandpa::schedule_resume(1).is_err());
+
+		assert_eq!(
+			Grandpa::state(),
+			StoredState::Live,
+		);
+
+		// we schedule a pause to be applied instantly
+		Grandpa::schedule_pause(0).unwrap();
+		Grandpa::on_finalize(1);
+		let _ = System::finalize();
+
+		assert_eq!(
+			Grandpa::state(),
+			StoredState::Paused,
+		);
+
+		// we schedule the set to go back live in 2 blocks
+		System::initialize(&2, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::schedule_resume(2).unwrap();
+		Grandpa::on_finalize(2);
+		let _ = System::finalize();
+
+		System::initialize(&3, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::on_finalize(3);
+		let _ = System::finalize();
+
+		System::initialize(&4, &Default::default(), &Default::default(), &Default::default());
+		Grandpa::on_finalize(4);
+		let _ = System::finalize();
+
+		// it should be live at block 4
+		assert_eq!(
+			Grandpa::state(),
+			StoredState::Live,
+		);
+	});
+}
+
+#[test]
+fn time_slot_have_sane_ord() {
+	// Ensure that `Ord` implementation is sane.
+	const FIXTURE: &[GrandpaTimeSlot] = &[
+		GrandpaTimeSlot {
+			set_id: 0,
+			round: 0,
+		},
+		GrandpaTimeSlot {
+			set_id: 0,
+			round: 1,
+		},
+		GrandpaTimeSlot {
+			set_id: 1,
+			round: 0,
+		},
+		GrandpaTimeSlot {
+			set_id: 1,
+			round: 1,
+		},
+		GrandpaTimeSlot {
+			set_id: 1,
+			round: 2,
+		}
+	];
+	assert!(FIXTURE.windows(2).all(|f| f[0] < f[1]));
+}
+
+#[test]
+#[cfg(feature = "migrate-authorities")]
+fn authorities_migration() {
+	use sr_primitives::traits::OnInitialize;
+
+	with_externalities(&mut new_test_ext(vec![]), || {
+		let authorities = to_authorities(vec![(1, 1), (2, 1), (3, 1)]);
+
+		Authorities::put(authorities.clone());
+		assert!(Grandpa::grandpa_authorities().is_empty());
+
+		Grandpa::on_initialize(1);
+
+		assert!(!Authorities::exists());
+		assert_eq!(Grandpa::grandpa_authorities(), authorities);
+	});
+}

substrate/frame/im-online/Cargo.toml

@@ -0,0 +1,36 @@
+[package]
+name = "pallet-im-online"
+version = "0.1.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+app-crypto = { package = "substrate-application-crypto", path = "../../primitives/application-crypto", default-features = false }
+authorship = { package = "pallet-authorship", path = "../authorship", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+primitives = { package="substrate-primitives", path = "../../primitives/core", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+serde = { version = "1.0.101", optional = true }
+session = { package = "pallet-session", path = "../session", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[features]
+default = ["std", "session/historical"]
+std = [
+	"app-crypto/std",
+	"authorship/std",
+	"codec/std",
+	"primitives/std",
+	"rstd/std",
+	"serde",
+	"session/std",
+	"runtime-io/std",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/im-online/src/lib.rs

@@ -0,0 +1,660 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # I'm online Module
+//!
+//! If the local node is a validator (i.e. contains an authority key), this module
+//! gossips a heartbeat transaction with each new session. The heartbeat functions
+//! as a simple mechanism to signal that the node is online in the current era.
+//!
+//! Received heartbeats are tracked for one era and reset with each new era. The
+//! module exposes two public functions to query if a heartbeat has been received
+//! in the current era or session.
+//!
+//! The heartbeat is a signed transaction, which was signed using the session key
+//! and includes the recent best block number of the local validators chain as well
+//! as the [NetworkState](../../client/offchain/struct.NetworkState.html).
+//! It is submitted as an Unsigned Transaction via off-chain workers.
+//!
+//! - [`im_online::Trait`](./trait.Trait.html)
+//! - [`Call`](./enum.Call.html)
+//! - [`Module`](./struct.Module.html)
+//!
+//! ## Interface
+//!
+//! ### Public Functions
+//!
+//! - `is_online` - True if the validator sent a heartbeat in the current session.
+//!
+//! ## Usage
+//!
+//! ```
+//! use support::{decl_module, dispatch::Result};
+//! use system::ensure_signed;
+//! use pallet_im_online::{self as im_online};
+//!
+//! pub trait Trait: im_online::Trait {}
+//!
+//! decl_module! {
+//! 	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+//! 		pub fn is_online(origin, authority_index: u32) -> Result {
+//! 			let _sender = ensure_signed(origin)?;
+//! 			let _is_online = <im_online::Module<T>>::is_online(authority_index);
+//! 			Ok(())
+//! 		}
+//! 	}
+//! }
+//! # fn main() { }
+//! ```
+//!
+//! ## Dependencies
+//!
+//! This module depends on the [Session module](../pallet_session/index.html).
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+mod mock;
+mod tests;
+
+use app_crypto::RuntimeAppPublic;
+use codec::{Encode, Decode};
+use primitives::offchain::{OpaqueNetworkState, StorageKind};
+use rstd::prelude::*;
+use rstd::convert::TryInto;
+use session::historical::IdentificationTuple;
+use sr_primitives::{
+	RuntimeDebug,
+	traits::{Convert, Member, Printable, Saturating}, Perbill,
+	transaction_validity::{
+		TransactionValidity, ValidTransaction, InvalidTransaction,
+		TransactionPriority,
+	},
+};
+use sr_staking_primitives::{
+	SessionIndex,
+	offence::{ReportOffence, Offence, Kind},
+};
+use support::{
+	decl_module, decl_event, decl_storage, print, Parameter, debug,
+	traits::Get,
+};
+use system::ensure_none;
+use system::offchain::SubmitUnsignedTransaction;
+
+pub mod sr25519 {
+	mod app_sr25519 {
+		use app_crypto::{app_crypto, key_types::IM_ONLINE, sr25519};
+		app_crypto!(sr25519, IM_ONLINE);
+	}
+
+	/// An i'm online keypair using sr25519 as its crypto.
+	#[cfg(feature = "std")]
+	pub type AuthorityPair = app_sr25519::Pair;
+
+	/// An i'm online signature using sr25519 as its crypto.
+	pub type AuthoritySignature = app_sr25519::Signature;
+
+	/// An i'm online identifier using sr25519 as its crypto.
+	pub type AuthorityId = app_sr25519::Public;
+}
+
+pub mod ed25519 {
+	mod app_ed25519 {
+		use app_crypto::{app_crypto, key_types::IM_ONLINE, ed25519};
+		app_crypto!(ed25519, IM_ONLINE);
+	}
+
+	/// An i'm online keypair using ed25519 as its crypto.
+	#[cfg(feature = "std")]
+	pub type AuthorityPair = app_ed25519::Pair;
+
+	/// An i'm online signature using ed25519 as its crypto.
+	pub type AuthoritySignature = app_ed25519::Signature;
+
+	/// An i'm online identifier using ed25519 as its crypto.
+	pub type AuthorityId = app_ed25519::Public;
+}
+
+/// The local storage database key under which the worker progress status
+/// is tracked.
+const DB_KEY: &[u8] = b"frame/im-online-worker-status";
+
+/// It's important to persist the worker state, since e.g. the
+/// server could be restarted while starting the gossip process, but before
+/// finishing it. With every execution of the off-chain worker we check
+/// if we need to recover and resume gossipping or if there is already
+/// another off-chain worker in the process of gossipping.
+#[derive(Encode, Decode, Clone, PartialEq, Eq, RuntimeDebug)]
+struct WorkerStatus<BlockNumber> {
+	done: bool,
+	gossipping_at: BlockNumber,
+}
+
+/// Error which may occur while executing the off-chain code.
+#[derive(RuntimeDebug)]
+enum OffchainErr {
+	DecodeWorkerStatus,
+	FailedSigning,
+	NetworkState,
+	SubmitTransaction,
+}
+
+impl Printable for OffchainErr {
+	fn print(&self) {
+		match self {
+			OffchainErr::DecodeWorkerStatus => print("Offchain error: decoding WorkerStatus failed!"),
+			OffchainErr::FailedSigning => print("Offchain error: signing failed!"),
+			OffchainErr::NetworkState => print("Offchain error: fetching network state failed!"),
+			OffchainErr::SubmitTransaction => print("Offchain error: submitting transaction failed!"),
+		}
+	}
+}
+
+pub type AuthIndex = u32;
+
+/// Heartbeat which is sent/received.
+#[derive(Encode, Decode, Clone, PartialEq, Eq, RuntimeDebug)]
+pub struct Heartbeat<BlockNumber>
+	where BlockNumber: PartialEq + Eq + Decode + Encode,
+{
+	block_number: BlockNumber,
+	network_state: OpaqueNetworkState,
+	session_index: SessionIndex,
+	authority_index: AuthIndex,
+}
+
+pub trait Trait: system::Trait + session::historical::Trait {
+	/// The identifier type for an authority.
+	type AuthorityId: Member + Parameter + RuntimeAppPublic + Default + Ord;
+
+	/// The overarching event type.
+	type Event: From<Event<Self>> + Into<<Self as system::Trait>::Event>;
+
+	/// A dispatchable call type.
+	type Call: From<Call<Self>>;
+
+	/// A transaction submitter.
+	type SubmitTransaction: SubmitUnsignedTransaction<Self, <Self as Trait>::Call>;
+
+	/// An expected duration of the session.
+	///
+	/// This parameter is used to determine the longevity of `heartbeat` transaction
+	/// and a rough time when the heartbeat should be sent.
+	type SessionDuration: Get<Self::BlockNumber>;
+
+	/// A type that gives us the ability to submit unresponsiveness offence reports.
+	type ReportUnresponsiveness:
+		ReportOffence<
+			Self::AccountId,
+			IdentificationTuple<Self>,
+			UnresponsivenessOffence<IdentificationTuple<Self>>,
+		>;
+}
+
+decl_event!(
+	pub enum Event<T> where
+		<T as Trait>::AuthorityId,
+		IdentificationTuple = IdentificationTuple<T>,
+	{
+		/// A new heartbeat was received from `AuthorityId`
+		HeartbeatReceived(AuthorityId),
+		/// At the end of the session, no offence was committed.
+		AllGood,
+		/// At the end of the session, at least once validator was found to be offline.
+		SomeOffline(Vec<IdentificationTuple>),
+	}
+);
+
+decl_storage! {
+	trait Store for Module<T: Trait> as ImOnline {
+		/// The block number when we should gossip.
+		GossipAt get(fn gossip_at): T::BlockNumber;
+
+		/// The current set of keys that may issue a heartbeat.
+		Keys get(fn keys): Vec<T::AuthorityId>;
+
+		/// For each session index, we keep a mapping of `AuthIndex`
+		/// to `offchain::OpaqueNetworkState`.
+		ReceivedHeartbeats get(fn received_heartbeats): double_map SessionIndex,
+			blake2_256(AuthIndex) => Option<Vec<u8>>;
+
+		/// For each session index, we keep a mapping of `T::ValidatorId` to the
+		/// number of blocks authored by the given authority.
+		AuthoredBlocks get(fn authored_blocks): double_map SessionIndex,
+			blake2_256(T::ValidatorId) => u32;
+	}
+	add_extra_genesis {
+		config(keys): Vec<T::AuthorityId>;
+		build(|config| Module::<T>::initialize_keys(&config.keys))
+	}
+}
+
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+
+		fn heartbeat(
+			origin,
+			heartbeat: Heartbeat<T::BlockNumber>,
+			// since signature verification is done in `validate_unsigned`
+			// we can skip doing it here again.
+			_signature: <T::AuthorityId as RuntimeAppPublic>::Signature
+		) {
+			ensure_none(origin)?;
+
+			let current_session = <session::Module<T>>::current_index();
+			let exists = <ReceivedHeartbeats>::exists(
+				&current_session,
+				&heartbeat.authority_index
+			);
+			let keys = Keys::<T>::get();
+			let public = keys.get(heartbeat.authority_index as usize);
+			if let (false, Some(public)) = (exists, public) {
+				Self::deposit_event(Event::<T>::HeartbeatReceived(public.clone()));
+
+				let network_state = heartbeat.network_state.encode();
+				<ReceivedHeartbeats>::insert(
+					&current_session,
+					&heartbeat.authority_index,
+					&network_state
+				);
+			} else if exists {
+				Err("Duplicated heartbeat.")?
+			} else {
+				Err("Non existent public key.")?
+			}
+		}
+
+		// Runs after every block.
+		fn offchain_worker(now: T::BlockNumber) {
+			debug::RuntimeLogger::init();
+
+			// Only send messages if we are a potential validator.
+			if runtime_io::offchain::is_validator() {
+				Self::offchain(now);
+			}
+		}
+	}
+}
+
+/// Keep track of number of authored blocks per authority, uncles are counted as
+/// well since they're a valid proof of onlineness.
+impl<T: Trait + authorship::Trait> authorship::EventHandler<T::ValidatorId, T::BlockNumber> for Module<T> {
+	fn note_author(author: T::ValidatorId) {
+		Self::note_authorship(author);
+	}
+
+	fn note_uncle(author: T::ValidatorId, _age: T::BlockNumber) {
+		Self::note_authorship(author);
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Returns `true` if a heartbeat has been received for the authority at
+	/// `authority_index` in the authorities series or if the authority has
+	/// authored at least one block, during the current session. Otherwise
+	/// `false`.
+	pub fn is_online(authority_index: AuthIndex) -> bool {
+		let current_validators = <session::Module<T>>::validators();
+
+		if authority_index >= current_validators.len() as u32 {
+			return false;
+		}
+
+		let authority = &current_validators[authority_index as usize];
+
+		Self::is_online_aux(authority_index, authority)
+	}
+
+	fn is_online_aux(authority_index: AuthIndex, authority: &T::ValidatorId) -> bool {
+		let current_session = <session::Module<T>>::current_index();
+
+		<ReceivedHeartbeats>::exists(&current_session, &authority_index) ||
+			<AuthoredBlocks<T>>::get(
+				&current_session,
+				authority,
+			) != 0
+	}
+
+	/// Returns `true` if a heartbeat has been received for the authority at `authority_index` in
+	/// the authorities series, during the current session. Otherwise `false`.
+	pub fn received_heartbeat_in_current_session(authority_index: AuthIndex) -> bool {
+		let current_session = <session::Module<T>>::current_index();
+		<ReceivedHeartbeats>::exists(&current_session, &authority_index)
+	}
+
+	/// Note that the given authority has authored a block in the current session.
+	fn note_authorship(author: T::ValidatorId) {
+		let current_session = <session::Module<T>>::current_index();
+
+		<AuthoredBlocks<T>>::mutate(
+			&current_session,
+			author,
+			|authored| *authored += 1,
+		);
+	}
+
+	pub(crate) fn offchain(now: T::BlockNumber) {
+		let next_gossip = <GossipAt<T>>::get();
+		let check = Self::check_not_yet_gossipped(now, next_gossip);
+		let (curr_worker_status, not_yet_gossipped) = match check {
+			Ok((s, v)) => (s, v),
+			Err(err) => {
+				print(err);
+				return;
+			},
+		};
+		if next_gossip < now && not_yet_gossipped {
+			let value_set = Self::compare_and_set_worker_status(now, false, curr_worker_status);
+			if !value_set {
+				// value could not be set in local storage, since the value was
+				// different from `curr_worker_status`. this indicates that
+				// another worker was running in parallel.
+				return;
+			}
+
+			match Self::do_gossip_at(now) {
+				Ok(_) => {},
+				Err(err) => print(err),
+			}
+		} else {
+			debug::native::debug!(
+				target: "imonline",
+				"Skipping gossip at: {:?} >= {:?} || {:?}",
+				next_gossip,
+				now,
+				if not_yet_gossipped { "not gossipped" } else { "gossipped" }
+			);
+		}
+	}
+
+	fn do_gossip_at(block_number: T::BlockNumber) -> Result<(), OffchainErr> {
+		// we run only when a local authority key is configured
+		let authorities = Keys::<T>::get();
+		let mut results = Vec::new();
+		let mut local_keys = T::AuthorityId::all();
+		local_keys.sort();
+
+		for (authority_index, key) in authorities.into_iter()
+			.enumerate()
+			.filter_map(|(index, authority)| {
+				local_keys.binary_search(&authority)
+					.ok()
+					.map(|location| (index as u32, &local_keys[location]))
+			})
+		{
+			if Self::is_online(authority_index) {
+				debug::native::info!(
+					target: "imonline",
+					"[index: {:?}] Skipping sending heartbeat at block: {:?}. Already online.",
+					authority_index,
+					block_number
+				);
+				continue;
+			}
+
+			let network_state = runtime_io::offchain::network_state()
+				.map_err(|_| OffchainErr::NetworkState)?;
+			let heartbeat_data = Heartbeat {
+				block_number,
+				network_state,
+				session_index: <session::Module<T>>::current_index(),
+				authority_index,
+			};
+
+			let signature = key.sign(&heartbeat_data.encode()).ok_or(OffchainErr::FailedSigning)?;
+			let call = Call::heartbeat(heartbeat_data, signature);
+
+			debug::info!(
+				target: "imonline",
+				"[index: {:?}] Reporting im-online at block: {:?}",
+				authority_index,
+				block_number
+			);
+
+			results.push(
+				T::SubmitTransaction::submit_unsigned(call)
+					.map_err(|_| OffchainErr::SubmitTransaction)
+			);
+		}
+
+		// fail only after trying all keys.
+		results.into_iter().collect::<Result<Vec<_>, OffchainErr>>()?;
+
+		// once finished we set the worker status without comparing
+		// if the existing value changed in the meantime. this is
+		// because at this point the heartbeat was definitely submitted.
+		Self::set_worker_status(block_number, true);
+
+		Ok(())
+	}
+
+	fn compare_and_set_worker_status(
+		gossipping_at: T::BlockNumber,
+		done: bool,
+		curr_worker_status: Option<Vec<u8>>,
+	) -> bool {
+		let enc = WorkerStatus {
+			done,
+			gossipping_at,
+		};
+		runtime_io::offchain::local_storage_compare_and_set(
+			StorageKind::PERSISTENT,
+			DB_KEY,
+			curr_worker_status,
+			&enc.encode()
+		)
+	}
+
+	fn set_worker_status(
+		gossipping_at: T::BlockNumber,
+		done: bool,
+	) {
+		let enc = WorkerStatus {
+			done,
+			gossipping_at,
+		};
+		runtime_io::offchain::local_storage_set(StorageKind::PERSISTENT, DB_KEY, &enc.encode());
+	}
+
+	// Checks if a heartbeat gossip already occurred at this block number.
+	// Returns a tuple of `(current worker status, bool)`, whereby the bool
+	// is true if not yet gossipped.
+	fn check_not_yet_gossipped(
+		now: T::BlockNumber,
+		next_gossip: T::BlockNumber,
+	) -> Result<(Option<Vec<u8>>, bool), OffchainErr> {
+		let last_gossip = runtime_io::offchain::local_storage_get(StorageKind::PERSISTENT, DB_KEY);
+		match last_gossip {
+			Some(last) => {
+				let worker_status: WorkerStatus<T::BlockNumber> = Decode::decode(&mut &last[..])
+					.map_err(|_| OffchainErr::DecodeWorkerStatus)?;
+
+				let was_aborted = !worker_status.done && worker_status.gossipping_at < now;
+
+				// another off-chain worker is currently in the process of submitting
+				let already_submitting =
+					!worker_status.done && worker_status.gossipping_at == now;
+
+				let not_yet_gossipped =
+					worker_status.done && worker_status.gossipping_at < next_gossip;
+
+				let ret = (was_aborted && !already_submitting) || not_yet_gossipped;
+				Ok((Some(last), ret))
+			},
+			None => Ok((None, true)),
+		}
+	}
+
+	fn initialize_keys(keys: &[T::AuthorityId]) {
+		if !keys.is_empty() {
+			assert!(Keys::<T>::get().is_empty(), "Keys are already initialized!");
+			Keys::<T>::put(keys);
+		}
+	}
+}
+
+impl<T: Trait> sr_primitives::BoundToRuntimeAppPublic for Module<T> {
+	type Public = T::AuthorityId;
+}
+
+impl<T: Trait> session::OneSessionHandler<T::AccountId> for Module<T> {
+	type Key = T::AuthorityId;
+
+	fn on_genesis_session<'a, I: 'a>(validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, T::AuthorityId)>
+	{
+		let keys = validators.map(|x| x.1).collect::<Vec<_>>();
+		Self::initialize_keys(&keys);
+	}
+
+	fn on_new_session<'a, I: 'a>(_changed: bool, validators: I, _queued_validators: I)
+		where I: Iterator<Item=(&'a T::AccountId, T::AuthorityId)>
+	{
+		// Tell the offchain worker to start making the next session's heartbeats.
+		// Since we consider producing blocks as being online,
+		// the hearbeat is defered a bit to prevent spaming.
+		let block_number = <system::Module<T>>::block_number();
+		let half_session = T::SessionDuration::get() / 2.into();
+		<GossipAt<T>>::put(block_number + half_session);
+
+		// Remember who the authorities are for the new session.
+		Keys::<T>::put(validators.map(|x| x.1).collect::<Vec<_>>());
+	}
+
+	fn on_before_session_ending() {
+		let session_index = <session::Module<T>>::current_index();
+		let keys = Keys::<T>::get();
+		let current_validators = <session::Module<T>>::validators();
+
+		let offenders = current_validators.into_iter().enumerate()
+			.filter(|(index, id)|
+				!Self::is_online_aux(*index as u32, id)
+			).filter_map(|(_, id)|
+				T::FullIdentificationOf::convert(id.clone()).map(|full_id| (id, full_id))
+			).collect::<Vec<IdentificationTuple<T>>>();
+
+		// Remove all received heartbeats and number of authored blocks from the
+		// current session, they have already been processed and won't be needed
+		// anymore.
+		<ReceivedHeartbeats>::remove_prefix(&<session::Module<T>>::current_index());
+		<AuthoredBlocks<T>>::remove_prefix(&<session::Module<T>>::current_index());
+
+		if offenders.is_empty() {
+			Self::deposit_event(RawEvent::AllGood);
+		} else {
+			Self::deposit_event(RawEvent::SomeOffline(offenders.clone()));
+
+			let validator_set_count = keys.len() as u32;
+			let offence = UnresponsivenessOffence { session_index, validator_set_count, offenders };
+			T::ReportUnresponsiveness::report_offence(vec![], offence);
+		}
+	}
+
+	fn on_disabled(_i: usize) {
+		// ignore
+	}
+}
+
+#[allow(deprecated)]
+impl<T: Trait> support::unsigned::ValidateUnsigned for Module<T> {
+	type Call = Call<T>;
+
+	fn validate_unsigned(call: &Self::Call) -> TransactionValidity {
+		if let Call::heartbeat(heartbeat, signature) = call {
+			if <Module<T>>::is_online(heartbeat.authority_index) {
+				// we already received a heartbeat for this authority
+				return InvalidTransaction::Stale.into();
+			}
+
+			// check if session index from heartbeat is recent
+			let current_session = <session::Module<T>>::current_index();
+			if heartbeat.session_index != current_session {
+				return InvalidTransaction::Stale.into();
+			}
+
+			// verify that the incoming (unverified) pubkey is actually an authority id
+			let keys = Keys::<T>::get();
+			let authority_id = match keys.get(heartbeat.authority_index as usize) {
+				Some(id) => id,
+				None => return InvalidTransaction::BadProof.into(),
+			};
+
+			// check signature (this is expensive so we do it last).
+			let signature_valid = heartbeat.using_encoded(|encoded_heartbeat| {
+				authority_id.verify(&encoded_heartbeat, &signature)
+			});
+
+			if !signature_valid {
+				return InvalidTransaction::BadProof.into();
+			}
+
+			Ok(ValidTransaction {
+				priority: TransactionPriority::max_value(),
+				requires: vec![],
+				provides: vec![(current_session, authority_id).encode()],
+				longevity: TryInto::<u64>::try_into(T::SessionDuration::get() / 2.into()).unwrap_or(64_u64),
+				propagate: true,
+			})
+		} else {
+			InvalidTransaction::Call.into()
+		}
+	}
+}
+
+/// An offence that is filed if a validator didn't send a heartbeat message.
+#[derive(RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Clone, PartialEq, Eq))]
+pub struct UnresponsivenessOffence<Offender> {
+	/// The current session index in which we report the unresponsive validators.
+	///
+	/// It acts as a time measure for unresponsiveness reports and effectively will always point
+	/// at the end of the session.
+	session_index: SessionIndex,
+	/// The size of the validator set in current session/era.
+	validator_set_count: u32,
+	/// Authorities that were unresponsive during the current era.
+	offenders: Vec<Offender>,
+}
+
+impl<Offender: Clone> Offence<Offender> for UnresponsivenessOffence<Offender> {
+	const ID: Kind = *b"im-online:offlin";
+	type TimeSlot = SessionIndex;
+
+	fn offenders(&self) -> Vec<Offender> {
+		self.offenders.clone()
+	}
+
+	fn session_index(&self) -> SessionIndex {
+		self.session_index
+	}
+
+	fn validator_set_count(&self) -> u32 {
+		self.validator_set_count
+	}
+
+	fn time_slot(&self) -> Self::TimeSlot {
+		self.session_index
+	}
+
+	fn slash_fraction(offenders: u32, validator_set_count: u32) -> Perbill {
+		// the formula is min((3 * (k - 1)) / n, 1) * 0.05
+		let x = Perbill::from_rational_approximation(3 * (offenders - 1), validator_set_count);
+		x.saturating_mul(Perbill::from_percent(5))
+	}
+}

substrate/frame/im-online/src/mock.rs

@@ -0,0 +1,178 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+#![cfg(test)]
+
+use std::cell::RefCell;
+
+use crate::{Module, Trait};
+use sr_primitives::Perbill;
+use sr_staking_primitives::{SessionIndex, offence::ReportOffence};
+use sr_primitives::testing::{Header, UintAuthorityId, TestXt};
+use sr_primitives::traits::{IdentityLookup, BlakeTwo256, ConvertInto};
+use primitives::H256;
+use support::{impl_outer_origin, impl_outer_dispatch, parameter_types};
+use {runtime_io, system};
+
+impl_outer_origin!{
+	pub enum Origin for Runtime {}
+}
+
+impl_outer_dispatch! {
+	pub enum Call for Runtime where origin: Origin {
+		imonline::ImOnline,
+	}
+}
+
+thread_local! {
+	pub static VALIDATORS: RefCell<Option<Vec<u64>>> = RefCell::new(Some(vec![1, 2, 3]));
+}
+
+pub struct TestOnSessionEnding;
+impl session::OnSessionEnding<u64> for TestOnSessionEnding {
+	fn on_session_ending(_ending_index: SessionIndex, _will_apply_at: SessionIndex)
+		-> Option<Vec<u64>>
+	{
+		VALIDATORS.with(|l| l.borrow_mut().take())
+	}
+}
+
+impl session::historical::OnSessionEnding<u64, u64> for TestOnSessionEnding {
+	fn on_session_ending(_ending_index: SessionIndex, _will_apply_at: SessionIndex)
+		-> Option<(Vec<u64>, Vec<(u64, u64)>)>
+	{
+		VALIDATORS.with(|l| l
+			.borrow_mut()
+			.take()
+			.map(|validators| {
+				let full_identification = validators.iter().map(|v| (*v, *v)).collect();
+				(validators, full_identification)
+			})
+		)
+	}
+}
+
+/// An extrinsic type used for tests.
+pub type Extrinsic = TestXt<Call, ()>;
+type SubmitTransaction = system::offchain::TransactionSubmitter<(), Call, Extrinsic>;
+type IdentificationTuple = (u64, u64);
+type Offence = crate::UnresponsivenessOffence<IdentificationTuple>;
+
+thread_local! {
+	pub static OFFENCES: RefCell<Vec<(Vec<u64>, Offence)>> = RefCell::new(vec![]);
+}
+
+/// A mock offence report handler.
+pub struct OffenceHandler;
+impl ReportOffence<u64, IdentificationTuple, Offence> for OffenceHandler {
+	fn report_offence(reporters: Vec<u64>, offence: Offence) {
+		OFFENCES.with(|l| l.borrow_mut().push((reporters, offence)));
+	}
+}
+
+pub fn new_test_ext() -> runtime_io::TestExternalities {
+	let t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+	t.into()
+}
+
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Runtime;
+
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+
+impl system::Trait for Runtime {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = Call;
+	type Hash = H256;
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+
+parameter_types! {
+	pub const Period: u64 = 1;
+	pub const Offset: u64 = 0;
+}
+
+parameter_types! {
+	pub const DisabledValidatorsThreshold: Perbill = Perbill::from_percent(33);
+}
+
+impl session::Trait for Runtime {
+	type ShouldEndSession = session::PeriodicSessions<Period, Offset>;
+	type OnSessionEnding = session::historical::NoteHistoricalRoot<Runtime, TestOnSessionEnding>;
+	type SessionHandler = (ImOnline, );
+	type ValidatorId = u64;
+	type ValidatorIdOf = ConvertInto;
+	type Keys = UintAuthorityId;
+	type Event = ();
+	type SelectInitialValidators = ();
+	type DisabledValidatorsThreshold = DisabledValidatorsThreshold;
+}
+
+impl session::historical::Trait for Runtime {
+	type FullIdentification = u64;
+	type FullIdentificationOf = ConvertInto;
+}
+
+parameter_types! {
+	pub const UncleGenerations: u32 = 5;
+}
+
+impl authorship::Trait for Runtime {
+	type FindAuthor = ();
+	type UncleGenerations = UncleGenerations;
+	type FilterUncle = ();
+	type EventHandler = ImOnline;
+}
+
+impl Trait for Runtime {
+	type AuthorityId = UintAuthorityId;
+	type Event = ();
+	type Call = Call;
+	type SubmitTransaction = SubmitTransaction;
+	type ReportUnresponsiveness = OffenceHandler;
+	type SessionDuration = Period;
+}
+
+/// Im Online module.
+pub type ImOnline = Module<Runtime>;
+pub type System = system::Module<Runtime>;
+pub type Session = session::Module<Runtime>;
+
+pub fn advance_session() {
+	let now = System::block_number();
+	System::set_block_number(now + 1);
+	Session::rotate_session();
+	assert_eq!(Session::current_index(), (now / Period::get()) as u32);
+}

substrate/frame/im-online/src/tests.rs

@@ -0,0 +1,332 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the im-online module.
+
+#![cfg(test)]
+
+use super::*;
+use crate::mock::*;
+use primitives::offchain::{
+	OpaquePeerId,
+	OffchainExt,
+	TransactionPoolExt,
+	testing::{TestOffchainExt, TestTransactionPoolExt},
+};
+use support::{dispatch, assert_noop};
+use sr_primitives::testing::UintAuthorityId;
+
+#[test]
+fn test_unresponsiveness_slash_fraction() {
+	// A single case of unresponsiveness is not slashed.
+	assert_eq!(
+		UnresponsivenessOffence::<()>::slash_fraction(1, 50),
+		Perbill::zero(),
+	);
+
+	assert_eq!(
+		UnresponsivenessOffence::<()>::slash_fraction(3, 50),
+		Perbill::from_parts(6000000), // 0.6%
+	);
+
+	// One third offline should be punished around 5%.
+	assert_eq!(
+		UnresponsivenessOffence::<()>::slash_fraction(17, 50),
+		Perbill::from_parts(48000000), // 4.8%
+	);
+}
+
+#[test]
+fn should_report_offline_validators() {
+	new_test_ext().execute_with(|| {
+		// given
+		let block = 1;
+		System::set_block_number(block);
+		// buffer new validators
+		Session::rotate_session();
+		// enact the change and buffer another one
+		let validators = vec![1, 2, 3, 4, 5, 6];
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(validators.clone()));
+		Session::rotate_session();
+
+		// when
+		// we end current session and start the next one
+		Session::rotate_session();
+
+		// then
+		let offences = OFFENCES.with(|l| l.replace(vec![]));
+		assert_eq!(offences, vec![
+			(vec![], UnresponsivenessOffence {
+				session_index: 2,
+				validator_set_count: 3,
+				offenders: vec![
+					(1, 1),
+					(2, 2),
+					(3, 3),
+				],
+			})
+		]);
+
+		// should not report when heartbeat is sent
+		for (idx, v) in validators.into_iter().take(4).enumerate() {
+			let _ = heartbeat(block, 3, idx as u32, v.into()).unwrap();
+		}
+		Session::rotate_session();
+
+		// then
+		let offences = OFFENCES.with(|l| l.replace(vec![]));
+		assert_eq!(offences, vec![
+			(vec![], UnresponsivenessOffence {
+				session_index: 3,
+				validator_set_count: 6,
+				offenders: vec![
+					(5, 5),
+					(6, 6),
+				],
+			})
+		]);
+	});
+}
+
+fn heartbeat(
+	block_number: u64,
+	session_index: u32,
+	authority_index: u32,
+	id: UintAuthorityId,
+) -> dispatch::Result {
+	#[allow(deprecated)]
+	use support::unsigned::ValidateUnsigned;
+
+	let heartbeat = Heartbeat {
+		block_number,
+		network_state: OpaqueNetworkState {
+			peer_id: OpaquePeerId(vec![1]),
+			external_addresses: vec![],
+		},
+		session_index,
+		authority_index,
+	};
+	let signature = id.sign(&heartbeat.encode()).unwrap();
+
+	#[allow(deprecated)] // Allow ValidateUnsigned
+	ImOnline::pre_dispatch(&crate::Call::heartbeat(heartbeat.clone(), signature.clone()))?;
+	ImOnline::heartbeat(
+		Origin::system(system::RawOrigin::None),
+		heartbeat,
+		signature
+	)
+}
+
+#[test]
+fn should_mark_online_validator_when_heartbeat_is_received() {
+	new_test_ext().execute_with(|| {
+		advance_session();
+		// given
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 3, 4, 5, 6]));
+		assert_eq!(Session::validators(), Vec::<u64>::new());
+		// enact the change and buffer another one
+		advance_session();
+
+		assert_eq!(Session::current_index(), 2);
+		assert_eq!(Session::validators(), vec![1, 2, 3]);
+
+		assert!(!ImOnline::is_online(0));
+		assert!(!ImOnline::is_online(1));
+		assert!(!ImOnline::is_online(2));
+
+		// when
+		let _ = heartbeat(1, 2, 0, 1.into()).unwrap();
+
+		// then
+		assert!(ImOnline::is_online(0));
+		assert!(!ImOnline::is_online(1));
+		assert!(!ImOnline::is_online(2));
+
+		// and when
+		let _ = heartbeat(1, 2, 2, 3.into()).unwrap();
+
+		// then
+		assert!(ImOnline::is_online(0));
+		assert!(!ImOnline::is_online(1));
+		assert!(ImOnline::is_online(2));
+	});
+}
+
+#[test]
+fn late_heartbeat_should_fail() {
+	new_test_ext().execute_with(|| {
+		advance_session();
+		// given
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 4, 4, 5, 6]));
+		assert_eq!(Session::validators(), Vec::<u64>::new());
+		// enact the change and buffer another one
+		advance_session();
+
+		assert_eq!(Session::current_index(), 2);
+		assert_eq!(Session::validators(), vec![1, 2, 3]);
+
+		// when
+		assert_noop!(heartbeat(1, 3, 0, 1.into()), "Transaction is outdated");
+		assert_noop!(heartbeat(1, 1, 0, 1.into()), "Transaction is outdated");
+	});
+}
+
+#[test]
+fn should_generate_heartbeats() {
+	let mut ext = new_test_ext();
+	let (offchain, _state) = TestOffchainExt::new();
+	let (pool, state) = TestTransactionPoolExt::new();
+	ext.register_extension(OffchainExt::new(offchain));
+	ext.register_extension(TransactionPoolExt::new(pool));
+
+	ext.execute_with(|| {
+		// given
+		let block = 1;
+		System::set_block_number(block);
+		// buffer new validators
+		Session::rotate_session();
+		// enact the change and buffer another one
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 3, 4, 5, 6]));
+		Session::rotate_session();
+
+		// when
+		UintAuthorityId::set_all_keys(vec![0, 1, 2]);
+		ImOnline::offchain(2);
+
+		// then
+		let transaction = state.write().transactions.pop().unwrap();
+		// All validators have `0` as their session key, so we generate 3 transactions.
+		assert_eq!(state.read().transactions.len(), 2);
+		// check stuff about the transaction.
+		let ex: Extrinsic = Decode::decode(&mut &*transaction).unwrap();
+		let heartbeat = match ex.1 {
+			crate::mock::Call::ImOnline(crate::Call::heartbeat(h, _)) => h,
+			e => panic!("Unexpected call: {:?}", e),
+		};
+
+		assert_eq!(heartbeat, Heartbeat {
+			block_number: 2,
+			network_state: runtime_io::offchain::network_state().unwrap(),
+			session_index: 2,
+			authority_index: 2,
+		});
+	});
+}
+
+#[test]
+fn should_cleanup_received_heartbeats_on_session_end() {
+	new_test_ext().execute_with(|| {
+		advance_session();
+
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 3]));
+		assert_eq!(Session::validators(), Vec::<u64>::new());
+
+		// enact the change and buffer another one
+		advance_session();
+
+		assert_eq!(Session::current_index(), 2);
+		assert_eq!(Session::validators(), vec![1, 2, 3]);
+
+		// send an heartbeat from authority id 0 at session 2
+		let _ = heartbeat(1, 2, 0, 1.into()).unwrap();
+
+		// the heartbeat is stored
+		assert!(!ImOnline::received_heartbeats(&2, &0).is_none());
+
+		advance_session();
+
+		// after the session has ended we have already processed the heartbeat
+		// message, so any messages received on the previous session should have
+		// been pruned.
+		assert!(ImOnline::received_heartbeats(&2, &0).is_none());
+	});
+}
+
+#[test]
+fn should_mark_online_validator_when_block_is_authored() {
+	use authorship::EventHandler;
+
+	new_test_ext().execute_with(|| {
+		advance_session();
+		// given
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 3, 4, 5, 6]));
+		assert_eq!(Session::validators(), Vec::<u64>::new());
+		// enact the change and buffer another one
+		advance_session();
+
+		assert_eq!(Session::current_index(), 2);
+		assert_eq!(Session::validators(), vec![1, 2, 3]);
+
+		for i in 0..3 {
+			assert!(!ImOnline::is_online(i));
+		}
+
+		// when
+		ImOnline::note_author(1);
+		ImOnline::note_uncle(2, 0);
+
+		// then
+		assert!(ImOnline::is_online(0));
+		assert!(ImOnline::is_online(1));
+		assert!(!ImOnline::is_online(2));
+	});
+}
+
+#[test]
+fn should_not_send_a_report_if_already_online() {
+	use authorship::EventHandler;
+
+	let mut ext = new_test_ext();
+	let (offchain, _state) = TestOffchainExt::new();
+	let (pool, pool_state) = TestTransactionPoolExt::new();
+	ext.register_extension(OffchainExt::new(offchain));
+	ext.register_extension(TransactionPoolExt::new(pool));
+
+	ext.execute_with(|| {
+		advance_session();
+		// given
+		VALIDATORS.with(|l| *l.borrow_mut() = Some(vec![1, 2, 3, 4, 5, 6]));
+		assert_eq!(Session::validators(), Vec::<u64>::new());
+		// enact the change and buffer another one
+		advance_session();
+		assert_eq!(Session::current_index(), 2);
+		assert_eq!(Session::validators(), vec![1, 2, 3]);
+		ImOnline::note_author(2);
+		ImOnline::note_uncle(3, 0);
+
+		// when
+		UintAuthorityId::set_all_keys(vec![0]); // all authorities use session key 0
+		ImOnline::offchain(4);
+
+		// then
+		let transaction = pool_state.write().transactions.pop().unwrap();
+		// All validators have `0` as their session key, but we should only produce 1 hearbeat.
+		assert_eq!(pool_state.read().transactions.len(), 0);
+		// check stuff about the transaction.
+		let ex: Extrinsic = Decode::decode(&mut &*transaction).unwrap();
+		let heartbeat = match ex.1 {
+			crate::mock::Call::ImOnline(crate::Call::heartbeat(h, _)) => h,
+			e => panic!("Unexpected call: {:?}", e),
+		};
+
+		assert_eq!(heartbeat, Heartbeat {
+			block_number: 4,
+			network_state: runtime_io::offchain::network_state().unwrap(),
+			session_index: 2,
+			authority_index: 0,
+		});
+	});
+}

substrate/frame/indices/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "pallet-indices"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+substrate-keyring = { path = "../../primitives/keyring", optional = true }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+ref_thread_local = "0.0.0"
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"safe-mix/std",
+	"substrate-keyring",
+	"codec/std",
+	"primitives/std",
+	"rstd/std",
+	"runtime-io/std",
+	"support/std",
+	"sr-primitives/std",
+	"system/std",
+]

substrate/frame/indices/src/address.rs

@@ -0,0 +1,158 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Address type that is union of index and id for an account.
+
+#[cfg(feature = "std")]
+use std::fmt;
+use rstd::convert::TryInto;
+use crate::Member;
+use codec::{Encode, Decode, Input, Output, Error};
+
+/// An indices-aware address, which can be either a direct `AccountId` or
+/// an index.
+#[derive(PartialEq, Eq, Clone, sr_primitives::RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Hash))]
+pub enum Address<AccountId, AccountIndex> where
+	AccountId: Member,
+	AccountIndex: Member,
+{
+	/// It's an account ID (pubkey).
+	Id(AccountId),
+	/// It's an account index.
+	Index(AccountIndex),
+}
+
+#[cfg(feature = "std")]
+impl<AccountId, AccountIndex> fmt::Display for Address<AccountId, AccountIndex> where
+	AccountId: Member,
+	AccountIndex: Member,
+{
+	fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+		write!(f, "{:?}", self)
+	}
+}
+
+impl<AccountId, AccountIndex> From<AccountId> for Address<AccountId, AccountIndex> where
+	AccountId: Member,
+	AccountIndex: Member,
+{
+	fn from(a: AccountId) -> Self {
+		Address::Id(a)
+	}
+}
+
+fn need_more_than<T: PartialOrd>(a: T, b: T) -> Result<T, Error> {
+	if a < b { Ok(b) } else { Err("Invalid range".into()) }
+}
+
+impl<AccountId, AccountIndex> Decode for Address<AccountId, AccountIndex> where
+	AccountId: Member + Decode,
+	AccountIndex: Member + Decode + PartialOrd<AccountIndex> + Ord + From<u32> + Copy,
+{
+	fn decode<I: Input>(input: &mut I) -> Result<Self, Error> {
+		Ok(match input.read_byte()? {
+			x @ 0x00..=0xef => Address::Index(AccountIndex::from(x as u32)),
+			0xfc => Address::Index(AccountIndex::from(
+				need_more_than(0xef, u16::decode(input)?)? as u32
+			)),
+			0xfd => Address::Index(AccountIndex::from(
+				need_more_than(0xffff, u32::decode(input)?)?
+			)),
+			0xfe => Address::Index(
+				need_more_than(0xffffffffu32.into(), Decode::decode(input)?)?
+			),
+			0xff => Address::Id(Decode::decode(input)?),
+			_ => return Err("Invalid address variant".into()),
+		})
+	}
+}
+
+impl<AccountId, AccountIndex> Encode for Address<AccountId, AccountIndex> where
+	AccountId: Member + Encode,
+	AccountIndex: Member + Encode + PartialOrd<AccountIndex> + Ord + Copy + From<u32> + TryInto<u32>,
+{
+	fn encode_to<T: Output>(&self, dest: &mut T) {
+		match *self {
+			Address::Id(ref i) => {
+				dest.push_byte(255);
+				dest.push(i);
+			}
+			Address::Index(i) => {
+				let maybe_u32: Result<u32, _> = i.try_into();
+				if let Ok(x) = maybe_u32 {
+					if x > 0xffff {
+						dest.push_byte(253);
+						dest.push(&x);
+					}
+					else if x >= 0xf0 {
+						dest.push_byte(252);
+						dest.push(&(x as u16));
+					}
+					else {
+						dest.push_byte(x as u8);
+					}
+
+				} else {
+					dest.push_byte(254);
+					dest.push(&i);
+				}
+			},
+		}
+	}
+}
+
+impl<AccountId, AccountIndex> codec::EncodeLike for Address<AccountId, AccountIndex> where
+	AccountId: Member + Encode,
+	AccountIndex: Member + Encode + PartialOrd<AccountIndex> + Ord + Copy + From<u32> + TryInto<u32>,
+{}
+
+impl<AccountId, AccountIndex> Default for Address<AccountId, AccountIndex> where
+	AccountId: Member + Default,
+	AccountIndex: Member,
+{
+	fn default() -> Self {
+		Address::Id(Default::default())
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use codec::{Encode, Decode};
+
+	type Address = super::Address<[u8; 8], u32>;
+	fn index(i: u32) -> Address { super::Address::Index(i) }
+	fn id(i: [u8; 8]) -> Address { super::Address::Id(i) }
+
+	fn compare(a: Option<Address>, d: &[u8]) {
+		if let Some(ref a) = a {
+			assert_eq!(d, &a.encode()[..]);
+		}
+		assert_eq!(Address::decode(&mut &d[..]).ok(), a);
+	}
+
+	#[test]
+	fn it_should_work() {
+		compare(Some(index(2)), &[2][..]);
+		compare(None, &[240][..]);
+		compare(None, &[252, 239, 0][..]);
+		compare(Some(index(240)), &[252, 240, 0][..]);
+		compare(Some(index(304)), &[252, 48, 1][..]);
+		compare(None, &[253, 255, 255, 0, 0][..]);
+		compare(Some(index(0x10000)), &[253, 0, 0, 1, 0][..]);
+		compare(Some(id([42, 69, 42, 69, 42, 69, 42, 69])), &[255, 42, 69, 42, 69, 42, 69, 42, 69][..]);
+	}
+}

substrate/frame/indices/src/lib.rs

@@ -0,0 +1,235 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! An index is a short form of an address. This module handles allocation
+//! of indices for a newly created accounts.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::{prelude::*, marker::PhantomData, convert::TryInto};
+use codec::{Encode, Codec};
+use support::{Parameter, decl_module, decl_event, decl_storage};
+use sr_primitives::traits::{One, SimpleArithmetic, StaticLookup, Member, LookupError};
+use system::{IsDeadAccount, OnNewAccount};
+
+use self::address::Address as RawAddress;
+
+mod mock;
+
+pub mod address;
+mod tests;
+
+/// Number of account IDs stored per enum set.
+const ENUM_SET_SIZE: u32 = 64;
+
+pub type Address<T> = RawAddress<<T as system::Trait>::AccountId, <T as Trait>::AccountIndex>;
+
+/// Turn an Id into an Index, or None for the purpose of getting
+/// a hint at a possibly desired index.
+pub trait ResolveHint<AccountId, AccountIndex> {
+	/// Turn an Id into an Index, or None for the purpose of getting
+	/// a hint at a possibly desired index.
+	fn resolve_hint(who: &AccountId) -> Option<AccountIndex>;
+}
+
+/// Simple encode-based resolve hint implementation.
+pub struct SimpleResolveHint<AccountId, AccountIndex>(PhantomData<(AccountId, AccountIndex)>);
+impl<AccountId: Encode, AccountIndex: From<u32>>
+	ResolveHint<AccountId, AccountIndex> for SimpleResolveHint<AccountId, AccountIndex>
+{
+	fn resolve_hint(who: &AccountId) -> Option<AccountIndex> {
+		Some(AccountIndex::from(who.using_encoded(|e| e[0] as u32 + e[1] as u32 * 256)))
+	}
+}
+
+/// The module's config trait.
+pub trait Trait: system::Trait {
+	/// Type used for storing an account's index; implies the maximum number of accounts the system
+	/// can hold.
+	type AccountIndex: Parameter + Member + Codec + Default + SimpleArithmetic + Copy;
+
+	/// Whether an account is dead or not.
+	type IsDeadAccount: IsDeadAccount<Self::AccountId>;
+
+	/// How to turn an id into an index.
+	type ResolveHint: ResolveHint<Self::AccountId, Self::AccountIndex>;
+
+	/// The overarching event type.
+	type Event: From<Event<Self>> + Into<<Self as system::Trait>::Event>;
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+	}
+}
+
+decl_event!(
+	pub enum Event<T> where
+		<T as system::Trait>::AccountId,
+		<T as Trait>::AccountIndex
+	{
+		/// A new account index was assigned.
+		///
+		/// This event is not triggered when an existing index is reassigned
+		/// to another `AccountId`.
+		NewAccountIndex(AccountId, AccountIndex),
+	}
+);
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Indices {
+		/// The next free enumeration set.
+		pub NextEnumSet get(fn next_enum_set) build(|config: &GenesisConfig<T>| {
+			(config.ids.len() as u32 / ENUM_SET_SIZE).into()
+		}): T::AccountIndex;
+
+		/// The enumeration sets.
+		pub EnumSet get(fn enum_set) build(|config: &GenesisConfig<T>| {
+			(0..((config.ids.len() as u32) + ENUM_SET_SIZE - 1) / ENUM_SET_SIZE)
+				.map(|i| (
+					i.into(),
+					config.ids[
+						(i * ENUM_SET_SIZE) as usize..
+						config.ids.len().min(((i + 1) * ENUM_SET_SIZE) as usize)
+					].to_owned(),
+				))
+				.collect::<Vec<_>>()
+		}): map T::AccountIndex => Vec<T::AccountId>;
+	}
+	add_extra_genesis {
+		config(ids): Vec<T::AccountId>;
+	}
+}
+
+impl<T: Trait> Module<T> {
+	// PUBLIC IMMUTABLES
+
+	/// Lookup an T::AccountIndex to get an Id, if there's one there.
+	pub fn lookup_index(index: T::AccountIndex) -> Option<T::AccountId> {
+		let enum_set_size = Self::enum_set_size();
+		let set = Self::enum_set(index / enum_set_size);
+		let i: usize = (index % enum_set_size).try_into().ok()?;
+		set.get(i).cloned()
+	}
+
+	/// `true` if the account `index` is ready for reclaim.
+	pub fn can_reclaim(try_index: T::AccountIndex) -> bool {
+		let enum_set_size = Self::enum_set_size();
+		let try_set = Self::enum_set(try_index / enum_set_size);
+		let maybe_usize: Result<usize, _> = (try_index % enum_set_size).try_into();
+		if let Ok(i) = maybe_usize {
+			i < try_set.len() && T::IsDeadAccount::is_dead_account(&try_set[i])
+		} else {
+			false
+		}
+	}
+
+	/// Lookup an address to get an Id, if there's one there.
+	pub fn lookup_address(
+		a: address::Address<T::AccountId, T::AccountIndex>
+	) -> Option<T::AccountId> {
+		match a {
+			address::Address::Id(i) => Some(i),
+			address::Address::Index(i) => Self::lookup_index(i),
+		}
+	}
+
+	// PUBLIC MUTABLES (DANGEROUS)
+
+	fn enum_set_size() -> T::AccountIndex {
+		ENUM_SET_SIZE.into()
+	}
+}
+
+impl<T: Trait> OnNewAccount<T::AccountId> for Module<T> {
+	// Implementation of the config type managing the creation of new accounts.
+	// See Balances module for a concrete example.
+	//
+	// # <weight>
+	// - Independent of the arguments.
+	// - Given the correct value of `Self::next_enum_set`, it always has a limited
+	//   number of reads and writes and no complex computation.
+	//
+	// As for storage, calling this function with _non-dead-indices_ will linearly grow the length of
+	// of `Self::enum_set`. Appropriate economic incentives should exist to make callers of this
+	// function provide a `who` argument that reclaims a dead account.
+	//
+	// At the time of this writing, only the Balances module calls this function upon creation
+	// of new accounts.
+	// # </weight>
+	fn on_new_account(who: &T::AccountId) {
+		let enum_set_size = Self::enum_set_size();
+		let next_set_index = Self::next_enum_set();
+
+		if let Some(try_index) = T::ResolveHint::resolve_hint(who) {
+			// then check to see if this account id identifies a dead account index.
+			let set_index = try_index / enum_set_size;
+			let mut try_set = Self::enum_set(set_index);
+			if let Ok(item_index) = (try_index % enum_set_size).try_into() {
+				if item_index < try_set.len() {
+					if T::IsDeadAccount::is_dead_account(&try_set[item_index]) {
+						// yup - this index refers to a dead account. can be reused.
+						try_set[item_index] = who.clone();
+						<EnumSet<T>>::insert(set_index, try_set);
+
+						return
+					}
+				}
+			}
+		}
+
+		// insert normally as a back up
+		let mut set_index = next_set_index;
+		// defensive only: this loop should never iterate since we keep NextEnumSet up to date
+		// later.
+		let mut set = loop {
+			let set = Self::enum_set(set_index);
+			if set.len() < ENUM_SET_SIZE as usize {
+				break set;
+			}
+			set_index += One::one();
+		};
+
+		let index = set_index * enum_set_size + T::AccountIndex::from(set.len() as u32);
+
+		// update set.
+		set.push(who.clone());
+
+		// keep NextEnumSet up to date
+		if set.len() == ENUM_SET_SIZE as usize {
+			<NextEnumSet<T>>::put(set_index + One::one());
+		}
+
+		// write set.
+		<EnumSet<T>>::insert(set_index, set);
+
+		Self::deposit_event(RawEvent::NewAccountIndex(who.clone(), index));
+	}
+}
+
+impl<T: Trait> StaticLookup for Module<T> {
+	type Source = address::Address<T::AccountId, T::AccountIndex>;
+	type Target = T::AccountId;
+
+	fn lookup(a: Self::Source) -> Result<T::AccountId, LookupError> {
+		Self::lookup_address(a).ok_or(LookupError)
+	}
+
+	fn unlookup(a: Self::Target) -> Self::Source {
+		address::Address::Id(a)
+	}
+}

substrate/frame/indices/src/mock.rs

@@ -0,0 +1,112 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+#![cfg(test)]
+
+use std::collections::HashSet;
+use ref_thread_local::{ref_thread_local, RefThreadLocal};
+use sr_primitives::testing::Header;
+use sr_primitives::Perbill;
+use primitives::H256;
+use support::{impl_outer_origin, parameter_types};
+use {runtime_io, system};
+use crate::{GenesisConfig, Module, Trait, IsDeadAccount, OnNewAccount, ResolveHint};
+
+impl_outer_origin!{
+	pub enum Origin for Runtime {}
+}
+
+ref_thread_local! {
+	static managed ALIVE: HashSet<u64> = HashSet::new();
+}
+
+pub fn make_account(who: u64) {
+	ALIVE.borrow_mut().insert(who);
+	Indices::on_new_account(&who);
+}
+
+pub fn kill_account(who: u64) {
+	ALIVE.borrow_mut().remove(&who);
+}
+
+pub struct TestIsDeadAccount {}
+impl IsDeadAccount<u64> for TestIsDeadAccount {
+	fn is_dead_account(who: &u64) -> bool {
+		!ALIVE.borrow_mut().contains(who)
+	}
+}
+
+pub struct TestResolveHint;
+impl ResolveHint<u64, u64> for TestResolveHint {
+	fn resolve_hint(who: &u64) -> Option<u64> {
+		if *who < 256 {
+			None
+		} else {
+			Some(*who - 256)
+		}
+	}
+}
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Runtime;
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Runtime {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = ::sr_primitives::traits::BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = Indices;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+impl Trait for Runtime {
+	type AccountIndex = u64;
+	type IsDeadAccount = TestIsDeadAccount;
+	type ResolveHint = TestResolveHint;
+	type Event = ();
+}
+
+pub fn new_test_ext() -> runtime_io::TestExternalities {
+	{
+		let mut h = ALIVE.borrow_mut();
+		h.clear();
+		for i in 1..5 { h.insert(i); }
+	}
+
+	let mut t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+	GenesisConfig::<Runtime> {
+		ids: vec![1, 2, 3, 4]
+	}.assimilate_storage(&mut t).unwrap();
+	t.into()
+}
+
+pub type Indices = Module<Runtime>;

substrate/frame/indices/src/tests.rs

@@ -0,0 +1,67 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the module.
+
+#![cfg(test)]
+
+use super::*;
+use crate::mock::{Indices, new_test_ext, make_account, kill_account, TestIsDeadAccount};
+
+#[test]
+fn indexing_lookup_should_work() {
+	new_test_ext().execute_with(|| {
+		assert_eq!(Indices::lookup_index(0), Some(1));
+		assert_eq!(Indices::lookup_index(1), Some(2));
+		assert_eq!(Indices::lookup_index(2), Some(3));
+		assert_eq!(Indices::lookup_index(3), Some(4));
+		assert_eq!(Indices::lookup_index(4), None);
+	});
+}
+
+#[test]
+fn default_indexing_on_new_accounts_should_work() {
+	new_test_ext().execute_with(|| {
+		assert_eq!(Indices::lookup_index(4), None);
+		make_account(5);
+		assert_eq!(Indices::lookup_index(4), Some(5));
+	});
+}
+
+#[test]
+fn reclaim_indexing_on_new_accounts_should_work() {
+	new_test_ext().execute_with(|| {
+		assert_eq!(Indices::lookup_index(1), Some(2));
+		assert_eq!(Indices::lookup_index(4), None);
+
+		kill_account(2);					// index 1 no longer locked to id 2
+
+		make_account(1 + 256);				// id 257 takes index 1.
+		assert_eq!(Indices::lookup_index(1), Some(257));
+	});
+}
+
+#[test]
+fn alive_account_should_prevent_reclaim() {
+	new_test_ext().execute_with(|| {
+		assert!(!TestIsDeadAccount::is_dead_account(&2));
+		assert_eq!(Indices::lookup_index(1), Some(2));
+		assert_eq!(Indices::lookup_index(4), None);
+
+		make_account(1 + 256);				// id 257 takes index 1.
+		assert_eq!(Indices::lookup_index(4), Some(257));
+	});
+}

substrate/frame/membership/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "pallet-membership"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"sr-primitives/std",
+	"rstd/std",
+	"runtime-io/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/membership/src/lib.rs

@@ -0,0 +1,345 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Membership Module
+//!
+//! Allows control of membership of a set of `AccountId`s, useful for managing membership of of a
+//! collective.
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::prelude::*;
+use support::{
+	decl_module, decl_storage, decl_event,
+	traits::{ChangeMembers, InitializeMembers},
+	weights::SimpleDispatchInfo,
+};
+use system::ensure_root;
+use sr_primitives::traits::EnsureOrigin;
+
+pub trait Trait<I=DefaultInstance>: system::Trait {
+	/// The overarching event type.
+	type Event: From<Event<Self, I>> + Into<<Self as system::Trait>::Event>;
+
+	/// Required origin for adding a member (though can always be Root).
+	type AddOrigin: EnsureOrigin<Self::Origin>;
+
+	/// Required origin for removing a member (though can always be Root).
+	type RemoveOrigin: EnsureOrigin<Self::Origin>;
+
+	/// Required origin for adding and removing a member in a single action.
+	type SwapOrigin: EnsureOrigin<Self::Origin>;
+
+	/// Required origin for resetting membership.
+	type ResetOrigin: EnsureOrigin<Self::Origin>;
+
+	/// The receiver of the signal for when the membership has been initialized. This happens pre-
+	/// genesis and will usually be the same as `MembershipChanged`. If you need to do something
+	/// different on initialization, then you can change this accordingly.
+	type MembershipInitialized: InitializeMembers<Self::AccountId>;
+
+	/// The receiver of the signal for when the membership has changed.
+	type MembershipChanged: ChangeMembers<Self::AccountId>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait<I>, I: Instance=DefaultInstance> as Membership {
+		/// The current membership, stored as an ordered Vec.
+		Members get(fn members): Vec<T::AccountId>;
+	}
+	add_extra_genesis {
+		config(members): Vec<T::AccountId>;
+		config(phantom): rstd::marker::PhantomData<I>;
+		build(|config: &Self| {
+			let mut members = config.members.clone();
+			members.sort();
+			T::MembershipInitialized::initialize_members(&members);
+			<Members<T, I>>::put(members);
+		})
+	}
+}
+
+decl_event!(
+	pub enum Event<T, I=DefaultInstance> where
+		<T as system::Trait>::AccountId,
+		<T as Trait<I>>::Event,
+	{
+		/// The given member was added; see the transaction for who.
+		MemberAdded,
+		/// The given member was removed; see the transaction for who.
+		MemberRemoved,
+		/// Two members were swapped; see the transaction for who.
+		MembersSwapped,
+		/// The membership was reset; see the transaction for who the new set is.
+		MembersReset,
+		/// Phantom member, never used.
+		Dummy(rstd::marker::PhantomData<(AccountId, Event)>),
+	}
+);
+
+decl_module! {
+	pub struct Module<T: Trait<I>, I: Instance=DefaultInstance>
+		for enum Call
+		where origin: T::Origin
+	{
+		fn deposit_event() = default;
+
+		/// Add a member `who` to the set.
+		///
+		/// May only be called from `AddOrigin` or root.
+		#[weight = SimpleDispatchInfo::FixedNormal(50_000)]
+		fn add_member(origin, who: T::AccountId) {
+			T::AddOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let mut members = <Members<T, I>>::get();
+			let location = members.binary_search(&who).err().ok_or("already a member")?;
+			members.insert(location, who.clone());
+			<Members<T, I>>::put(&members);
+
+			T::MembershipChanged::change_members_sorted(&[who], &[], &members[..]);
+
+			Self::deposit_event(RawEvent::MemberAdded);
+		}
+
+		/// Remove a member `who` from the set.
+		///
+		/// May only be called from `RemoveOrigin` or root.
+		#[weight = SimpleDispatchInfo::FixedNormal(50_000)]
+		fn remove_member(origin, who: T::AccountId) {
+			T::RemoveOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let mut members = <Members<T, I>>::get();
+			let location = members.binary_search(&who).ok().ok_or("not a member")?;
+			members.remove(location);
+			<Members<T, I>>::put(&members);
+
+			T::MembershipChanged::change_members_sorted(&[], &[who], &members[..]);
+
+			Self::deposit_event(RawEvent::MemberRemoved);
+		}
+
+		/// Swap out one member `remove` for another `add`.
+		///
+		/// May only be called from `SwapOrigin` or root.
+		#[weight = SimpleDispatchInfo::FixedNormal(50_000)]
+		fn swap_member(origin, remove: T::AccountId, add: T::AccountId) {
+			T::SwapOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			if remove == add { return Ok(()) }
+
+			let mut members = <Members<T, I>>::get();
+			let location = members.binary_search(&remove).ok().ok_or("not a member")?;
+			members[location] = add.clone();
+			let _location = members.binary_search(&add).err().ok_or("already a member")?;
+			members.sort();
+			<Members<T, I>>::put(&members);
+
+			T::MembershipChanged::change_members_sorted(
+				&[add],
+				&[remove],
+				&members[..],
+			);
+
+			Self::deposit_event(RawEvent::MembersSwapped);
+		}
+
+		/// Change the membership to a new set, disregarding the existing membership. Be nice and
+		/// pass `members` pre-sorted.
+		///
+		/// May only be called from `ResetOrigin` or root.
+		#[weight = SimpleDispatchInfo::FixedNormal(50_000)]
+		fn reset_members(origin, members: Vec<T::AccountId>) {
+			T::ResetOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let mut members = members;
+			members.sort();
+			<Members<T, I>>::mutate(|m| {
+				T::MembershipChanged::set_members_sorted(&members[..], m);
+				*m = members;
+			});
+
+			Self::deposit_event(RawEvent::MembersReset);
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	use std::cell::RefCell;
+	use support::{assert_ok, assert_noop, impl_outer_origin, parameter_types};
+	use primitives::H256;
+	// The testing primitives are very useful for avoiding having to work with signatures
+	// or public keys. `u64` is used as the `AccountId` and no `Signature`s are requried.
+	use sr_primitives::{Perbill, traits::{BlakeTwo256, IdentityLookup}, testing::Header};
+	use system::EnsureSignedBy;
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	// For testing the module, we construct most of a mock runtime. This means
+	// first constructing a configuration type (`Test`) which `impl`s each of the
+	// configuration traits of modules we want to use.
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Hash = H256;
+		type Call = ();
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type MaximumBlockLength = MaximumBlockLength;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type Version = ();
+	}
+	parameter_types! {
+		pub const One: u64 = 1;
+		pub const Two: u64 = 2;
+		pub const Three: u64 = 3;
+		pub const Four: u64 = 4;
+		pub const Five: u64 = 5;
+	}
+
+	thread_local! {
+		static MEMBERS: RefCell<Vec<u64>> = RefCell::new(vec![]);
+	}
+
+	pub struct TestChangeMembers;
+	impl ChangeMembers<u64> for TestChangeMembers {
+		fn change_members_sorted(incoming: &[u64], outgoing: &[u64], new: &[u64]) {
+			let mut old_plus_incoming = MEMBERS.with(|m| m.borrow().to_vec());
+			old_plus_incoming.extend_from_slice(incoming);
+			old_plus_incoming.sort();
+			let mut new_plus_outgoing = new.to_vec();
+			new_plus_outgoing.extend_from_slice(outgoing);
+			new_plus_outgoing.sort();
+			assert_eq!(old_plus_incoming, new_plus_outgoing);
+
+			MEMBERS.with(|m| *m.borrow_mut() = new.to_vec());
+		}
+	}
+	impl InitializeMembers<u64> for TestChangeMembers {
+		fn initialize_members(members: &[u64]) {
+			MEMBERS.with(|m| *m.borrow_mut() = members.to_vec());
+		}
+	}
+
+	impl Trait for Test {
+		type Event = ();
+		type AddOrigin = EnsureSignedBy<One, u64>;
+		type RemoveOrigin = EnsureSignedBy<Two, u64>;
+		type SwapOrigin = EnsureSignedBy<Three, u64>;
+		type ResetOrigin = EnsureSignedBy<Four, u64>;
+		type MembershipInitialized = TestChangeMembers;
+		type MembershipChanged = TestChangeMembers;
+	}
+
+	type Membership = Module<Test>;
+
+	// This function basically just builds a genesis storage key/value store according to
+	// our desired mockup.
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		// We use default for brevity, but you can configure as desired if needed.
+		GenesisConfig::<Test>{
+			members: vec![10, 20, 30],
+			.. Default::default()
+		}.assimilate_storage(&mut t).unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn query_membership_works() {
+		new_test_ext().execute_with(|| {
+			assert_eq!(Membership::members(), vec![10, 20, 30]);
+			assert_eq!(MEMBERS.with(|m| m.borrow().clone()), vec![10, 20, 30]);
+		});
+	}
+
+	#[test]
+	fn add_member_works() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(Membership::add_member(Origin::signed(5), 15), "bad origin");
+			assert_noop!(Membership::add_member(Origin::signed(1), 10), "already a member");
+			assert_ok!(Membership::add_member(Origin::signed(1), 15));
+			assert_eq!(Membership::members(), vec![10, 15, 20, 30]);
+			assert_eq!(MEMBERS.with(|m| m.borrow().clone()), Membership::members());
+		});
+	}
+
+	#[test]
+	fn remove_member_works() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(Membership::remove_member(Origin::signed(5), 20), "bad origin");
+			assert_noop!(Membership::remove_member(Origin::signed(2), 15), "not a member");
+			assert_ok!(Membership::remove_member(Origin::signed(2), 20));
+			assert_eq!(Membership::members(), vec![10, 30]);
+			assert_eq!(MEMBERS.with(|m| m.borrow().clone()), Membership::members());
+		});
+	}
+
+	#[test]
+	fn swap_member_works() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(Membership::swap_member(Origin::signed(5), 10, 25), "bad origin");
+			assert_noop!(Membership::swap_member(Origin::signed(3), 15, 25), "not a member");
+			assert_noop!(Membership::swap_member(Origin::signed(3), 10, 30), "already a member");
+			assert_ok!(Membership::swap_member(Origin::signed(3), 20, 20));
+			assert_eq!(Membership::members(), vec![10, 20, 30]);
+			assert_ok!(Membership::swap_member(Origin::signed(3), 10, 25));
+			assert_eq!(Membership::members(), vec![20, 25, 30]);
+			assert_eq!(MEMBERS.with(|m| m.borrow().clone()), Membership::members());
+		});
+	}
+
+	#[test]
+	fn reset_members_works() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(Membership::reset_members(Origin::signed(1), vec![20, 40, 30]), "bad origin");
+			assert_ok!(Membership::reset_members(Origin::signed(4), vec![20, 40, 30]));
+			assert_eq!(Membership::members(), vec![20, 30, 40]);
+			assert_eq!(MEMBERS.with(|m| m.borrow().clone()), Membership::members());
+		});
+	}
+}

substrate/frame/metadata/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "frame-metadata"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+primitives = { package = "substrate-primitives", path = "../../primitives/core", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"codec/std",
+	"rstd/std",
+	"primitives/std",
+	"serde",
+]

substrate/frame/metadata/src/lib.rs

@@ -0,0 +1,402 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Decodable variant of the RuntimeMetadata.
+//!
+//! This really doesn't belong here, but is necessary for the moment. In the future
+//! it should be removed entirely to an external module for shimming on to the
+//! codec-encoded metadata.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+#[cfg(feature = "std")]
+use serde::Serialize;
+#[cfg(feature = "std")]
+use codec::{Decode, Input, Error};
+use codec::{Encode, Output};
+use rstd::vec::Vec;
+use primitives::RuntimeDebug;
+
+#[cfg(feature = "std")]
+type StringBuf = String;
+
+/// Curent prefix of metadata
+pub const META_RESERVED: u32 = 0x6174656d; // 'meta' warn endianness
+
+/// On `no_std` we do not support `Decode` and thus `StringBuf` is just `&'static str`.
+/// So, if someone tries to decode this stuff on `no_std`, they will get a compilation error.
+#[cfg(not(feature = "std"))]
+type StringBuf = &'static str;
+
+/// A type that decodes to a different type than it encodes.
+/// The user needs to make sure that both types use the same encoding.
+///
+/// For example a `&'static [ &'static str ]` can be decoded to a `Vec<String>`.
+#[derive(Clone)]
+pub enum DecodeDifferent<B, O> where B: 'static, O: 'static {
+	Encode(B),
+	Decoded(O),
+}
+
+impl<B, O> Encode for DecodeDifferent<B, O> where B: Encode + 'static, O: Encode + 'static {
+	fn encode_to<W: Output>(&self, dest: &mut W) {
+		match self {
+			DecodeDifferent::Encode(b) => b.encode_to(dest),
+			DecodeDifferent::Decoded(o) => o.encode_to(dest),
+		}
+	}
+}
+
+impl<B, O> codec::EncodeLike for DecodeDifferent<B, O> where B: Encode + 'static, O: Encode + 'static {}
+
+#[cfg(feature = "std")]
+impl<B, O> Decode for DecodeDifferent<B, O> where B: 'static, O: Decode + 'static {
+	fn decode<I: Input>(input: &mut I) -> Result<Self, Error> {
+		<O>::decode(input).map(|val| {
+			DecodeDifferent::Decoded(val)
+		})
+	}
+}
+
+impl<B, O> PartialEq for DecodeDifferent<B, O>
+where
+	B: Encode + Eq + PartialEq + 'static,
+	O: Encode + Eq + PartialEq + 'static,
+{
+	fn eq(&self, other: &Self) -> bool {
+		self.encode() == other.encode()
+	}
+}
+
+impl<B, O> Eq for DecodeDifferent<B, O>
+	where B: Encode + Eq + PartialEq + 'static, O: Encode + Eq + PartialEq + 'static
+{}
+
+impl<B, O> rstd::fmt::Debug for DecodeDifferent<B, O>
+	where
+		B: rstd::fmt::Debug + Eq + 'static,
+		O: rstd::fmt::Debug + Eq + 'static,
+{
+	fn fmt(&self, f: &mut rstd::fmt::Formatter) -> rstd::fmt::Result {
+		match self {
+			DecodeDifferent::Encode(b) => b.fmt(f),
+			DecodeDifferent::Decoded(o) => o.fmt(f),
+		}
+	}
+}
+
+#[cfg(feature = "std")]
+impl<B, O> serde::Serialize for DecodeDifferent<B, O>
+	where
+		B: serde::Serialize + 'static,
+		O: serde::Serialize + 'static,
+{
+	fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: serde::Serializer {
+		match self {
+			DecodeDifferent::Encode(b) => b.serialize(serializer),
+			DecodeDifferent::Decoded(o) => o.serialize(serializer),
+		}
+	}
+}
+
+pub type DecodeDifferentArray<B, O=B> = DecodeDifferent<&'static [B], Vec<O>>;
+
+type DecodeDifferentStr = DecodeDifferent<&'static str, StringBuf>;
+
+/// All the metadata about a function.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct FunctionMetadata {
+	pub name: DecodeDifferentStr,
+	pub arguments: DecodeDifferentArray<FunctionArgumentMetadata>,
+	pub documentation: DecodeDifferentArray<&'static str, StringBuf>,
+}
+
+/// All the metadata about a function argument.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct FunctionArgumentMetadata {
+	pub name: DecodeDifferentStr,
+	pub ty: DecodeDifferentStr,
+}
+
+/// Newtype wrapper for support encoding functions (actual the result of the function).
+#[derive(Clone, Eq)]
+pub struct FnEncode<E>(pub fn() -> E) where E: Encode + 'static;
+
+impl<E: Encode> Encode for FnEncode<E> {
+	fn encode_to<W: Output>(&self, dest: &mut W) {
+		self.0().encode_to(dest);
+	}
+}
+
+impl<E: Encode> codec::EncodeLike for FnEncode<E> {}
+
+impl<E: Encode + PartialEq> PartialEq for FnEncode<E> {
+	fn eq(&self, other: &Self) -> bool {
+		self.0().eq(&other.0())
+	}
+}
+
+impl<E: Encode + rstd::fmt::Debug> rstd::fmt::Debug for FnEncode<E> {
+	fn fmt(&self, f: &mut rstd::fmt::Formatter) -> rstd::fmt::Result {
+		self.0().fmt(f)
+	}
+}
+
+#[cfg(feature = "std")]
+impl<E: Encode + serde::Serialize> serde::Serialize for FnEncode<E> {
+	fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: serde::Serializer {
+		self.0().serialize(serializer)
+	}
+}
+
+/// All the metadata about an outer event.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct OuterEventMetadata {
+	pub name: DecodeDifferentStr,
+	pub events: DecodeDifferentArray<
+		(&'static str, FnEncode<&'static [EventMetadata]>),
+		(StringBuf, Vec<EventMetadata>)
+	>,
+}
+
+/// All the metadata about an event.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct EventMetadata {
+	pub name: DecodeDifferentStr,
+	pub arguments: DecodeDifferentArray<&'static str, StringBuf>,
+	pub documentation: DecodeDifferentArray<&'static str, StringBuf>,
+}
+
+/// All the metadata about one storage entry.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct StorageEntryMetadata {
+	pub name: DecodeDifferentStr,
+	pub modifier: StorageEntryModifier,
+	pub ty: StorageEntryType,
+	pub default: ByteGetter,
+	pub documentation: DecodeDifferentArray<&'static str, StringBuf>,
+}
+
+/// All the metadata about one module constant.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct ModuleConstantMetadata {
+	pub name: DecodeDifferentStr,
+	pub ty: DecodeDifferentStr,
+	pub value: ByteGetter,
+	pub documentation: DecodeDifferentArray<&'static str, StringBuf>,
+}
+
+/// All the metadata about a module error.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct ErrorMetadata {
+	pub name: DecodeDifferentStr,
+	pub documentation: DecodeDifferentArray<&'static str, StringBuf>,
+}
+
+/// All the metadata about errors in a module.
+pub trait ModuleErrorMetadata {
+	fn metadata() -> &'static [ErrorMetadata];
+}
+
+impl ModuleErrorMetadata for &'static str {
+	fn metadata() -> &'static [ErrorMetadata] {
+		&[]
+	}
+}
+
+/// A technical trait to store lazy initiated vec value as static dyn pointer.
+pub trait DefaultByte: Send + Sync {
+	fn default_byte(&self) -> Vec<u8>;
+}
+
+/// Wrapper over dyn pointer for accessing a cached once byte value.
+#[derive(Clone)]
+pub struct DefaultByteGetter(pub &'static dyn DefaultByte);
+
+/// Decode different for static lazy initiated byte value.
+pub type ByteGetter = DecodeDifferent<DefaultByteGetter, Vec<u8>>;
+
+impl Encode for DefaultByteGetter {
+	fn encode_to<W: Output>(&self, dest: &mut W) {
+		self.0.default_byte().encode_to(dest)
+	}
+}
+
+impl codec::EncodeLike for DefaultByteGetter {}
+
+impl PartialEq<DefaultByteGetter> for DefaultByteGetter {
+	fn eq(&self, other: &DefaultByteGetter) -> bool {
+		let left = self.0.default_byte();
+		let right = other.0.default_byte();
+		left.eq(&right)
+	}
+}
+
+impl Eq for DefaultByteGetter { }
+
+#[cfg(feature = "std")]
+impl serde::Serialize for DefaultByteGetter {
+	fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error> where S: serde::Serializer {
+		self.0.default_byte().serialize(serializer)
+	}
+}
+
+impl rstd::fmt::Debug for DefaultByteGetter {
+	fn fmt(&self, f: &mut rstd::fmt::Formatter) -> rstd::fmt::Result {
+		self.0.default_byte().fmt(f)
+	}
+}
+
+/// Hasher used by storage maps
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub enum StorageHasher {
+	Blake2_128,
+	Blake2_256,
+	Twox128,
+	Twox256,
+	Twox64Concat,
+}
+
+/// A storage entry type.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub enum StorageEntryType {
+	Plain(DecodeDifferentStr),
+	Map {
+		hasher: StorageHasher,
+		key: DecodeDifferentStr,
+		value: DecodeDifferentStr,
+		is_linked: bool,
+	},
+	DoubleMap {
+		hasher: StorageHasher,
+		key1: DecodeDifferentStr,
+		key2: DecodeDifferentStr,
+		value: DecodeDifferentStr,
+		key2_hasher: StorageHasher,
+	},
+}
+
+/// A storage entry modifier.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub enum StorageEntryModifier {
+	Optional,
+	Default,
+}
+
+/// All metadata of the storage.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct StorageMetadata {
+	/// The common prefix used by all storage entries.
+	pub prefix: DecodeDifferent<&'static str, StringBuf>,
+	pub entries: DecodeDifferent<&'static [StorageEntryMetadata], Vec<StorageEntryMetadata>>,
+}
+
+#[derive(Eq, Encode, PartialEq, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+/// Metadata prefixed by a u32 for reserved usage
+pub struct RuntimeMetadataPrefixed(pub u32, pub RuntimeMetadata);
+
+/// The metadata of a runtime.
+/// The version ID encoded/decoded through
+/// the enum nature of `RuntimeMetadata`.
+#[derive(Eq, Encode, PartialEq, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub enum RuntimeMetadata {
+	/// Unused; enum filler.
+	V0(RuntimeMetadataDeprecated),
+	/// Version 1 for runtime metadata. No longer used.
+	V1(RuntimeMetadataDeprecated),
+	/// Version 2 for runtime metadata. No longer used.
+	V2(RuntimeMetadataDeprecated),
+	/// Version 3 for runtime metadata. No longer used.
+	V3(RuntimeMetadataDeprecated),
+	/// Version 4 for runtime metadata. No longer used.
+	V4(RuntimeMetadataDeprecated),
+	/// Version 5 for runtime metadata. No longer used.
+	V5(RuntimeMetadataDeprecated),
+	/// Version 6 for runtime metadata. No longer used.
+	V6(RuntimeMetadataDeprecated),
+	/// Version 7 for runtime metadata. No longer used.
+	V7(RuntimeMetadataDeprecated),
+	/// Version 8 for runtime metadata.
+	V8(RuntimeMetadataV8),
+}
+
+/// Enum that should fail.
+#[derive(Eq, PartialEq, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Serialize))]
+pub enum RuntimeMetadataDeprecated { }
+
+impl Encode for RuntimeMetadataDeprecated {
+	fn encode_to<W: Output>(&self, _dest: &mut W) {}
+}
+
+impl codec::EncodeLike for RuntimeMetadataDeprecated {}
+
+#[cfg(feature = "std")]
+impl Decode for RuntimeMetadataDeprecated {
+	fn decode<I: Input>(_input: &mut I) -> Result<Self, Error> {
+		Err("Decoding is not supported".into())
+	}
+}
+
+/// The metadata of a runtime.
+#[derive(Eq, Encode, PartialEq, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct RuntimeMetadataV8 {
+	pub modules: DecodeDifferentArray<ModuleMetadata>,
+}
+
+/// The latest version of the metadata.
+pub type RuntimeMetadataLastVersion = RuntimeMetadataV8;
+
+/// All metadata about an runtime module.
+#[derive(Clone, PartialEq, Eq, Encode, RuntimeDebug)]
+#[cfg_attr(feature = "std", derive(Decode, Serialize))]
+pub struct ModuleMetadata {
+	pub name: DecodeDifferentStr,
+	pub storage: Option<DecodeDifferent<FnEncode<StorageMetadata>, StorageMetadata>>,
+	pub calls: ODFnA<FunctionMetadata>,
+	pub event: ODFnA<EventMetadata>,
+	pub constants: DFnA<ModuleConstantMetadata>,
+	pub errors: DFnA<ErrorMetadata>,
+}
+
+type ODFnA<T> = Option<DFnA<T>>;
+type DFnA<T> = DecodeDifferent<FnEncode<&'static [T]>, Vec<T>>;
+
+impl Into<primitives::OpaqueMetadata> for RuntimeMetadataPrefixed {
+	fn into(self) -> primitives::OpaqueMetadata {
+		primitives::OpaqueMetadata::new(self.encode())
+	}
+}
+
+impl Into<RuntimeMetadataPrefixed> for RuntimeMetadataLastVersion {
+	fn into(self) -> RuntimeMetadataPrefixed {
+		RuntimeMetadataPrefixed(META_RESERVED, RuntimeMetadata::V8(self))
+	}
+}

substrate/frame/nicks/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "pallet-nicks"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+balances = { package = "pallet-balances", path = "../balances", default-features = false }
+
+[features]
+default = ["std"]
+std = [
+	"serde",
+	"codec/std",
+	"rstd/std",
+	"runtime-io/std",
+	"sr-primitives/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/nicks/src/lib.rs

@@ -0,0 +1,385 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Nicks Module
+//!
+//! - [`nicks::Trait`](./trait.Trait.html)
+//! - [`Call`](./enum.Call.html)
+//!
+//! ## Overview
+//!
+//! Nicks is a trivial module for keeping track of account names on-chain. It makes no effort to
+//! create a name hierarchy, be a DNS replacement or provide reverse lookups.
+//!
+//! ## Interface
+//!
+//! ### Dispatchable Functions
+//!
+//! * `set_name` - Set the associated name of an account; a small deposit is reserved if not already
+//!   taken.
+//! * `clear_name` - Remove an account's associated name; the deposit is returned.
+//! * `kill_name` - Forcibly remove the associated name; the deposit is lost.
+//!
+//! [`Call`]: ./enum.Call.html
+//! [`Trait`]: ./trait.Trait.html
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::prelude::*;
+use sr_primitives::{
+	traits::{StaticLookup, EnsureOrigin, Zero}
+};
+use support::{
+	decl_module, decl_event, decl_storage, ensure,
+	traits::{Currency, ReservableCurrency, OnUnbalanced, Get},
+	weights::SimpleDispatchInfo,
+};
+use system::{ensure_signed, ensure_root};
+
+type BalanceOf<T> = <<T as Trait>::Currency as Currency<<T as system::Trait>::AccountId>>::Balance;
+type NegativeImbalanceOf<T> = <<T as Trait>::Currency as Currency<<T as system::Trait>::AccountId>>::NegativeImbalance;
+
+pub trait Trait: system::Trait {
+	/// The overarching event type.
+	type Event: From<Event<Self>> + Into<<Self as system::Trait>::Event>;
+
+	/// The currency trait.
+	type Currency: ReservableCurrency<Self::AccountId>;
+
+	/// Reservation fee.
+	type ReservationFee: Get<BalanceOf<Self>>;
+
+	/// What to do with slashed funds.
+	type Slashed: OnUnbalanced<NegativeImbalanceOf<Self>>;
+
+	/// The origin which may forcibly set or remove a name. Root can always do this.
+	type ForceOrigin: EnsureOrigin<Self::Origin>;
+
+	/// The minimum length a name may be.
+	type MinLength: Get<usize>;
+
+	/// The maximum length a name may be.
+	type MaxLength: Get<usize>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Sudo {
+		/// The lookup table for names.
+		NameOf: map T::AccountId => Option<(Vec<u8>, BalanceOf<T>)>;
+	}
+}
+
+decl_event!(
+	pub enum Event<T> where AccountId = <T as system::Trait>::AccountId, Balance = BalanceOf<T> {
+		/// A name was set.
+		NameSet(AccountId),
+		/// A name was forcibly set.
+		NameForced(AccountId),
+		/// A name was changed.
+		NameChanged(AccountId),
+		/// A name was cleared, and the given balance returned.
+		NameCleared(AccountId, Balance),
+		/// A name was removed and the given balance slashed.
+		NameKilled(AccountId, Balance),
+	}
+);
+
+decl_module! {
+	// Simple declaration of the `Module` type. Lets the macro know what it's working on.
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+
+		/// Reservation fee.
+		const ReservationFee: BalanceOf<T> = T::ReservationFee::get();
+
+		/// The minimum length a name may be.
+		const MinLength: u32 = T::MinLength::get() as u32;
+
+		/// The maximum length a name may be.
+		const MaxLength: u32 = T::MaxLength::get() as u32;
+
+		/// Set an account's name. The name should be a UTF-8-encoded string by convention, though
+		/// we don't check it.
+		///
+		/// The name may not be more than `T::MaxLength` bytes, nor less than `T::MinLength` bytes.
+		///
+		/// If the account doesn't already have a name, then a fee of `ReservationFee` is reserved
+		/// in the account.
+		///
+		/// The dispatch origin for this call must be _Signed_.
+		///
+		/// # <weight>
+		/// - O(1).
+		/// - At most one balance operation.
+		/// - One storage read/write.
+		/// - One event.
+		/// # </weight>
+		#[weight = SimpleDispatchInfo::FixedNormal(50_000)]
+		fn set_name(origin, name: Vec<u8>) {
+			let sender = ensure_signed(origin)?;
+
+			ensure!(name.len() >= T::MinLength::get(), "Name too short");
+			ensure!(name.len() <= T::MaxLength::get(), "Name too long");
+
+			let deposit = if let Some((_, deposit)) = <NameOf<T>>::get(&sender) {
+				Self::deposit_event(RawEvent::NameSet(sender.clone()));
+				deposit
+			} else {
+				let deposit = T::ReservationFee::get();
+				T::Currency::reserve(&sender, deposit.clone())?;
+				Self::deposit_event(RawEvent::NameChanged(sender.clone()));
+				deposit
+			};
+
+			<NameOf<T>>::insert(&sender, (name, deposit));
+		}
+
+		/// Clear an account's name and return the deposit. Fails if the account was not named.
+		///
+		/// The dispatch origin for this call must be _Signed_.
+		///
+		/// # <weight>
+		/// - O(1).
+		/// - One balance operation.
+		/// - One storage read/write.
+		/// - One event.
+		/// # </weight>
+		fn clear_name(origin) {
+			let sender = ensure_signed(origin)?;
+
+			let deposit = <NameOf<T>>::take(&sender).ok_or("Not named")?.1;
+
+			let _ = T::Currency::unreserve(&sender, deposit.clone());
+
+			Self::deposit_event(RawEvent::NameCleared(sender, deposit));
+		}
+
+		/// Remove an account's name and take charge of the deposit.
+		///
+		/// Fails if `who` has not been named. The deposit is dealt with through `T::Slashed`
+		/// imbalance handler.
+		///
+		/// The dispatch origin for this call must be _Root_ or match `T::ForceOrigin`.
+		///
+		/// # <weight>
+		/// - O(1).
+		/// - One unbalanced handler (probably a balance transfer)
+		/// - One storage read/write.
+		/// - One event.
+		/// # </weight>
+		#[weight = SimpleDispatchInfo::FreeOperational]
+		fn kill_name(origin, target: <T::Lookup as StaticLookup>::Source) {
+			T::ForceOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			// Figure out who we're meant to be clearing.
+			let target = T::Lookup::lookup(target)?;
+			// Grab their deposit (and check that they have one).
+			let deposit = <NameOf<T>>::take(&target).ok_or("Not named")?.1;
+			// Slash their deposit from them.
+			T::Slashed::on_unbalanced(T::Currency::slash_reserved(&target, deposit.clone()).0);
+
+			Self::deposit_event(RawEvent::NameKilled(target, deposit));
+		}
+
+		/// Set a third-party account's name with no deposit.
+		///
+		/// No length checking is done on the name.
+		///
+		/// The dispatch origin for this call must be _Root_ or match `T::ForceOrigin`.
+		///
+		/// # <weight>
+		/// - O(1).
+		/// - At most one balance operation.
+		/// - One storage read/write.
+		/// - One event.
+		/// # </weight>
+		#[weight = SimpleDispatchInfo::FreeOperational]
+		fn force_name(origin, target: <T::Lookup as StaticLookup>::Source, name: Vec<u8>) {
+			T::ForceOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let target = T::Lookup::lookup(target)?;
+			let deposit = <NameOf<T>>::get(&target).map(|x| x.1).unwrap_or_else(Zero::zero);
+			<NameOf<T>>::insert(&target, (name, deposit));
+
+			Self::deposit_event(RawEvent::NameForced(target));
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+
+	use support::{assert_ok, assert_noop, impl_outer_origin, parameter_types};
+	use primitives::H256;
+	use system::EnsureSignedBy;
+	// The testing primitives are very useful for avoiding having to work with signatures
+	// or public keys. `u64` is used as the `AccountId` and no `Signature`s are required.
+	use sr_primitives::{
+		Perbill, testing::Header, traits::{BlakeTwo256, IdentityLookup},
+	};
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	// For testing the module, we construct most of a mock runtime. This means
+	// first constructing a configuration type (`Test`) which `impl`s each of the
+	// configuration traits of modules we want to use.
+	#[derive(Clone, Eq, PartialEq)]
+	pub struct Test;
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Hash = H256;
+		type Call = ();
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type MaximumBlockLength = MaximumBlockLength;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type Version = ();
+	}
+	parameter_types! {
+		pub const ExistentialDeposit: u64 = 0;
+		pub const TransferFee: u64 = 0;
+		pub const CreationFee: u64 = 0;
+	}
+	impl balances::Trait for Test {
+		type Balance = u64;
+		type OnFreeBalanceZero = ();
+		type OnNewAccount = ();
+		type Event = ();
+		type TransferPayment = ();
+		type DustRemoval = ();
+		type ExistentialDeposit = ExistentialDeposit;
+		type TransferFee = TransferFee;
+		type CreationFee = CreationFee;
+	}
+	parameter_types! {
+		pub const ReservationFee: u64 = 2;
+		pub const MinLength: usize = 3;
+		pub const MaxLength: usize = 16;
+		pub const One: u64 = 1;
+	}
+	impl Trait for Test {
+		type Event = ();
+		type Currency = Balances;
+		type ReservationFee = ReservationFee;
+		type Slashed = ();
+		type ForceOrigin = EnsureSignedBy<One, u64>;
+		type MinLength = MinLength;
+		type MaxLength = MaxLength;
+	}
+	type Balances = balances::Module<Test>;
+	type Nicks = Module<Test>;
+
+	// This function basically just builds a genesis storage key/value store according to
+	// our desired mockup.
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		// We use default for brevity, but you can configure as desired if needed.
+		balances::GenesisConfig::<Test> {
+			balances: vec![
+				(1, 10),
+				(2, 10),
+			],
+			vesting: vec![],
+		}.assimilate_storage(&mut t).unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn kill_name_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Nicks::set_name(Origin::signed(2), b"Dave".to_vec()));
+			assert_eq!(Balances::total_balance(&2), 10);
+			assert_ok!(Nicks::kill_name(Origin::signed(1), 2));
+			assert_eq!(Balances::total_balance(&2), 8);
+			assert_eq!(<NameOf<Test>>::get(2), None);
+		});
+	}
+
+	#[test]
+	fn force_name_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(
+				Nicks::set_name(Origin::signed(2), b"Dr. David Brubeck, III".to_vec()),
+				"Name too long"
+			);
+
+			assert_ok!(Nicks::set_name(Origin::signed(2), b"Dave".to_vec()));
+			assert_eq!(Balances::reserved_balance(&2), 2);
+			assert_ok!(Nicks::force_name(Origin::signed(1), 2, b"Dr. David Brubeck, III".to_vec()));
+			assert_eq!(Balances::reserved_balance(&2), 2);
+			assert_eq!(<NameOf<Test>>::get(2).unwrap(), (b"Dr. David Brubeck, III".to_vec(), 2));
+		});
+	}
+
+	#[test]
+	fn normal_operation_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_ok!(Nicks::set_name(Origin::signed(1), b"Gav".to_vec()));
+			assert_eq!(Balances::reserved_balance(&1), 2);
+			assert_eq!(Balances::free_balance(&1), 8);
+			assert_eq!(<NameOf<Test>>::get(1).unwrap().0, b"Gav".to_vec());
+
+			assert_ok!(Nicks::set_name(Origin::signed(1), b"Gavin".to_vec()));
+			assert_eq!(Balances::reserved_balance(&1), 2);
+			assert_eq!(Balances::free_balance(&1), 8);
+			assert_eq!(<NameOf<Test>>::get(1).unwrap().0, b"Gavin".to_vec());
+
+			assert_ok!(Nicks::clear_name(Origin::signed(1)));
+			assert_eq!(Balances::reserved_balance(&1), 0);
+			assert_eq!(Balances::free_balance(&1), 10);
+		});
+	}
+
+	#[test]
+	fn error_catching_should_work() {
+		new_test_ext().execute_with(|| {
+			assert_noop!(Nicks::clear_name(Origin::signed(1)), "Not named");
+
+			assert_noop!(Nicks::set_name(Origin::signed(3), b"Dave".to_vec()), "not enough free funds");
+
+			assert_noop!(Nicks::set_name(Origin::signed(1), b"Ga".to_vec()), "Name too short");
+			assert_noop!(
+				Nicks::set_name(Origin::signed(1), b"Gavin James Wood, Esquire".to_vec()),
+				"Name too long"
+			);
+			assert_ok!(Nicks::set_name(Origin::signed(1), b"Dave".to_vec()));
+			assert_noop!(Nicks::kill_name(Origin::signed(2), 1), "bad origin");
+			assert_noop!(Nicks::force_name(Origin::signed(2), 1, b"Whatever".to_vec()), "bad origin");
+		});
+	}
+}

substrate/frame/offences/Cargo.toml

@@ -0,0 +1,32 @@
+[package]
+name = "pallet-offences"
+version = "1.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+balances = { package = "pallet-balances", path = "../balances", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+serde = { version = "1.0.101", optional = true }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io" }
+substrate-primitives = { path = "../../primitives/core" }
+
+[features]
+default = ["std"]
+std = [
+	"balances/std",
+	"codec/std",
+	"rstd/std",
+	"serde",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/offences/src/lib.rs

@@ -0,0 +1,279 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Offences Module
+//!
+//! Tracks reported offences
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+mod mock;
+mod tests;
+
+use rstd::{
+	vec::Vec,
+	collections::btree_set::BTreeSet,
+};
+use support::{
+	decl_module, decl_event, decl_storage, Parameter,
+};
+use sr_primitives::{
+	Perbill,
+	traits::{Hash, Saturating},
+};
+use sr_staking_primitives::{
+	offence::{Offence, ReportOffence, Kind, OnOffenceHandler, OffenceDetails},
+};
+use codec::{Encode, Decode};
+
+/// A binary blob which represents a SCALE codec-encoded `O::TimeSlot`.
+type OpaqueTimeSlot = Vec<u8>;
+
+/// A type alias for a report identifier.
+type ReportIdOf<T> = <T as system::Trait>::Hash;
+
+/// Offences trait
+pub trait Trait: system::Trait {
+	/// The overarching event type.
+	type Event: From<Event> + Into<<Self as system::Trait>::Event>;
+	/// Full identification of the validator.
+	type IdentificationTuple: Parameter + Ord;
+	/// A handler called for every offence report.
+	type OnOffenceHandler: OnOffenceHandler<Self::AccountId, Self::IdentificationTuple>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Offences {
+		/// The primary structure that holds all offence records keyed by report identifiers.
+		Reports get(fn reports): map ReportIdOf<T> => Option<OffenceDetails<T::AccountId, T::IdentificationTuple>>;
+
+		/// A vector of reports of the same kind that happened at the same time slot.
+		ConcurrentReportsIndex: double_map Kind, blake2_256(OpaqueTimeSlot) => Vec<ReportIdOf<T>>;
+
+		/// Enumerates all reports of a kind along with the time they happened.
+		///
+		/// All reports are sorted by the time of offence.
+		///
+		/// Note that the actual type of this mapping is `Vec<u8>`, this is because values of
+		/// different types are not supported at the moment so we are doing the manual serialization.
+		ReportsByKindIndex: map Kind => Vec<u8>; // (O::TimeSlot, ReportIdOf<T>)
+	}
+}
+
+decl_event!(
+	pub enum Event {
+		/// There is an offence reported of the given `kind` happened at the `session_index` and
+		/// (kind-specific) time slot. This event is not deposited for duplicate slashes.
+		Offence(Kind, OpaqueTimeSlot),
+	}
+);
+
+decl_module! {
+	/// Offences module, currently just responsible for taking offence reports.
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn deposit_event() = default;
+	}
+}
+impl<T: Trait, O: Offence<T::IdentificationTuple>>
+	ReportOffence<T::AccountId, T::IdentificationTuple, O> for Module<T>
+where
+	T::IdentificationTuple: Clone,
+{
+	fn report_offence(reporters: Vec<T::AccountId>, offence: O) {
+		let offenders = offence.offenders();
+		let time_slot = offence.time_slot();
+		let validator_set_count = offence.validator_set_count();
+
+		// Go through all offenders in the offence report and find all offenders that was spotted
+		// in unique reports.
+		let TriageOutcome {
+			new_offenders,
+			concurrent_offenders,
+		} = match Self::triage_offence_report::<O>(reporters, &time_slot, offenders) {
+			Some(triage) => triage,
+			// The report contained only duplicates, so there is no need to slash again.
+			None => return,
+		};
+
+		// Deposit the event.
+		Self::deposit_event(Event::Offence(O::ID, time_slot.encode()));
+
+		let offenders_count = concurrent_offenders.len() as u32;
+		let previous_offenders_count = offenders_count - new_offenders.len() as u32;
+
+		// The amount new offenders are slashed
+		let new_fraction = O::slash_fraction(offenders_count, validator_set_count);
+
+		// The amount previous offenders are slashed additionally.
+		//
+		// Since they were slashed in the past, we slash by:
+		// x = (new - prev) / (1 - prev)
+		// because:
+		// Y = X * (1 - prev)
+		// Z = Y * (1 - x)
+		// Z = X * (1 - new)
+		let old_fraction = if previous_offenders_count > 0 {
+			let previous_fraction = O::slash_fraction(
+				offenders_count.saturating_sub(previous_offenders_count),
+				validator_set_count,
+			);
+			let numerator = new_fraction.saturating_sub(previous_fraction);
+			let denominator = Perbill::one().saturating_sub(previous_fraction);
+			denominator.saturating_mul(numerator)
+		} else {
+			new_fraction.clone()
+		};
+
+		// calculate how much to slash
+		let slash_perbill = concurrent_offenders
+			.iter()
+			.map(|details| {
+				if previous_offenders_count > 0 && new_offenders.contains(&details.offender) {
+					new_fraction.clone()
+				} else {
+					old_fraction.clone()
+				}
+			})
+			.collect::<Vec<_>>();
+
+		T::OnOffenceHandler::on_offence(&concurrent_offenders, &slash_perbill);
+	}
+}
+
+impl<T: Trait> Module<T> {
+	/// Compute the ID for the given report properties.
+	///
+	/// The report id depends on the offence kind, time slot and the id of offender.
+	fn report_id<O: Offence<T::IdentificationTuple>>(
+		time_slot: &O::TimeSlot,
+		offender: &T::IdentificationTuple,
+	) -> ReportIdOf<T> {
+		(O::ID, time_slot.encode(), offender).using_encoded(T::Hashing::hash)
+	}
+
+	/// Triages the offence report and returns the set of offenders that was involved in unique
+	/// reports along with the list of the concurrent offences.
+	fn triage_offence_report<O: Offence<T::IdentificationTuple>>(
+		reporters: Vec<T::AccountId>,
+		time_slot: &O::TimeSlot,
+		offenders: Vec<T::IdentificationTuple>,
+	) -> Option<TriageOutcome<T>> {
+		let mut storage = ReportIndexStorage::<T, O>::load(time_slot);
+		let mut new_offenders = BTreeSet::new();
+
+		for offender in offenders {
+			let report_id = Self::report_id::<O>(time_slot, &offender);
+
+			if !<Reports<T>>::exists(&report_id) {
+				new_offenders.insert(offender.clone());
+				<Reports<T>>::insert(
+					&report_id,
+					OffenceDetails {
+						offender,
+						reporters: reporters.clone(),
+					},
+				);
+
+				storage.insert(time_slot, report_id);
+			}
+		}
+
+		if !new_offenders.is_empty() {
+			// Load report details for the all reports happened at the same time.
+			let concurrent_offenders = storage.concurrent_reports
+				.iter()
+				.filter_map(|report_id| <Reports<T>>::get(report_id))
+				.collect::<Vec<_>>();
+
+			storage.save();
+
+			Some(TriageOutcome {
+				new_offenders,
+				concurrent_offenders,
+			})
+		} else {
+			None
+		}
+	}
+}
+
+struct TriageOutcome<T: Trait> {
+	/// Offenders that was spotted in the unique reports.
+	new_offenders: BTreeSet<T::IdentificationTuple>,
+	/// Other reports for the same report kinds.
+	concurrent_offenders: Vec<OffenceDetails<T::AccountId, T::IdentificationTuple>>,
+}
+
+/// An auxilary struct for working with storage of indexes localized for a specific offence
+/// kind (specified by the `O` type parameter).
+///
+/// This struct is responsible for aggregating storage writes and the underlying storage should not
+/// accessed directly meanwhile.
+#[must_use = "The changes are not saved without called `save`"]
+struct ReportIndexStorage<T: Trait, O: Offence<T::IdentificationTuple>> {
+	opaque_time_slot: OpaqueTimeSlot,
+	concurrent_reports: Vec<ReportIdOf<T>>,
+	same_kind_reports: Vec<(O::TimeSlot, ReportIdOf<T>)>,
+}
+
+impl<T: Trait, O: Offence<T::IdentificationTuple>> ReportIndexStorage<T, O> {
+	/// Preload indexes from the storage for the specific `time_slot` and the kind of the offence.
+	fn load(time_slot: &O::TimeSlot) -> Self {
+		let opaque_time_slot = time_slot.encode();
+
+		let same_kind_reports = <ReportsByKindIndex>::get(&O::ID);
+		let same_kind_reports =
+			Vec::<(O::TimeSlot, ReportIdOf<T>)>::decode(&mut &same_kind_reports[..])
+				.unwrap_or_default();
+
+		let concurrent_reports = <ConcurrentReportsIndex<T>>::get(&O::ID, &opaque_time_slot);
+
+		Self {
+			opaque_time_slot,
+			concurrent_reports,
+			same_kind_reports,
+		}
+	}
+
+	/// Insert a new report to the index.
+	fn insert(&mut self, time_slot: &O::TimeSlot, report_id: ReportIdOf<T>) {
+		// Insert the report id into the list while maintaining the ordering by the time
+		// slot.
+		let pos = match self
+			.same_kind_reports
+			.binary_search_by_key(&time_slot, |&(ref when, _)| when)
+		{
+			Ok(pos) => pos,
+			Err(pos) => pos,
+		};
+		self.same_kind_reports
+			.insert(pos, (time_slot.clone(), report_id));
+
+		// Update the list of concurrent reports.
+		self.concurrent_reports.push(report_id);
+	}
+
+	/// Dump the indexes to the storage.
+	fn save(self) {
+		<ReportsByKindIndex>::insert(&O::ID, self.same_kind_reports.encode());
+		<ConcurrentReportsIndex<T>>::insert(
+			&O::ID,
+			&self.opaque_time_slot,
+			&self.concurrent_reports,
+		);
+	}
+}

substrate/frame/offences/src/mock.rs

@@ -0,0 +1,162 @@
+// Copyright 2018-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+#![cfg(test)]
+
+use std::cell::RefCell;
+use crate::{Module, Trait};
+use codec::Encode;
+use sr_primitives::Perbill;
+use sr_staking_primitives::{
+	SessionIndex,
+	offence::{self, Kind, OffenceDetails},
+};
+use sr_primitives::testing::Header;
+use sr_primitives::traits::{IdentityLookup, BlakeTwo256};
+use substrate_primitives::H256;
+use support::{impl_outer_origin, impl_outer_event, parameter_types, StorageMap, StorageDoubleMap};
+use {runtime_io, system};
+
+impl_outer_origin!{
+	pub enum Origin for Runtime {}
+}
+
+pub struct OnOffenceHandler;
+
+thread_local! {
+	pub static ON_OFFENCE_PERBILL: RefCell<Vec<Perbill>> = RefCell::new(Default::default());
+}
+
+impl<Reporter, Offender> offence::OnOffenceHandler<Reporter, Offender> for OnOffenceHandler {
+	fn on_offence(
+		_offenders: &[OffenceDetails<Reporter, Offender>],
+		slash_fraction: &[Perbill],
+	) {
+		ON_OFFENCE_PERBILL.with(|f| {
+			*f.borrow_mut() = slash_fraction.to_vec();
+		});
+	}
+}
+
+pub fn with_on_offence_fractions<R, F: FnOnce(&mut Vec<Perbill>) -> R>(f: F) -> R {
+	ON_OFFENCE_PERBILL.with(|fractions| {
+		f(&mut *fractions.borrow_mut())
+	})
+}
+
+// Workaround for https://github.com/rust-lang/rust/issues/26925 . Remove when sorted.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Runtime;
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+impl system::Trait for Runtime {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = TestEvent;
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+
+impl Trait for Runtime {
+	type Event = TestEvent;
+	type IdentificationTuple = u64;
+	type OnOffenceHandler = OnOffenceHandler;
+}
+
+mod offences {
+	pub use crate::Event;
+}
+
+impl_outer_event! {
+	pub enum TestEvent for Runtime {
+		offences,
+	}
+}
+
+pub fn new_test_ext() -> runtime_io::TestExternalities {
+	let t = system::GenesisConfig::default().build_storage::<Runtime>().unwrap();
+	t.into()
+}
+
+/// Offences module.
+pub type Offences = Module<Runtime>;
+pub type System = system::Module<Runtime>;
+
+pub const KIND: [u8; 16] = *b"test_report_1234";
+
+/// Returns all offence details for the specific `kind` happened at the specific time slot.
+pub fn offence_reports(kind: Kind, time_slot: u128) -> Vec<OffenceDetails<u64, u64>> {
+	<crate::ConcurrentReportsIndex<Runtime>>::get(&kind, &time_slot.encode())
+		.into_iter()
+		.map(|report_id| {
+			<crate::Reports<Runtime>>::get(&report_id)
+				.expect("dangling report id is found in ConcurrentReportsIndex")
+		})
+		.collect()
+}
+
+#[derive(Clone)]
+pub struct Offence<T> {
+	pub validator_set_count: u32,
+	pub offenders: Vec<T>,
+	pub time_slot: u128,
+}
+
+impl<T: Clone> offence::Offence<T> for Offence<T> {
+	const ID: offence::Kind = KIND;
+	type TimeSlot = u128;
+
+	fn offenders(&self) -> Vec<T> {
+		self.offenders.clone()
+	}
+
+	fn validator_set_count(&self) -> u32 {
+		self.validator_set_count
+	}
+
+	fn time_slot(&self) -> u128 {
+		self.time_slot
+	}
+
+	fn session_index(&self) -> SessionIndex {
+		// session index is not used by the pallet-offences directly, but rather it exists only for
+		// filtering historical reports.
+		unimplemented!()
+	}
+
+	fn slash_fraction(
+		offenders_count: u32,
+		validator_set_count: u32,
+	) -> Perbill {
+		Perbill::from_percent(5 + offenders_count * 100 / validator_set_count)
+	}
+}

substrate/frame/offences/src/tests.rs

@@ -0,0 +1,245 @@
+// Copyright 2017-2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the offences module.
+
+#![cfg(test)]
+
+use super::*;
+use crate::mock::{
+	Offences, System, Offence, TestEvent, KIND, new_test_ext, with_on_offence_fractions,
+	offence_reports,
+};
+use system::{EventRecord, Phase};
+
+#[test]
+fn should_report_an_authority_and_trigger_on_offence() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let offence = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+
+		// when
+		Offences::report_offence(vec![], offence);
+
+		// then
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+		});
+	});
+}
+
+#[test]
+fn should_calculate_the_fraction_correctly() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+		let offence1 = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+		let offence2 = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![4],
+		};
+
+		// when
+		Offences::report_offence(vec![], offence1);
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+		});
+
+		Offences::report_offence(vec![], offence2);
+
+		// then
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(15), Perbill::from_percent(45)]);
+		});
+	});
+}
+
+#[test]
+fn should_not_report_the_same_authority_twice_in_the_same_slot() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let offence = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+		Offences::report_offence(vec![], offence.clone());
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+			f.clear();
+		});
+
+		// when
+		// report for the second time
+		Offences::report_offence(vec![], offence);
+
+		// then
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![]);
+		});
+	});
+}
+
+
+#[test]
+fn should_report_in_different_time_slot() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let mut offence = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+		Offences::report_offence(vec![], offence.clone());
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+			f.clear();
+		});
+
+		// when
+		// reportfor the second time
+		offence.time_slot += 1;
+		Offences::report_offence(vec![], offence);
+
+		// then
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+		});
+	});
+}
+
+#[test]
+fn should_deposit_event() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let offence = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+
+		// when
+		Offences::report_offence(vec![], offence);
+
+		// then
+		assert_eq!(
+			System::events(),
+			vec![EventRecord {
+				phase: Phase::ApplyExtrinsic(0),
+				event: TestEvent::offences(crate::Event::Offence(KIND, time_slot.encode())),
+				topics: vec![],
+			}]
+		);
+	});
+}
+
+#[test]
+fn doesnt_deposit_event_for_dups() {
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let offence = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+		Offences::report_offence(vec![], offence.clone());
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+			f.clear();
+		});
+
+		// when
+		// report for the second time
+		Offences::report_offence(vec![], offence);
+
+		// then
+		// there is only one event.
+		assert_eq!(
+			System::events(),
+			vec![EventRecord {
+				phase: Phase::ApplyExtrinsic(0),
+				event: TestEvent::offences(crate::Event::Offence(KIND, time_slot.encode())),
+				topics: vec![],
+			}]
+		);
+	});
+}
+
+#[test]
+fn should_properly_count_offences() {
+	// We report two different authorities for the same issue. Ultimately, the 1st authority
+	// should have `count` equal 2 and the count of the 2nd one should be equal to 1.
+	new_test_ext().execute_with(|| {
+		// given
+		let time_slot = 42;
+		assert_eq!(offence_reports(KIND, time_slot), vec![]);
+
+		let offence1 = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![5],
+		};
+		let offence2 = Offence {
+			validator_set_count: 5,
+			time_slot,
+			offenders: vec![4],
+		};
+		Offences::report_offence(vec![], offence1);
+		with_on_offence_fractions(|f| {
+			assert_eq!(f.clone(), vec![Perbill::from_percent(25)]);
+			f.clear();
+		});
+
+		// when
+		// report for the second time
+		Offences::report_offence(vec![], offence2);
+
+		// then
+		// the 1st authority should have count 2 and the 2nd one should be reported only once.
+		assert_eq!(
+			offence_reports(KIND, time_slot),
+			vec![
+				OffenceDetails { offender: 5, reporters: vec![] },
+				OffenceDetails { offender: 4, reporters: vec![] },
+			]
+		);
+	});
+}

substrate/frame/randomness-collective-flip/Cargo.toml

@@ -0,0 +1,28 @@
+[package]
+name = "pallet-randomness-collective-flip"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+safe-mix = { version = "1.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io" }
+
+[features]
+default = ["std"]
+std = [
+	"safe-mix/std",
+	"system/std",
+	"codec/std",
+	"support/std",
+	"sr-primitives/std",
+	"rstd/std",
+]

substrate/frame/randomness-collective-flip/src/lib.rs

@@ -0,0 +1,280 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Randomness Module
+//!
+//! The Randomness Collective Flip module provides a [`random`](./struct.Module.html#method.random)
+//! function that generates low-influence random values based on the block hashes from the previous
+//! `81` blocks. Low-influence randomness can be useful when defending against relatively weak
+//! adversaries.
+//!
+//! ## Public Functions
+//!
+//! See the [`Module`](./struct.Module.html) struct for details of publicly available functions.
+//!
+//! ## Usage
+//!
+//! ### Prerequisites
+//!
+//! Import the Randomness Collective Flip module and derive your module's configuration trait from
+//! the system trait.
+//!
+//! ### Example - Get random seed for the current block
+//!
+//! ```
+//! use support::{decl_module, dispatch::Result, traits::Randomness};
+//!
+//! pub trait Trait: system::Trait {}
+//!
+//! decl_module! {
+//! 	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+//! 		pub fn random_module_example(origin) -> Result {
+//! 			let _random_seed = <pallet_randomness_collective_flip::Module<T>>::random_seed();
+//! 			Ok(())
+//! 		}
+//! 	}
+//! }
+//! # fn main() { }
+//! ```
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use rstd::{prelude::*, convert::TryInto};
+use sr_primitives::traits::Hash;
+use support::{decl_module, decl_storage, traits::Randomness};
+use safe_mix::TripletMix;
+use codec::Encode;
+use system::Trait;
+
+const RANDOM_MATERIAL_LEN: u32 = 81;
+
+fn block_number_to_index<T: Trait>(block_number: T::BlockNumber) -> usize {
+	// on_initialize is called on the first block after genesis
+	let index = (block_number - 1.into()) % RANDOM_MATERIAL_LEN.into();
+	index.try_into().ok().expect("Something % 81 is always smaller than usize; qed")
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+		fn on_initialize(block_number: T::BlockNumber) {
+			let parent_hash = <system::Module<T>>::parent_hash();
+
+			<RandomMaterial<T>>::mutate(|ref mut values| if values.len() < RANDOM_MATERIAL_LEN as usize {
+				values.push(parent_hash)
+			} else {
+				let index = block_number_to_index::<T>(block_number);
+				values[index] = parent_hash;
+			});
+		}
+	}
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as RandomnessCollectiveFlip {
+		/// Series of block headers from the last 81 blocks that acts as random seed material. This
+		/// is arranged as a ring buffer with `block_number % 81` being the index into the `Vec` of
+		/// the oldest hash.
+		RandomMaterial get(fn random_material): Vec<T::Hash>;
+	}
+}
+
+impl<T: Trait> Randomness<T::Hash> for Module<T> {
+	/// Get a low-influence "random" value.
+	///
+	/// Being a deterministic block chain, real randomness is difficult to come by. This gives you
+	/// something that approximates it. `subject` is a context identifier and allows you to get a
+	/// different result to other callers of this function; use it like
+	/// `random(&b"my context"[..])`. This is initially implemented through a low-influence
+	/// "triplet mix" convolution of previous block hash values. In the future it will be generated
+	/// from a secure verifiable random function (VRF).
+	///
+	/// ### Security Notes
+	///
+	/// This randomness uses a low-influence function, drawing upon the block hashes from the
+	/// previous 81 blocks. Its result for any given subject will be known far in advance by anyone
+	/// observing the chain. Any block producer has significant influence over their block hashes
+	/// bounded only by their computational resources. Our low-influence function reduces the actual
+	/// block producer's influence over the randomness, but increases the influence of small
+	/// colluding groups of recent block producers.
+	///
+	/// Some BABE blocks have VRF outputs where the block producer has exactly one bit of influence,
+	/// either they make the block or they do not make the block and thus someone else makes the
+	/// next block. Yet, this randomness is not fresh in all BABE blocks.
+	///
+	/// If that is an insufficient security guarantee then two things can be used to improve this
+	/// randomness:
+	///
+	/// - Name, in advance, the block number whose random value will be used; ensure your module
+	///   retains a buffer of previous random values for its subject and then index into these in
+	///   order to obviate the ability of your user to look up the parent hash and choose when to
+	///   transact based upon it.
+	/// - Require your user to first commit to an additional value by first posting its hash.
+	///   Require them to reveal the value to determine the final result, hashing it with the
+	///   output of this random function. This reduces the ability of a cabal of block producers
+	///   from conspiring against individuals.
+	///
+	/// WARNING: Hashing the result of this function will remove any low-influence properties it has
+	/// and mean that all bits of the resulting value are entirely manipulatable by the author of
+	/// the parent block, who can determine the value of `parent_hash`.
+	fn random(subject: &[u8]) -> T::Hash {
+		let block_number = <system::Module<T>>::block_number();
+		let index = block_number_to_index::<T>(block_number);
+
+		let hash_series = <RandomMaterial<T>>::get();
+		if !hash_series.is_empty() {
+			// Always the case after block 1 is initialised.
+			hash_series.iter()
+				.cycle()
+				.skip(index)
+				.take(RANDOM_MATERIAL_LEN as usize)
+				.enumerate()
+				.map(|(i, h)| (i as i8, subject, h).using_encoded(T::Hashing::hash))
+				.triplet_mix()
+		} else {
+			T::Hash::default()
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use primitives::H256;
+	use sr_primitives::{
+		Perbill, traits::{BlakeTwo256, OnInitialize, Header as _, IdentityLookup}, testing::Header,
+	};
+	use support::{impl_outer_origin, parameter_types, traits::Randomness};
+
+	#[derive(Clone, PartialEq, Eq)]
+	pub struct Test;
+
+	impl_outer_origin! {
+		pub enum Origin for Test {}
+	}
+
+	parameter_types! {
+		pub const BlockHashCount: u64 = 250;
+		pub const MaximumBlockWeight: u32 = 1024;
+		pub const MaximumBlockLength: u32 = 2 * 1024;
+		pub const AvailableBlockRatio: Perbill = Perbill::one();
+	}
+
+	impl system::Trait for Test {
+		type Origin = Origin;
+		type Index = u64;
+		type BlockNumber = u64;
+		type Call = ();
+		type Hash = H256;
+		type Hashing = BlakeTwo256;
+		type AccountId = u64;
+		type Lookup = IdentityLookup<Self::AccountId>;
+		type Header = Header;
+		type Event = ();
+		type BlockHashCount = BlockHashCount;
+		type MaximumBlockWeight = MaximumBlockWeight;
+		type AvailableBlockRatio = AvailableBlockRatio;
+		type MaximumBlockLength = MaximumBlockLength;
+		type Version = ();
+	}
+
+	type System = system::Module<Test>;
+	type CollectiveFlip = Module<Test>;
+
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		t.into()
+	}
+
+	#[test]
+	fn test_block_number_to_index() {
+		for i in 1 .. 1000 {
+			assert_eq!((i - 1) as usize % 81, block_number_to_index::<Test>(i));
+		}
+	}
+
+	fn setup_blocks(blocks: u64) {
+		let mut parent_hash = System::parent_hash();
+
+		for i in 1 .. (blocks + 1) {
+			System::initialize(&i, &parent_hash, &Default::default(), &Default::default());
+			CollectiveFlip::on_initialize(i);
+
+			let header = System::finalize();
+			parent_hash = header.hash();
+			System::set_block_number(*header.number());
+		}
+	}
+
+	#[test]
+	fn test_random_material_parital() {
+		new_test_ext().execute_with(|| {
+			let genesis_hash = System::parent_hash();
+
+			setup_blocks(38);
+
+			let random_material = CollectiveFlip::random_material();
+
+			assert_eq!(random_material.len(), 38);
+			assert_eq!(random_material[0], genesis_hash);
+		});
+	}
+
+	#[test]
+	fn test_random_material_filled() {
+		new_test_ext().execute_with(|| {
+			let genesis_hash = System::parent_hash();
+
+			setup_blocks(81);
+
+			let random_material = CollectiveFlip::random_material();
+
+			assert_eq!(random_material.len(), 81);
+			assert_ne!(random_material[0], random_material[1]);
+			assert_eq!(random_material[0], genesis_hash);
+		});
+	}
+
+	#[test]
+	fn test_random_material_filled_twice() {
+		new_test_ext().execute_with(|| {
+			let genesis_hash = System::parent_hash();
+
+			setup_blocks(162);
+
+			let random_material = CollectiveFlip::random_material();
+
+			assert_eq!(random_material.len(), 81);
+			assert_ne!(random_material[0], random_material[1]);
+			assert_ne!(random_material[0], genesis_hash);
+		});
+	}
+
+	#[test]
+	fn test_random() {
+		new_test_ext().execute_with(|| {
+			setup_blocks(162);
+
+			assert_eq!(System::block_number(), 162);
+			assert_eq!(CollectiveFlip::random_seed(), CollectiveFlip::random_seed());
+			assert_ne!(CollectiveFlip::random(b"random_1"), CollectiveFlip::random(b"random_2"));
+
+			let random = CollectiveFlip::random_seed();
+
+			assert_ne!(random, H256::zero());
+			assert!(!CollectiveFlip::random_material().contains(&random));
+		});
+	}
+}

substrate/frame/scored-pool/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "pallet-scored-pool"
+version = "1.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+serde = { version = "1.0.101", optional = true }
+runtime-io = { package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+
+[dev-dependencies]
+balances = { package = "pallet-balances", path = "../balances" }
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+
+[features]
+default = ["std"]
+std = [
+	"codec/std",
+	"serde",
+	"runtime-io/std",
+	"sr-primitives/std",
+	"rstd/std",
+	"support/std",
+	"system/std",
+]

substrate/frame/scored-pool/src/lib.rs

@@ -0,0 +1,456 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! # Scored Pool Module
+//!
+//! The module maintains a scored membership pool. Each entity in the
+//! pool can be attributed a `Score`. From this pool a set `Members`
+//! is constructed. This set contains the `MemberCount` highest
+//! scoring entities. Unscored entities are never part of `Members`.
+//!
+//! If an entity wants to be part of the pool a deposit is required.
+//! The deposit is returned when the entity withdraws or when it
+//! is removed by an entity with the appropriate authority.
+//!
+//! Every `Period` blocks the set of `Members` is refreshed from the
+//! highest scoring members in the pool and, no matter if changes
+//! occurred, `T::MembershipChanged::set_members_sorted` is invoked.
+//! On first load `T::MembershipInitialized::initialize_members` is
+//! invoked with the initial `Members` set.
+//!
+//! It is possible to withdraw candidacy/resign your membership at any
+//! time. If an entity is currently a member, this results in removal
+//! from the `Pool` and `Members`; the entity is immediately replaced
+//! by the next highest scoring candidate in the pool, if available.
+//!
+//! - [`scored_pool::Trait`](./trait.Trait.html)
+//! - [`Call`](./enum.Call.html)
+//! - [`Module`](./struct.Module.html)
+//!
+//! ## Interface
+//!
+//! ### Public Functions
+//!
+//! - `submit_candidacy` - Submit candidacy to become a member. Requires a deposit.
+//! - `withdraw_candidacy` - Withdraw candidacy. Deposit is returned.
+//! - `score` - Attribute a quantitative score to an entity.
+//! - `kick` - Remove an entity from the pool and members. Deposit is returned.
+//! - `change_member_count` - Changes the amount of candidates taken into `Members`.
+//!
+//! ## Usage
+//!
+//! ```
+//! use support::{decl_module, dispatch::Result};
+//! use system::ensure_signed;
+//! use pallet_scored_pool::{self as scored_pool};
+//!
+//! pub trait Trait: scored_pool::Trait {}
+//!
+//! decl_module! {
+//! 	pub struct Module<T: Trait> for enum Call where origin: T::Origin {
+//! 		pub fn candidate(origin) -> Result {
+//! 			let who = ensure_signed(origin)?;
+//!
+//! 			let _ = <scored_pool::Module<T>>::submit_candidacy(
+//! 				T::Origin::from(Some(who.clone()).into())
+//! 			);
+//! 			Ok(())
+//! 		}
+//! 	}
+//! }
+//!
+//! # fn main() { }
+//! ```
+//!
+//! ## Dependencies
+//!
+//! This module depends on the [System module](../frame_system/index.html).
+
+// Ensure we're `no_std` when compiling for Wasm.
+#![cfg_attr(not(feature = "std"), no_std)]
+
+#[cfg(test)]
+mod mock;
+
+#[cfg(test)]
+mod tests;
+
+use codec::FullCodec;
+use rstd::{
+	fmt::Debug,
+	prelude::*,
+};
+use support::{
+	decl_module, decl_storage, decl_event, ensure,
+	traits::{ChangeMembers, InitializeMembers, Currency, Get, ReservableCurrency},
+};
+use system::{self, ensure_root, ensure_signed};
+use sr_primitives::{
+	traits::{EnsureOrigin, SimpleArithmetic, MaybeSerializeDeserialize, Zero, StaticLookup},
+};
+
+type BalanceOf<T, I> = <<T as Trait<I>>::Currency as Currency<<T as system::Trait>::AccountId>>::Balance;
+type PoolT<T, I> = Vec<(<T as system::Trait>::AccountId, Option<<T as Trait<I>>::Score>)>;
+
+/// The enum is supplied when refreshing the members set.
+/// Depending on the enum variant the corresponding associated
+/// type function will be invoked.
+enum ChangeReceiver {
+	/// Should call `T::MembershipInitialized`.
+	MembershipInitialized,
+	/// Should call `T::MembershipChanged`.
+	MembershipChanged,
+}
+
+pub trait Trait<I=DefaultInstance>: system::Trait {
+	/// The currency used for deposits.
+	type Currency: Currency<Self::AccountId> + ReservableCurrency<Self::AccountId>;
+
+	/// The score attributed to a member or candidate.
+	type Score:
+		SimpleArithmetic + Clone + Copy + Default + FullCodec + MaybeSerializeDeserialize + Debug;
+
+	/// The overarching event type.
+	type Event: From<Event<Self, I>> + Into<<Self as system::Trait>::Event>;
+
+	// The deposit which is reserved from candidates if they want to
+	// start a candidacy. The deposit gets returned when the candidacy is
+	// withdrawn or when the candidate is kicked.
+	type CandidateDeposit: Get<BalanceOf<Self, I>>;
+
+	/// Every `Period` blocks the `Members` are filled with the highest scoring
+	/// members in the `Pool`.
+	type Period: Get<Self::BlockNumber>;
+
+	/// The receiver of the signal for when the membership has been initialized.
+	/// This happens pre-genesis and will usually be the same as `MembershipChanged`.
+	/// If you need to do something different on initialization, then you can change
+	/// this accordingly.
+	type MembershipInitialized: InitializeMembers<Self::AccountId>;
+
+	/// The receiver of the signal for when the members have changed.
+	type MembershipChanged: ChangeMembers<Self::AccountId>;
+
+	/// Allows a configurable origin type to set a score to a candidate in the pool.
+	type ScoreOrigin: EnsureOrigin<Self::Origin>;
+
+	/// Required origin for removing a member (though can always be Root).
+	/// Configurable origin which enables removing an entity. If the entity
+	/// is part of the `Members` it is immediately replaced by the next
+	/// highest scoring candidate, if available.
+	type KickOrigin: EnsureOrigin<Self::Origin>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait<I>, I: Instance=DefaultInstance> as ScoredPool {
+		/// The current pool of candidates, stored as an ordered Vec
+		/// (ordered descending by score, `None` last, highest first).
+		Pool get(fn pool) config(): PoolT<T, I>;
+
+		/// A Map of the candidates. The information in this Map is redundant
+		/// to the information in the `Pool`. But the Map enables us to easily
+		/// check if a candidate is already in the pool, without having to
+		/// iterate over the entire pool (the `Pool` is not sorted by
+		/// `T::AccountId`, but by `T::Score` instead).
+		CandidateExists get(fn candidate_exists): map T::AccountId => bool;
+
+		/// The current membership, stored as an ordered Vec.
+		Members get(fn members): Vec<T::AccountId>;
+
+		/// Size of the `Members` set.
+		MemberCount get(fn member_count) config(): u32;
+	}
+	add_extra_genesis {
+		config(members): Vec<T::AccountId>;
+		config(phantom): rstd::marker::PhantomData<I>;
+		build(|config| {
+			let mut pool = config.pool.clone();
+
+			// reserve balance for each candidate in the pool.
+			// panicking here is ok, since this just happens one time, pre-genesis.
+			pool
+				.iter()
+				.for_each(|(who, _)| {
+					T::Currency::reserve(&who, T::CandidateDeposit::get())
+						.expect("balance too low to create candidacy");
+					<CandidateExists<T, I>>::insert(who, true);
+				});
+
+			/// Sorts the `Pool` by score in a descending order. Entities which
+			/// have a score of `None` are sorted to the beginning of the vec.
+			pool.sort_by_key(|(_, maybe_score)|
+				Reverse(maybe_score.unwrap_or_default())
+			);
+
+			<Pool<T, I>>::put(&pool);
+			<Module<T, I>>::refresh_members(pool, ChangeReceiver::MembershipInitialized);
+		})
+	}
+}
+
+decl_event!(
+	pub enum Event<T, I=DefaultInstance> where
+		<T as system::Trait>::AccountId,
+	{
+		/// The given member was removed. See the transaction for who.
+		MemberRemoved,
+		/// An entity has issued a candidacy. See the transaction for who.
+		CandidateAdded,
+		/// An entity withdrew candidacy. See the transaction for who.
+		CandidateWithdrew,
+		/// The candidacy was forcefully removed for an entity.
+		/// See the transaction for who.
+		CandidateKicked,
+		/// A score was attributed to the candidate.
+		/// See the transaction for who.
+		CandidateScored,
+		/// Phantom member, never used.
+		Dummy(rstd::marker::PhantomData<(AccountId, I)>),
+	}
+);
+
+decl_module! {
+	pub struct Module<T: Trait<I>, I: Instance=DefaultInstance>
+		for enum Call
+		where origin: T::Origin
+	{
+		fn deposit_event() = default;
+
+		/// Every `Period` blocks the `Members` set is refreshed from the
+		/// highest scoring members in the pool.
+		fn on_initialize(n: T::BlockNumber) {
+			if n % T::Period::get() == Zero::zero() {
+				let pool = <Pool<T, I>>::get();
+				<Module<T, I>>::refresh_members(pool, ChangeReceiver::MembershipChanged);
+			}
+		}
+
+		/// Add `origin` to the pool of candidates.
+		///
+		/// This results in `CandidateDeposit` being reserved from
+		/// the `origin` account. The deposit is returned once
+		/// candidacy is withdrawn by the candidate or the entity
+		/// is kicked by `KickOrigin`.
+		///
+		/// The dispatch origin of this function must be signed.
+		///
+		/// The `index` parameter of this function must be set to
+		/// the index of the transactor in the `Pool`.
+		pub fn submit_candidacy(origin) {
+			let who = ensure_signed(origin)?;
+			ensure!(!<CandidateExists<T, I>>::exists(&who), "already a member");
+
+			let deposit = T::CandidateDeposit::get();
+			T::Currency::reserve(&who, deposit)
+				.map_err(|_| "balance too low to submit candidacy")?;
+
+			// can be inserted as last element in pool, since entities with
+			// `None` are always sorted to the end.
+			if let Err(e) = <Pool<T, I>>::append(&[(who.clone(), None)]) {
+				T::Currency::unreserve(&who, deposit);
+				return Err(e);
+			}
+
+			<CandidateExists<T, I>>::insert(&who, true);
+
+			Self::deposit_event(RawEvent::CandidateAdded);
+		}
+
+		/// An entity withdraws candidacy and gets its deposit back.
+		///
+		/// If the entity is part of the `Members`, then the highest member
+		/// of the `Pool` that is not currently in `Members` is immediately
+		/// placed in the set instead.
+		///
+		/// The dispatch origin of this function must be signed.
+		///
+		/// The `index` parameter of this function must be set to
+		/// the index of the transactor in the `Pool`.
+		pub fn withdraw_candidacy(
+			origin,
+			index: u32
+		) {
+			let who = ensure_signed(origin)?;
+
+			let pool = <Pool<T, I>>::get();
+			Self::ensure_index(&pool, &who, index)?;
+
+			Self::remove_member(pool, who, index)?;
+			Self::deposit_event(RawEvent::CandidateWithdrew);
+		}
+
+		/// Kick a member `who` from the set.
+		///
+		/// May only be called from `KickOrigin` or root.
+		///
+		/// The `index` parameter of this function must be set to
+		/// the index of `dest` in the `Pool`.
+		pub fn kick(
+			origin,
+			dest: <T::Lookup as StaticLookup>::Source,
+			index: u32
+		) {
+			T::KickOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let who = T::Lookup::lookup(dest)?;
+
+			let pool = <Pool<T, I>>::get();
+			Self::ensure_index(&pool, &who, index)?;
+
+			Self::remove_member(pool, who, index)?;
+			Self::deposit_event(RawEvent::CandidateKicked);
+		}
+
+		/// Score a member `who` with `score`.
+		///
+		/// May only be called from `ScoreOrigin` or root.
+		///
+		/// The `index` parameter of this function must be set to
+		/// the index of the `dest` in the `Pool`.
+		pub fn score(
+			origin,
+			dest: <T::Lookup as StaticLookup>::Source,
+			index: u32,
+			score: T::Score
+		) {
+			T::ScoreOrigin::try_origin(origin)
+				.map(|_| ())
+				.or_else(ensure_root)
+				.map_err(|_| "bad origin")?;
+
+			let who = T::Lookup::lookup(dest)?;
+
+			let mut pool = <Pool<T, I>>::get();
+			Self::ensure_index(&pool, &who, index)?;
+
+			pool.remove(index as usize);
+
+			// we binary search the pool (which is sorted descending by score).
+			// if there is already an element with `score`, we insert
+			// right before that. if not, the search returns a location
+			// where we can insert while maintaining order.
+			let item = (who.clone(), Some(score.clone()));
+			let location = pool
+				.binary_search_by_key(
+					&Reverse(score),
+					|(_, maybe_score)| Reverse(maybe_score.unwrap_or_default())
+				)
+				.unwrap_or_else(|l| l);
+			pool.insert(location, item);
+
+			<Pool<T, I>>::put(&pool);
+			Self::deposit_event(RawEvent::CandidateScored);
+		}
+
+		/// Dispatchable call to change `MemberCount`.
+		///
+		/// This will only have an effect the next time a refresh happens
+		/// (this happens each `Period`).
+		///
+		/// May only be called from root.
+		pub fn change_member_count(origin, count: u32) {
+			ensure_root(origin)?;
+			<MemberCount<I>>::put(&count);
+		}
+	}
+}
+
+impl<T: Trait<I>, I: Instance> Module<T, I> {
+
+	/// Fetches the `MemberCount` highest scoring members from
+	/// `Pool` and puts them into `Members`.
+	///
+	/// The `notify` parameter is used to deduct which associated
+	/// type function to invoke at the end of the method.
+	fn refresh_members(
+		pool: PoolT<T, I>,
+		notify: ChangeReceiver
+	) {
+		let count = <MemberCount<I>>::get();
+
+		let mut new_members: Vec<T::AccountId> = pool
+			.into_iter()
+			.filter(|(_, score)| score.is_some())
+			.take(count as usize)
+			.map(|(account_id, _)| account_id)
+			.collect();
+		new_members.sort();
+
+		let old_members = <Members<T, I>>::get();
+		<Members<T, I>>::put(&new_members);
+
+		match notify {
+			ChangeReceiver::MembershipInitialized =>
+				T::MembershipInitialized::initialize_members(&new_members),
+			ChangeReceiver::MembershipChanged =>
+				T::MembershipChanged::set_members_sorted(
+					&new_members[..],
+					&old_members[..],
+				),
+		}
+	}
+
+	/// Removes an entity `remove` at `index` from the `Pool`.
+	///
+	/// If the entity is a member it is also removed from `Members` and
+	/// the deposit is returned.
+	fn remove_member(
+		mut pool: PoolT<T, I>,
+		remove: T::AccountId,
+		index: u32
+	) -> Result<(), &'static str> {
+		// all callers of this function in this module also check
+		// the index for validity before calling this function.
+		// nevertheless we check again here, to assert that there was
+		// no mistake when invoking this sensible function.
+		Self::ensure_index(&pool, &remove, index)?;
+
+		pool.remove(index as usize);
+		<Pool<T, I>>::put(&pool);
+
+		// remove from set, if it was in there
+		let members = <Members<T, I>>::get();
+		if members.binary_search(&remove).is_ok() {
+			Self::refresh_members(pool, ChangeReceiver::MembershipChanged);
+		}
+
+		<CandidateExists<T, I>>::remove(&remove);
+
+		T::Currency::unreserve(&remove, T::CandidateDeposit::get());
+
+		Self::deposit_event(RawEvent::MemberRemoved);
+		Ok(())
+	}
+
+	/// Checks if `index` is a valid number and if the element found
+	/// at `index` in `Pool` is equal to `who`.
+	fn ensure_index(
+		pool: &PoolT<T, I>,
+		who: &T::AccountId,
+		index: u32
+	) -> Result<(), &'static str> {
+		ensure!(index < pool.len() as u32, "index out of bounds");
+
+		let (index_who, _index_score) = &pool[index as usize];
+		ensure!(index_who == who, "index does not match requested account");
+
+		Ok(())
+	}
+}
+

substrate/frame/scored-pool/src/mock.rs

@@ -0,0 +1,170 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test utilities
+
+use super::*;
+
+use std::cell::RefCell;
+use support::{impl_outer_origin, parameter_types};
+use primitives::H256;
+// The testing primitives are very useful for avoiding having to work with signatures
+// or public keys. `u64` is used as the `AccountId` and no `Signature`s are requried.
+use sr_primitives::{
+	Perbill, traits::{BlakeTwo256, IdentityLookup}, testing::Header,
+};
+use system::EnsureSignedBy;
+
+impl_outer_origin! {
+	pub enum Origin for Test {}
+}
+
+// For testing the module, we construct most of a mock runtime. This means
+// first constructing a configuration type (`Test`) which `impl`s each of the
+// configuration traits of modules we want to use.
+#[derive(Clone, Eq, PartialEq)]
+pub struct Test;
+parameter_types! {
+	pub const CandidateDeposit: u64 = 25;
+	pub const Period: u64 = 4;
+
+	pub const KickOrigin: u64 = 2;
+	pub const ScoreOrigin: u64 = 3;
+
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+
+	pub const ExistentialDeposit: u64 = 0;
+	pub const TransferFee: u64 = 0;
+	pub const CreationFee: u64 = 0;
+}
+
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Hash = H256;
+	type Call = ();
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type MaximumBlockLength = MaximumBlockLength;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type Version = ();
+}
+
+impl balances::Trait for Test {
+	type Balance = u64;
+	type OnFreeBalanceZero = ();
+	type OnNewAccount = ();
+	type Event = ();
+	type TransferPayment = ();
+	type DustRemoval = ();
+	type ExistentialDeposit = ExistentialDeposit;
+	type TransferFee = TransferFee;
+	type CreationFee = CreationFee;
+}
+
+thread_local! {
+	pub static MEMBERS: RefCell<Vec<u64>> = RefCell::new(vec![]);
+}
+
+pub struct TestChangeMembers;
+impl ChangeMembers<u64> for TestChangeMembers {
+	fn change_members_sorted(incoming: &[u64], outgoing: &[u64], new: &[u64]) {
+		let mut old_plus_incoming = MEMBERS.with(|m| m.borrow().to_vec());
+		old_plus_incoming.extend_from_slice(incoming);
+		old_plus_incoming.sort();
+
+		let mut new_plus_outgoing = new.to_vec();
+		new_plus_outgoing.extend_from_slice(outgoing);
+		new_plus_outgoing.sort();
+
+		assert_eq!(old_plus_incoming, new_plus_outgoing);
+
+		MEMBERS.with(|m| *m.borrow_mut() = new.to_vec());
+	}
+}
+
+impl InitializeMembers<u64> for TestChangeMembers {
+	fn initialize_members(new_members: &[u64]) {
+		MEMBERS.with(|m| *m.borrow_mut() = new_members.to_vec());
+	}
+}
+
+impl Trait for Test {
+	type Event = ();
+	type KickOrigin = EnsureSignedBy<KickOrigin, u64>;
+	type MembershipInitialized = TestChangeMembers;
+	type MembershipChanged = TestChangeMembers;
+	type Currency = balances::Module<Self>;
+	type CandidateDeposit = CandidateDeposit;
+	type Period = Period;
+	type Score = u64;
+	type ScoreOrigin = EnsureSignedBy<ScoreOrigin, u64>;
+}
+
+// This function basically just builds a genesis storage key/value store according to
+// our desired mockup.
+pub fn new_test_ext() -> runtime_io::TestExternalities {
+	let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+	// We use default for brevity, but you can configure as desired if needed.
+	balances::GenesisConfig::<Test> {
+		balances: vec![
+			(5, 500_000),
+			(10, 500_000),
+			(15, 500_000),
+			(20, 500_000),
+			(31, 500_000),
+			(40, 500_000),
+			(99, 1),
+		],
+		vesting: vec![],
+	}.assimilate_storage(&mut t).unwrap();
+	GenesisConfig::<Test>{
+		pool: vec![
+			(5, None),
+			(10, Some(1)),
+			(20, Some(2)),
+			(31, Some(2)),
+			(40, Some(3)),
+		],
+		member_count: 2,
+		.. Default::default()
+	}.assimilate_storage(&mut t).unwrap();
+	t.into()
+}
+
+/// Fetch an entity from the pool, if existent.
+pub fn fetch_from_pool(who: u64) -> Option<(u64, Option<u64>)> {
+	<Module<Test>>::pool()
+		.into_iter()
+		.find(|item| item.0 == who)
+}
+
+/// Find an entity in the pool.
+/// Returns its position in the `Pool` vec, if existent.
+pub fn find_in_pool(who: u64) -> Option<usize> {
+	<Module<Test>>::pool()
+		.into_iter()
+		.position(|item| item.0 == who)
+}

substrate/frame/scored-pool/src/tests.rs

@@ -0,0 +1,282 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tests for the module.
+
+use super::*;
+use mock::*;
+
+use support::{assert_ok, assert_noop};
+use sr_primitives::traits::OnInitialize;
+
+type ScoredPool = Module<Test>;
+type System = system::Module<Test>;
+type Balances = balances::Module<Test>;
+
+const OOB_ERR: &str = "index out of bounds";
+const INDEX_ERR: &str = "index does not match requested account";
+
+#[test]
+fn query_membership_works() {
+	new_test_ext().execute_with(|| {
+		assert_eq!(ScoredPool::members(), vec![20, 40]);
+		assert_eq!(Balances::reserved_balance(&31), CandidateDeposit::get());
+		assert_eq!(Balances::reserved_balance(&40), CandidateDeposit::get());
+		assert_eq!(MEMBERS.with(|m| m.borrow().clone()), vec![20, 40]);
+	});
+}
+
+#[test]
+fn submit_candidacy_must_not_work() {
+	new_test_ext().execute_with(|| {
+		assert_noop!(
+			ScoredPool::submit_candidacy(Origin::signed(99)),
+			"balance too low to submit candidacy"
+		);
+		assert_noop!(
+			ScoredPool::submit_candidacy(Origin::signed(40)),
+			"already a member"
+		);
+	});
+}
+
+#[test]
+fn submit_candidacy_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 15;
+
+		// when
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(who)));
+		assert_eq!(fetch_from_pool(15), Some((who, None)));
+
+		// then
+		assert_eq!(Balances::reserved_balance(&who), CandidateDeposit::get());
+	});
+}
+
+#[test]
+fn scoring_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 15;
+		let score = 99;
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(who)));
+
+		// when
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), who, index, score));
+
+		// then
+		assert_eq!(fetch_from_pool(who), Some((who, Some(score))));
+		assert_eq!(find_in_pool(who), Some(0)); // must be first element, since highest scored
+	});
+}
+
+#[test]
+fn scoring_same_element_with_same_score_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 31;
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		let score = 2;
+
+		// when
+		assert_ok!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), who, index, score));
+
+		// then
+		assert_eq!(fetch_from_pool(who), Some((who, Some(score))));
+
+		// must have been inserted right before the `20` element which is
+		// of the same score as `31`. so sort order is maintained.
+		assert_eq!(find_in_pool(who), Some(1));
+	});
+}
+
+#[test]
+fn kicking_works_only_for_authorized() {
+	new_test_ext().execute_with(|| {
+		let who = 40;
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_noop!(ScoredPool::kick(Origin::signed(99), who, index), "bad origin");
+	});
+}
+
+#[test]
+fn kicking_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 40;
+		assert_eq!(Balances::reserved_balance(&who), CandidateDeposit::get());
+		assert_eq!(find_in_pool(who), Some(0));
+
+		// when
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::kick(Origin::signed(KickOrigin::get()), who, index));
+
+		// then
+		assert_eq!(find_in_pool(who), None);
+		assert_eq!(ScoredPool::members(), vec![20, 31]);
+		assert_eq!(MEMBERS.with(|m| m.borrow().clone()), ScoredPool::members());
+		assert_eq!(Balances::reserved_balance(&who), 0); // deposit must have been returned
+	});
+}
+
+#[test]
+fn unscored_entities_must_not_be_used_for_filling_members() {
+	new_test_ext().execute_with(|| {
+		// given
+		// we submit a candidacy, score will be `None`
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(15)));
+
+		// when
+		// we remove every scored member
+		ScoredPool::pool()
+			.into_iter()
+			.for_each(|(who, score)| {
+				if let Some(_) = score {
+					let index = find_in_pool(who).expect("entity must be in pool") as u32;
+					assert_ok!(ScoredPool::kick(Origin::signed(KickOrigin::get()), who, index));
+				}
+			});
+
+		// then
+		// the `None` candidates should not have been filled in
+		assert_eq!(ScoredPool::members(), vec![]);
+		assert_eq!(MEMBERS.with(|m| m.borrow().clone()), ScoredPool::members());
+	});
+}
+
+#[test]
+fn refreshing_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 15;
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(who)));
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), who, index, 99));
+
+		// when
+		ScoredPool::refresh_members(ScoredPool::pool(), ChangeReceiver::MembershipChanged);
+
+		// then
+		assert_eq!(ScoredPool::members(), vec![15, 40]);
+		assert_eq!(MEMBERS.with(|m| m.borrow().clone()), ScoredPool::members());
+	});
+}
+
+#[test]
+fn refreshing_happens_every_period() {
+	new_test_ext().execute_with(|| {
+		// given
+		System::set_block_number(1);
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(15)));
+		let index = find_in_pool(15).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), 15, index, 99));
+		assert_eq!(ScoredPool::members(), vec![20, 40]);
+
+		// when
+		System::set_block_number(4);
+		ScoredPool::on_initialize(4);
+
+		// then
+		assert_eq!(ScoredPool::members(), vec![15, 40]);
+		assert_eq!(MEMBERS.with(|m| m.borrow().clone()), ScoredPool::members());
+	});
+}
+
+#[test]
+fn withdraw_candidacy_must_only_work_for_members() {
+	new_test_ext().execute_with(|| {
+		let who = 77;
+		let index = 0;
+		assert_noop!( ScoredPool::withdraw_candidacy(Origin::signed(who), index), INDEX_ERR);
+	});
+}
+
+#[test]
+fn oob_index_should_abort() {
+	new_test_ext().execute_with(|| {
+		let who = 40;
+		let oob_index = ScoredPool::pool().len() as u32;
+		assert_noop!(ScoredPool::withdraw_candidacy(Origin::signed(who), oob_index), OOB_ERR);
+		assert_noop!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), who, oob_index, 99), OOB_ERR);
+		assert_noop!(ScoredPool::kick(Origin::signed(KickOrigin::get()), who, oob_index), OOB_ERR);
+	});
+}
+
+#[test]
+fn index_mismatches_should_abort() {
+	new_test_ext().execute_with(|| {
+		let who = 40;
+		let index = 3;
+		assert_noop!(ScoredPool::withdraw_candidacy(Origin::signed(who), index), INDEX_ERR);
+		assert_noop!(ScoredPool::score(Origin::signed(ScoreOrigin::get()), who, index, 99), INDEX_ERR);
+		assert_noop!(ScoredPool::kick(Origin::signed(KickOrigin::get()), who, index), INDEX_ERR);
+	});
+}
+
+#[test]
+fn withdraw_unscored_candidacy_must_work() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 5;
+
+		// when
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::withdraw_candidacy(Origin::signed(who), index));
+
+		// then
+		assert_eq!(fetch_from_pool(5), None);
+	});
+}
+
+#[test]
+fn withdraw_scored_candidacy_must_work() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 40;
+		assert_eq!(Balances::reserved_balance(&who), CandidateDeposit::get());
+
+		// when
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::withdraw_candidacy(Origin::signed(who), index));
+
+		// then
+		assert_eq!(fetch_from_pool(who), None);
+		assert_eq!(ScoredPool::members(), vec![20, 31]);
+		assert_eq!(Balances::reserved_balance(&who), 0);
+	});
+}
+
+#[test]
+fn candidacy_resubmitting_works() {
+	new_test_ext().execute_with(|| {
+		// given
+		let who = 15;
+
+		// when
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(who)));
+		assert_eq!(ScoredPool::candidate_exists(who), true);
+		let index = find_in_pool(who).expect("entity must be in pool") as u32;
+		assert_ok!(ScoredPool::withdraw_candidacy(Origin::signed(who), index));
+		assert_eq!(ScoredPool::candidate_exists(who), false);
+		assert_ok!(ScoredPool::submit_candidacy(Origin::signed(who)));
+
+		// then
+		assert_eq!(ScoredPool::candidate_exists(who), true);
+	});
+}

substrate/frame/session/Cargo.toml

@@ -0,0 +1,40 @@
+[package]
+name = "pallet-session"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition =  "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+timestamp = { package = "pallet-timestamp", path = "../timestamp", default-features = false }
+substrate-trie = { path = "../../primitives/trie", default-features = false, optional = true }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+impl-trait-for-tuples = "0.1.3"
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+app-crypto = { package = "substrate-application-crypto",  path = "../../primitives/application-crypto" }
+lazy_static = "1.4.0"
+
+[features]
+default = ["std", "historical"]
+historical = ["substrate-trie"]
+std = [
+	"serde",
+	"safe-mix/std",
+	"codec/std",
+	"rstd/std",
+	"support/std",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"timestamp/std",
+	"substrate-trie/std",
+	"runtime-io/std",
+]

substrate/frame/session/src/historical.rs

@@ -0,0 +1,431 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! An opt-in utility for tracking historical sessions in SRML-session.
+//!
+//! This is generally useful when implementing blockchains that require accountable
+//! safety where validators from some amount f prior sessions must remain slashable.
+//!
+//! Rather than store the full session data for any given session, we instead commit
+//! to the roots of merkle tries containing the session data.
+//!
+//! These roots and proofs of inclusion can be generated at any time during the current session.
+//! Afterwards, the proofs can be fed to a consensus module when reporting misbehavior.
+
+use rstd::prelude::*;
+use codec::{Encode, Decode};
+use sr_primitives::KeyTypeId;
+use sr_primitives::traits::{Convert, OpaqueKeys, Hash as HashT};
+use support::{decl_module, decl_storage};
+use support::{Parameter, print};
+use substrate_trie::{MemoryDB, Trie, TrieMut, Recorder, EMPTY_PREFIX};
+use substrate_trie::trie_types::{TrieDBMut, TrieDB};
+use super::{SessionIndex, Module as SessionModule};
+
+type ValidatorCount = u32;
+
+/// Trait necessary for the historical module.
+pub trait Trait: super::Trait {
+	/// Full identification of the validator.
+	type FullIdentification: Parameter;
+
+	/// A conversion from validator ID to full identification.
+	///
+	/// This should contain any references to economic actors associated with the
+	/// validator, since they may be outdated by the time this is queried from a
+	/// historical trie.
+	///
+	/// This mapping is expected to remain stable in between calls to
+	/// `Self::OnSessionEnding::on_session_ending` which return new validators.
+	type FullIdentificationOf: Convert<Self::ValidatorId, Option<Self::FullIdentification>>;
+}
+
+decl_storage! {
+	trait Store for Module<T: Trait> as Session {
+		/// Mapping from historical session indices to session-data root hash and validator count.
+		HistoricalSessions get(fn historical_root): map SessionIndex => Option<(T::Hash, ValidatorCount)>;
+		/// Queued full identifications for queued sessions whose validators have become obsolete.
+		CachedObsolete get(fn cached_obsolete): map SessionIndex
+			=> Option<Vec<(T::ValidatorId, T::FullIdentification)>>;
+		/// The range of historical sessions we store. [first, last)
+		StoredRange: Option<(SessionIndex, SessionIndex)>;
+	}
+}
+
+decl_module! {
+	pub struct Module<T: Trait> for enum Call where origin: T::Origin { }
+}
+
+impl<T: Trait> Module<T> {
+	/// Prune historical stored session roots up to (but not including)
+	/// `up_to`.
+	pub fn prune_up_to(up_to: SessionIndex) {
+		<Self as Store>::StoredRange::mutate(|range| {
+			let (start, end) = match *range {
+				Some(range) => range,
+				None => return, // nothing to prune.
+			};
+
+			let up_to = rstd::cmp::min(up_to, end);
+
+			if up_to < start {
+				return // out of bounds. harmless.
+			}
+
+			(start..up_to).for_each(<Self as Store>::HistoricalSessions::remove);
+
+			let new_start = up_to;
+			*range = if new_start == end {
+				None // nothing is stored.
+			} else {
+				Some((new_start, end))
+			}
+		})
+	}
+}
+
+/// Specialization of the crate-level `OnSessionEnding` which returns the old
+/// set of full identification when changing the validator set.
+pub trait OnSessionEnding<ValidatorId, FullIdentification>: crate::OnSessionEnding<ValidatorId> {
+	/// If there was a validator set change, its returns the set of new validators along with the
+	/// old validators and their full identifications.
+	fn on_session_ending(ending: SessionIndex, will_apply_at: SessionIndex)
+		-> Option<(Vec<ValidatorId>, Vec<(ValidatorId, FullIdentification)>)>;
+}
+
+/// An `OnSessionEnding` implementation that wraps an inner `I` and also
+/// sets the historical trie root of the ending session.
+pub struct NoteHistoricalRoot<T, I>(rstd::marker::PhantomData<(T, I)>);
+
+impl<T: Trait, I> crate::OnSessionEnding<T::ValidatorId> for NoteHistoricalRoot<T, I>
+	where I: OnSessionEnding<T::ValidatorId, T::FullIdentification>
+{
+	fn on_session_ending(ending: SessionIndex, applied_at: SessionIndex) -> Option<Vec<T::ValidatorId>> {
+		StoredRange::mutate(|range| {
+			range.get_or_insert_with(|| (ending, ending)).1 = ending + 1;
+		});
+
+		// do all of this _before_ calling the other `on_session_ending` impl
+		// so that we have e.g. correct exposures from the _current_.
+
+		let count = <SessionModule<T>>::validators().len() as u32;
+		match ProvingTrie::<T>::generate_for(ending) {
+			Ok(trie) => <HistoricalSessions<T>>::insert(ending, &(trie.root, count)),
+			Err(reason) => {
+				print("Failed to generate historical ancestry-inclusion proof.");
+				print(reason);
+			}
+		};
+
+		// trie has been generated for this session, so it's no longer queued.
+		<CachedObsolete<T>>::remove(&ending);
+
+		let (new_validators, old_exposures) = <I as OnSessionEnding<_, _>>::on_session_ending(ending, applied_at)?;
+
+		// every session from `ending+1 .. applied_at` now has obsolete `FullIdentification`
+		// now that a new validator election has occurred.
+		// we cache these in the trie until those sessions themselves end.
+		for obsolete in (ending + 1) .. applied_at {
+			<CachedObsolete<T>>::insert(obsolete, &old_exposures);
+		}
+
+		Some(new_validators)
+	}
+}
+
+type HasherOf<T> = <<T as system::Trait>::Hashing as HashT>::Hasher;
+
+/// A tuple of the validator's ID and their full identification.
+pub type IdentificationTuple<T> = (<T as crate::Trait>::ValidatorId, <T as Trait>::FullIdentification);
+
+/// a trie instance for checking and generating proofs.
+pub struct ProvingTrie<T: Trait> {
+	db: MemoryDB<HasherOf<T>>,
+	root: T::Hash,
+}
+
+impl<T: Trait> ProvingTrie<T> {
+	fn generate_for(now: SessionIndex) -> Result<Self, &'static str> {
+		let mut db = MemoryDB::default();
+		let mut root = Default::default();
+
+		fn build<T: Trait, I>(root: &mut T::Hash, db: &mut MemoryDB<HasherOf<T>>, validators: I)
+			-> Result<(), &'static str>
+			where I: IntoIterator<Item=(T::ValidatorId, Option<T::FullIdentification>)>
+		{
+			let mut trie = TrieDBMut::new(db, root);
+			for (i, (validator, full_id)) in validators.into_iter().enumerate() {
+				let i = i as u32;
+				let keys = match <SessionModule<T>>::load_keys(&validator) {
+					None => continue,
+					Some(k) => k,
+				};
+
+				let full_id = full_id.or_else(|| T::FullIdentificationOf::convert(validator.clone()));
+				let full_id = match full_id {
+					None => return Err("no full identification for a current validator"),
+					Some(full) => (validator, full),
+				};
+
+				// map each key to the owner index.
+				for key_id in T::Keys::key_ids() {
+					let key = keys.get_raw(*key_id);
+					let res = (key_id, key).using_encoded(|k|
+						i.using_encoded(|v| trie.insert(k, v))
+					);
+
+					let _ = res.map_err(|_| "failed to insert into trie")?;
+				}
+
+				// map each owner index to the full identification.
+				let _ = i.using_encoded(|k| full_id.using_encoded(|v| trie.insert(k, v)))
+					.map_err(|_| "failed to insert into trie")?;
+			}
+
+			Ok(())
+		}
+
+		// if the current session's full identifications are obsolete but cached,
+		// use those.
+		if let Some(obsolete) = <CachedObsolete<T>>::get(&now) {
+			build::<T, _>(&mut root, &mut db, obsolete.into_iter().map(|(v, f)| (v, Some(f))))?
+		} else {
+			let validators = <SessionModule<T>>::validators();
+			build::<T, _>(&mut root, &mut db, validators.into_iter().map(|v| (v, None)))?
+		}
+
+		Ok(ProvingTrie {
+			db,
+			root,
+		})
+	}
+
+	fn from_nodes(root: T::Hash, nodes: &[Vec<u8>]) -> Self {
+		use substrate_trie::HashDBT;
+
+		let mut memory_db = MemoryDB::default();
+		for node in nodes {
+			HashDBT::insert(&mut memory_db, EMPTY_PREFIX, &node[..]);
+		}
+
+		ProvingTrie {
+			db: memory_db,
+			root,
+		}
+	}
+
+	/// Prove the full verification data for a given key and key ID.
+	pub fn prove(&self, key_id: KeyTypeId, key_data: &[u8]) -> Option<Vec<Vec<u8>>> {
+		let trie = TrieDB::new(&self.db, &self.root).ok()?;
+		let mut recorder = Recorder::new();
+		let val_idx = (key_id, key_data).using_encoded(|s| {
+			trie.get_with(s, &mut recorder)
+				.ok()?
+				.and_then(|raw| u32::decode(&mut &*raw).ok())
+		})?;
+
+		val_idx.using_encoded(|s| {
+			trie.get_with(s, &mut recorder)
+				.ok()?
+				.and_then(|raw| <IdentificationTuple<T>>::decode(&mut &*raw).ok())
+		})?;
+
+		Some(recorder.drain().into_iter().map(|r| r.data).collect())
+	}
+
+	/// Access the underlying trie root.
+	pub fn root(&self) -> &T::Hash {
+		&self.root
+	}
+
+	// Check a proof contained within the current memory-db. Returns `None` if the
+	// nodes within the current `MemoryDB` are insufficient to query the item.
+	fn query(&self, key_id: KeyTypeId, key_data: &[u8]) -> Option<IdentificationTuple<T>> {
+		let trie = TrieDB::new(&self.db, &self.root).ok()?;
+		let val_idx = (key_id, key_data).using_encoded(|s| trie.get(s))
+			.ok()?
+			.and_then(|raw| u32::decode(&mut &*raw).ok())?;
+
+		val_idx.using_encoded(|s| trie.get(s))
+			.ok()?
+			.and_then(|raw| <IdentificationTuple<T>>::decode(&mut &*raw).ok())
+	}
+
+}
+
+/// Proof of ownership of a specific key.
+#[derive(Encode, Decode, Clone)]
+pub struct Proof {
+	session: SessionIndex,
+	trie_nodes: Vec<Vec<u8>>,
+}
+
+impl<T: Trait, D: AsRef<[u8]>> support::traits::KeyOwnerProofSystem<(KeyTypeId, D)>
+	for Module<T>
+{
+	type Proof = Proof;
+	type IdentificationTuple = IdentificationTuple<T>;
+
+	fn prove(key: (KeyTypeId, D)) -> Option<Self::Proof> {
+		let session = <SessionModule<T>>::current_index();
+		let trie = ProvingTrie::<T>::generate_for(session).ok()?;
+
+		let (id, data) = key;
+
+		trie.prove(id, data.as_ref()).map(|trie_nodes| Proof {
+			session,
+			trie_nodes,
+		})
+	}
+
+	fn check_proof(key: (KeyTypeId, D), proof: Proof) -> Option<IdentificationTuple<T>> {
+		let (id, data) = key;
+
+		if proof.session == <SessionModule<T>>::current_index() {
+			<SessionModule<T>>::key_owner(id, data.as_ref()).and_then(|owner|
+				T::FullIdentificationOf::convert(owner.clone()).map(move |id| (owner, id))
+			)
+		} else {
+			let (root, _) = <HistoricalSessions<T>>::get(&proof.session)?;
+			let trie = ProvingTrie::<T>::from_nodes(root, &proof.trie_nodes);
+
+			trie.query(id, data.as_ref())
+		}
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use primitives::crypto::key_types::DUMMY;
+	use sr_primitives::{traits::OnInitialize, testing::UintAuthorityId};
+	use crate::mock::{
+		NEXT_VALIDATORS, force_new_session,
+		set_next_validators, Test, System, Session,
+	};
+	use support::traits::KeyOwnerProofSystem;
+
+	type Historical = Module<Test>;
+
+	fn new_test_ext() -> runtime_io::TestExternalities {
+		let mut t = system::GenesisConfig::default().build_storage::<Test>().unwrap();
+		crate::GenesisConfig::<Test> {
+			keys: NEXT_VALIDATORS.with(|l|
+				l.borrow().iter().cloned().map(|i| (i, UintAuthorityId(i).into())).collect()
+			),
+		}.assimilate_storage(&mut t).unwrap();
+		runtime_io::TestExternalities::new(t)
+	}
+
+	#[test]
+	fn generated_proof_is_good() {
+		new_test_ext().execute_with(|| {
+			set_next_validators(vec![1, 2]);
+			force_new_session();
+
+			System::set_block_number(1);
+			Session::on_initialize(1);
+
+			let encoded_key_1 = UintAuthorityId(1).encode();
+			let proof = Historical::prove((DUMMY, &encoded_key_1[..])).unwrap();
+
+			// proof-checking in the same session is OK.
+			assert!(Historical::check_proof((DUMMY, &encoded_key_1[..]), proof.clone()).is_some());
+
+			set_next_validators(vec![1, 2, 4]);
+			force_new_session();
+
+			assert!(Historical::cached_obsolete(&(proof.session + 1)).is_none());
+
+			System::set_block_number(2);
+			Session::on_initialize(2);
+
+			assert!(Historical::cached_obsolete(&(proof.session + 1)).is_some());
+
+			assert!(Historical::historical_root(proof.session).is_some());
+			assert!(Session::current_index() > proof.session);
+
+			// proof-checking in the next session is also OK.
+			assert!(Historical::check_proof((DUMMY, &encoded_key_1[..]), proof.clone()).is_some());
+
+			set_next_validators(vec![1, 2, 5]);
+
+			force_new_session();
+			System::set_block_number(3);
+			Session::on_initialize(3);
+
+			assert!(Historical::cached_obsolete(&(proof.session + 1)).is_none());
+		});
+	}
+
+	#[test]
+	fn prune_up_to_works() {
+		new_test_ext().execute_with(|| {
+			for i in 1..101u64 {
+				set_next_validators(vec![i]);
+				force_new_session();
+
+				System::set_block_number(i);
+				Session::on_initialize(i);
+
+			}
+
+			assert_eq!(StoredRange::get(), Some((0, 100)));
+
+			for i in 1..100 {
+				assert!(Historical::historical_root(i).is_some())
+			}
+
+			Historical::prune_up_to(10);
+			assert_eq!(StoredRange::get(), Some((10, 100)));
+
+			Historical::prune_up_to(9);
+			assert_eq!(StoredRange::get(), Some((10, 100)));
+
+			for i in 10..100 {
+				assert!(Historical::historical_root(i).is_some())
+			}
+
+			Historical::prune_up_to(99);
+			assert_eq!(StoredRange::get(), Some((99, 100)));
+
+			Historical::prune_up_to(100);
+			assert_eq!(StoredRange::get(), None);
+
+			for i in 101..201u64 {
+				set_next_validators(vec![i]);
+				force_new_session();
+
+				System::set_block_number(i);
+				Session::on_initialize(i);
+
+			}
+
+			assert_eq!(StoredRange::get(), Some((100, 200)));
+
+			for i in 101..200 {
+				assert!(Historical::historical_root(i).is_some())
+			}
+
+			Historical::prune_up_to(9999);
+			assert_eq!(StoredRange::get(), None);
+
+			for i in 101..200 {
+				assert!(Historical::historical_root(i).is_none())
+			}
+		});
+	}
+}

substrate/frame/session/src/mock.rs

@@ -0,0 +1,211 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Mock helpers for Session.
+
+use super::*;
+use std::cell::RefCell;
+use support::{impl_outer_origin, parameter_types};
+use primitives::{crypto::key_types::DUMMY, H256};
+use sr_primitives::{
+	Perbill, impl_opaque_keys, traits::{BlakeTwo256, IdentityLookup, ConvertInto},
+	testing::{Header, UintAuthorityId}
+};
+use sr_staking_primitives::SessionIndex;
+
+impl_opaque_keys! {
+	pub struct MockSessionKeys {
+		pub dummy: UintAuthorityId,
+	}
+}
+
+impl From<UintAuthorityId> for MockSessionKeys {
+	fn from(dummy: UintAuthorityId) -> Self {
+		Self { dummy }
+	}
+}
+
+impl_outer_origin! {
+	pub enum Origin for Test {}
+}
+
+thread_local! {
+	pub static VALIDATORS: RefCell<Vec<u64>> = RefCell::new(vec![1, 2, 3]);
+	pub static NEXT_VALIDATORS: RefCell<Vec<u64>> = RefCell::new(vec![1, 2, 3]);
+	pub static AUTHORITIES: RefCell<Vec<UintAuthorityId>> =
+		RefCell::new(vec![UintAuthorityId(1), UintAuthorityId(2), UintAuthorityId(3)]);
+	pub static FORCE_SESSION_END: RefCell<bool> = RefCell::new(false);
+	pub static SESSION_LENGTH: RefCell<u64> = RefCell::new(2);
+	pub static SESSION_CHANGED: RefCell<bool> = RefCell::new(false);
+	pub static TEST_SESSION_CHANGED: RefCell<bool> = RefCell::new(false);
+	pub static DISABLED: RefCell<bool> = RefCell::new(false);
+	// Stores if `on_before_session_end` was called
+	pub static BEFORE_SESSION_END_CALLED: RefCell<bool> = RefCell::new(false);
+}
+
+pub struct TestShouldEndSession;
+impl ShouldEndSession<u64> for TestShouldEndSession {
+	fn should_end_session(now: u64) -> bool {
+		let l = SESSION_LENGTH.with(|l| *l.borrow());
+		now % l == 0 || FORCE_SESSION_END.with(|l| { let r = *l.borrow(); *l.borrow_mut() = false; r })
+	}
+}
+
+pub struct TestSessionHandler;
+impl SessionHandler<u64> for TestSessionHandler {
+	const KEY_TYPE_IDS: &'static [sr_primitives::KeyTypeId] = &[UintAuthorityId::ID];
+	fn on_genesis_session<T: OpaqueKeys>(_validators: &[(u64, T)]) {}
+	fn on_new_session<T: OpaqueKeys>(
+		changed: bool,
+		validators: &[(u64, T)],
+		_queued_validators: &[(u64, T)],
+	) {
+		SESSION_CHANGED.with(|l| *l.borrow_mut() = changed);
+		AUTHORITIES.with(|l|
+			*l.borrow_mut() = validators.iter()
+				.map(|(_, id)| id.get::<UintAuthorityId>(DUMMY).unwrap_or_default())
+				.collect()
+		);
+	}
+	fn on_disabled(_validator_index: usize) {
+		DISABLED.with(|l| *l.borrow_mut() = true)
+	}
+	fn on_before_session_ending() {
+		BEFORE_SESSION_END_CALLED.with(|b| *b.borrow_mut() = true);
+	}
+}
+
+pub struct TestOnSessionEnding;
+impl OnSessionEnding<u64> for TestOnSessionEnding {
+	fn on_session_ending(_: SessionIndex, _: SessionIndex) -> Option<Vec<u64>> {
+		if !TEST_SESSION_CHANGED.with(|l| *l.borrow()) {
+			VALIDATORS.with(|v| {
+				let mut v = v.borrow_mut();
+				*v = NEXT_VALIDATORS.with(|l| l.borrow().clone());
+				Some(v.clone())
+			})
+		} else if DISABLED.with(|l| std::mem::replace(&mut *l.borrow_mut(), false)) {
+			// If there was a disabled validator, underlying conditions have changed
+			// so we return `Some`.
+			Some(VALIDATORS.with(|v| v.borrow().clone()))
+		} else {
+			None
+		}
+	}
+}
+
+#[cfg(feature = "historical")]
+impl crate::historical::OnSessionEnding<u64, u64> for TestOnSessionEnding {
+	fn on_session_ending(ending_index: SessionIndex, will_apply_at: SessionIndex)
+		-> Option<(Vec<u64>, Vec<(u64, u64)>)>
+	{
+		let pair_with_ids = |vals: &[u64]| vals.iter().map(|&v| (v, v)).collect::<Vec<_>>();
+		<Self as OnSessionEnding<_>>::on_session_ending(ending_index, will_apply_at)
+			.map(|vals| (pair_with_ids(&vals), vals))
+			.map(|(ids, vals)| (vals, ids))
+	}
+}
+
+pub fn authorities() -> Vec<UintAuthorityId> {
+	AUTHORITIES.with(|l| l.borrow().to_vec())
+}
+
+pub fn force_new_session() {
+	FORCE_SESSION_END.with(|l| *l.borrow_mut() = true )
+}
+
+pub fn set_session_length(x: u64) {
+	SESSION_LENGTH.with(|l| *l.borrow_mut() = x )
+}
+
+pub fn session_changed() -> bool {
+	SESSION_CHANGED.with(|l| *l.borrow())
+}
+
+pub fn set_next_validators(next: Vec<u64>) {
+	NEXT_VALIDATORS.with(|v| *v.borrow_mut() = next);
+}
+
+pub fn before_session_end_called() -> bool {
+	BEFORE_SESSION_END_CALLED.with(|b| *b.borrow())
+}
+
+pub fn reset_before_session_end_called() {
+	BEFORE_SESSION_END_CALLED.with(|b| *b.borrow_mut() = false);
+}
+
+#[derive(Clone, Eq, PartialEq)]
+pub struct Test;
+
+parameter_types! {
+	pub const BlockHashCount: u64 = 250;
+	pub const MaximumBlockWeight: u32 = 1024;
+	pub const MaximumBlockLength: u32 = 2 * 1024;
+	pub const MinimumPeriod: u64 = 5;
+	pub const AvailableBlockRatio: Perbill = Perbill::one();
+}
+
+impl system::Trait for Test {
+	type Origin = Origin;
+	type Index = u64;
+	type BlockNumber = u64;
+	type Call = ();
+	type Hash = H256;
+	type Hashing = BlakeTwo256;
+	type AccountId = u64;
+	type Lookup = IdentityLookup<Self::AccountId>;
+	type Header = Header;
+	type Event = ();
+	type BlockHashCount = BlockHashCount;
+	type MaximumBlockWeight = MaximumBlockWeight;
+	type AvailableBlockRatio = AvailableBlockRatio;
+	type MaximumBlockLength = MaximumBlockLength;
+	type Version = ();
+}
+
+impl timestamp::Trait for Test {
+	type Moment = u64;
+	type OnTimestampSet = ();
+	type MinimumPeriod = MinimumPeriod;
+}
+
+parameter_types! {
+	pub const DisabledValidatorsThreshold: Perbill = Perbill::from_percent(33);
+}
+
+impl Trait for Test {
+	type ShouldEndSession = TestShouldEndSession;
+	#[cfg(feature = "historical")]
+	type OnSessionEnding = crate::historical::NoteHistoricalRoot<Test, TestOnSessionEnding>;
+	#[cfg(not(feature = "historical"))]
+	type OnSessionEnding = TestOnSessionEnding;
+	type SessionHandler = TestSessionHandler;
+	type ValidatorId = u64;
+	type ValidatorIdOf = ConvertInto;
+	type Keys = MockSessionKeys;
+	type Event = ();
+	type SelectInitialValidators = ();
+	type DisabledValidatorsThreshold = DisabledValidatorsThreshold;
+}
+
+#[cfg(feature = "historical")]
+impl crate::historical::Trait for Test {
+	type FullIdentification = u64;
+	type FullIdentificationOf = sr_primitives::traits::ConvertInto;
+}
+
+pub type System = system::Module<Test>;
+pub type Session = Module<Test>;

substrate/frame/staking/Cargo.toml

@@ -0,0 +1,45 @@
+[package]
+name = "pallet-staking"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[dependencies]
+serde = { version = "1.0.101", optional = true }
+safe-mix = { version = "1.0.0", default-features = false }
+codec = { package = "parity-scale-codec", version = "1.0.0", default-features = false, features = ["derive"] }
+substrate-keyring = { path = "../../primitives/keyring", optional = true }
+rstd = { package = "sr-std", path = "../../primitives/sr-std", default-features = false }
+phragmen = { package = "substrate-phragmen", path = "../../primitives/phragmen", default-features = false }
+runtime-io ={ package = "sr-io", path = "../../primitives/sr-io", default-features = false }
+sr-primitives = { path = "../../primitives/sr-primitives", default-features = false }
+sr-staking-primitives = { path = "../../primitives/sr-staking-primitives", default-features = false }
+support = { package = "frame-support", path = "../support", default-features = false }
+system = { package = "frame-system", path = "../system", default-features = false }
+session = { package = "pallet-session", path = "../session", default-features = false, features = ["historical"] }
+authorship = { package = "pallet-authorship", path = "../authorship", default-features = false }
+
+[dev-dependencies]
+primitives = { package = "substrate-primitives",  path = "../../primitives/core" }
+balances = { package = "pallet-balances", path = "../balances" }
+timestamp = { package = "pallet-timestamp", path = "../timestamp" }
+pallet-staking-reward-curve = { path = "../staking/reward-curve"}
+
+[features]
+equalize = []
+default = ["std", "equalize"]
+std = [
+	"serde",
+	"safe-mix/std",
+	"substrate-keyring",
+	"codec/std",
+	"rstd/std",
+	"phragmen/std",
+	"runtime-io/std",
+	"support/std",
+	"sr-primitives/std",
+	"sr-staking-primitives/std",
+	"session/std",
+	"system/std",
+	"authorship/std",
+]

substrate/frame/staking/reward-curve/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "pallet-staking-reward-curve"
+version = "2.0.0"
+authors = ["Parity Technologies <admin@parity.io>"]
+edition = "2018"
+
+[lib]
+proc-macro = true
+
+[dependencies]
+syn = { version = "1.0.7", features = [ "full", "visit" ] }
+quote = "1.0"
+proc-macro2 = "1.0.6"
+proc-macro-crate = "0.1.4"
+
+[dev-dependencies]
+sr-primitives = { path = "../../../primitives/sr-primitives" }

substrate/frame/staking/reward-curve/src/lib.rs

@@ -0,0 +1,425 @@
+extern crate proc_macro;
+
+mod log;
+
+use log::log2;
+use proc_macro::TokenStream;
+use proc_macro2::{TokenStream as TokenStream2, Span};
+use proc_macro_crate::crate_name;
+use quote::{quote, ToTokens};
+use std::convert::TryInto;
+use syn::parse::{Parse, ParseStream};
+
+/// Accepts a number of expressions to create a instance of PiecewiseLinear which represents the
+/// NPoS curve (as detailed
+/// [here](http://research.web3.foundation/en/latest/polkadot/Token%20Economics/#inflation-model))
+/// for those parameters. Parameters are:
+/// - `min_inflation`: the minimal amount to be rewarded between validators, expressed as a fraction
+///   of total issuance. Known as `I_0` in the literature.
+///   Expressed in millionth, must be between 0 and 1_000_000.
+///
+/// - `max_inflation`: the maximum amount to be rewarded between validators, expressed as a fraction
+///   of total issuance. This is attained only when `ideal_stake` is achieved.
+///   Expressed in millionth, must be between min_inflation and 1_000_000.
+///
+/// - `ideal_stake`: the fraction of total issued tokens that should be actively staked behind
+///   validators. Known as `x_ideal` in the literature.
+///   Expressed in millionth, must be between 0_100_000 and 0_900_000.
+///
+/// - `falloff`: Known as `decay_rate` in the literature. A co-efficient dictating the strength of
+///   the global incentivisation to get the `ideal_stake`. A higher number results in less typical
+///   inflation at the cost of greater volatility for validators.
+///   Expressed in millionth, must be between 0 and 1_000_000.
+///
+/// - `max_piece_count`: The maximum number of pieces in the curve. A greater number uses more
+///   resources but results in higher accuracy.
+///   Must be between 2 and 1_000.
+///
+/// - `test_precision`: The maximum error allowed in the generated test.
+///   Expressed in millionth, must be between 0 and 1_000_000.
+///
+/// # Example
+///
+/// ```
+/// # fn main() {}
+/// use sr_primitives::curve::PiecewiseLinear;
+///
+/// pallet_staking_reward_curve::build! {
+/// 	const I_NPOS: PiecewiseLinear<'static> = curve!(
+/// 		min_inflation: 0_025_000,
+/// 		max_inflation: 0_100_000,
+/// 		ideal_stake: 0_500_000,
+/// 		falloff: 0_050_000,
+/// 		max_piece_count: 40,
+/// 		test_precision: 0_005_000,
+/// 	);
+/// }
+/// ```
+#[proc_macro]
+pub fn build(input: TokenStream) -> TokenStream {
+	let input = syn::parse_macro_input!(input as INposInput);
+
+	let points = compute_points(&input);
+
+	let declaration = generate_piecewise_linear(points);
+	let test_module = generate_test_module(&input);
+
+	let imports = match crate_name("sr-primitives") {
+		Ok(sr_primitives) => {
+			let ident = syn::Ident::new(&sr_primitives, Span::call_site());
+			quote!( extern crate #ident as _sr_primitives; )
+		},
+		Err(e) => syn::Error::new(Span::call_site(), &e).to_compile_error(),
+	};
+
+	let const_name = input.ident;
+	let const_type = input.typ;
+
+	quote!(
+		const #const_name: #const_type = {
+			#imports
+			#declaration
+		};
+		#test_module
+	).into()
+}
+
+const MILLION: u32 = 1_000_000;
+
+mod keyword {
+	syn::custom_keyword!(curve);
+	syn::custom_keyword!(min_inflation);
+	syn::custom_keyword!(max_inflation);
+	syn::custom_keyword!(ideal_stake);
+	syn::custom_keyword!(falloff);
+	syn::custom_keyword!(max_piece_count);
+	syn::custom_keyword!(test_precision);
+}
+
+struct INposInput {
+	ident: syn::Ident,
+	typ: syn::Type,
+	min_inflation: u32,
+	ideal_stake: u32,
+	max_inflation: u32,
+	falloff: u32,
+	max_piece_count: u32,
+	test_precision: u32,
+}
+
+struct Bounds {
+	min: u32,
+	min_strict: bool,
+	max: u32,
+	max_strict: bool,
+}
+
+impl Bounds {
+	fn check(&self, value: u32) -> bool {
+		let wrong = (self.min_strict && value <= self.min)
+			|| (!self.min_strict && value < self.min)
+			|| (self.max_strict && value >= self.max)
+			|| (!self.max_strict && value > self.max);
+
+		!wrong
+	}
+}
+
+impl core::fmt::Display for Bounds {
+	fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+		write!(
+			f,
+			"{}{:07}; {:07}{}",
+			if self.min_strict { "]" } else { "[" },
+			self.min,
+			self.max,
+			if self.max_strict { "[" } else { "]" },
+		)
+	}
+}
+
+fn parse_field<Token: Parse + Default + ToTokens>(input: ParseStream, bounds: Bounds)
+	-> syn::Result<u32>
+{
+	<Token>::parse(&input)?;
+	<syn::Token![:]>::parse(&input)?;
+	let value_lit = syn::LitInt::parse(&input)?;
+	let value: u32 = value_lit.base10_parse()?;
+	if !bounds.check(value) {
+		return Err(syn::Error::new(value_lit.span(), format!(
+			"Invalid {}: {},  must be in {}", Token::default().to_token_stream(), value, bounds,
+		)));
+	}
+
+	Ok(value)
+}
+
+impl Parse for INposInput {
+	fn parse(input: ParseStream) -> syn::Result<Self> {
+		let args_input;
+
+		<syn::Token![const]>::parse(&input)?;
+		let ident = <syn::Ident>::parse(&input)?;
+		<syn::Token![:]>::parse(&input)?;
+		let typ = <syn::Type>::parse(&input)?;
+		<syn::Token![=]>::parse(&input)?;
+		<keyword::curve>::parse(&input)?;
+		<syn::Token![!]>::parse(&input)?;
+		syn::parenthesized!(args_input in input);
+		<syn::Token![;]>::parse(&input)?;
+
+		if !input.is_empty() {
+			return Err(input.error("expected end of input stream, no token expected"));
+		}
+
+		let min_inflation = parse_field::<keyword::min_inflation>(&args_input, Bounds {
+			min: 0,
+			min_strict: true,
+			max: 1_000_000,
+			max_strict: false,
+		})?;
+		<syn::Token![,]>::parse(&args_input)?;
+		let max_inflation = parse_field::<keyword::max_inflation>(&args_input, Bounds {
+			min: min_inflation,
+			min_strict: true,
+			max: 1_000_000,
+			max_strict: false,
+		})?;
+		<syn::Token![,]>::parse(&args_input)?;
+		let ideal_stake = parse_field::<keyword::ideal_stake>(&args_input, Bounds {
+			min: 0_100_000,
+			min_strict: false,
+			max: 0_900_000,
+			max_strict: false,
+		})?;
+		<syn::Token![,]>::parse(&args_input)?;
+		let falloff = parse_field::<keyword::falloff>(&args_input, Bounds {
+			min: 0_010_000,
+			min_strict: false,
+			max: 1_000_000,
+			max_strict: false,
+		})?;
+		<syn::Token![,]>::parse(&args_input)?;
+		let max_piece_count = parse_field::<keyword::max_piece_count>(&args_input, Bounds {
+			min: 2,
+			min_strict: false,
+			max: 1_000,
+			max_strict: false,
+		})?;
+		<syn::Token![,]>::parse(&args_input)?;
+		let test_precision = parse_field::<keyword::test_precision>(&args_input, Bounds {
+			min: 0,
+			min_strict: false,
+			max: 1_000_000,
+			max_strict: false,
+		})?;
+		<Option<syn::Token![,]>>::parse(&args_input)?;
+
+		if !args_input.is_empty() {
+			return Err(args_input.error("expected end of input stream, no token expected"));
+		}
+
+		Ok(Self {
+			ident,
+			typ,
+			min_inflation,
+			ideal_stake,
+			max_inflation,
+			falloff,
+			max_piece_count,
+			test_precision,
+		})
+	}
+}
+
+struct INPoS {
+	i_0: u32,
+	i_ideal_times_x_ideal: u32,
+	i_ideal: u32,
+	x_ideal: u32,
+	d: u32,
+}
+
+impl INPoS {
+	fn from_input(input: &INposInput) -> Self {
+		INPoS {
+			i_0: input.min_inflation,
+			i_ideal: (input.max_inflation as u64 * MILLION as u64 / input.ideal_stake as u64)
+				.try_into().unwrap(),
+			i_ideal_times_x_ideal: input.max_inflation,
+			x_ideal: input.ideal_stake,
+			d: input.falloff,
+		}
+	}
+
+	fn compute_opposite_after_x_ideal(&self, y: u32) -> u32 {
+		if y == self.i_0 {
+			return u32::max_value();
+		}
+		let log = log2(self.i_ideal_times_x_ideal - self.i_0, y - self.i_0);
+
+		let term: u32 = ((self.d as u64 * log as u64) / 1_000_000).try_into().unwrap();
+
+		self.x_ideal + term
+	}
+}
+
+fn compute_points(input: &INposInput) -> Vec<(u32, u32)> {
+	let inpos = INPoS::from_input(input);
+
+	let mut points = vec![];
+	points.push((0, inpos.i_0));
+	points.push((inpos.x_ideal, inpos.i_ideal_times_x_ideal));
+
+	// For each point p: (next_p.0 - p.0) < segment_lenght && (next_p.1 - p.1) < segment_lenght.
+	// This ensures that the total number of segment doesn't overflow max_piece_count.
+	let max_length = (input.max_inflation - input.min_inflation + 1_000_000 - inpos.x_ideal)
+		/ (input.max_piece_count - 1);
+
+	let mut delta_y = max_length;
+	let mut y = input.max_inflation;
+
+	// The algorithm divide the curve in segment with vertical len and horizontal len less
+	// than `max_length`. This is not very accurate in case of very consequent steep.
+	while delta_y != 0 {
+		let next_y = y - delta_y;
+
+		if next_y <= input.min_inflation {
+			delta_y = delta_y.saturating_sub(1);
+			continue
+		}
+
+		let next_x = inpos.compute_opposite_after_x_ideal(next_y);
+
+		if (next_x - points.last().unwrap().0) > max_length {
+			delta_y = delta_y.saturating_sub(1);
+			continue
+		}
+
+		if next_x >= 1_000_000 {
+			let prev = points.last().unwrap();
+			// Compute the y corresponding to x=1_000_000 using the this point and the previous one.
+
+			let delta_y: u32 = (
+				(next_x - 1_000_000) as u64
+				* (prev.1 - next_y) as u64
+				/ (next_x - prev.0) as u64
+			).try_into().unwrap();
+
+			let y = next_y + delta_y;
+
+			points.push((1_000_000, y));
+			return points;
+		}
+		points.push((next_x, next_y));
+		y = next_y;
+	}
+
+	points.push((1_000_000, inpos.i_0));
+
+	points
+}
+
+fn generate_piecewise_linear(points: Vec<(u32, u32)>) -> TokenStream2 {
+	let mut points_tokens = quote!();
+
+	let max = points.iter()
+		.map(|&(_, x)| x)
+		.max()
+		.unwrap_or(0)
+		.checked_mul(1_000)
+		// clip at 1.0 for sanity only since it'll panic later if too high.
+		.unwrap_or(1_000_000_000);
+
+	for (x, y) in points {
+		let error = || panic!(format!(
+			"Generated reward curve approximation doesn't fit into [0, 1] -> [0, 1] \
+			because of point:
+			x = {:07} per million
+			y = {:07} per million",
+			x, y
+		));
+
+		let x_perbill = x.checked_mul(1_000).unwrap_or_else(error);
+		let y_perbill = y.checked_mul(1_000).unwrap_or_else(error);
+
+		points_tokens.extend(quote!(
+			(
+				_sr_primitives::Perbill::from_parts(#x_perbill),
+				_sr_primitives::Perbill::from_parts(#y_perbill),
+			),
+		));
+	}
+
+	quote!(
+		_sr_primitives::curve::PiecewiseLinear::<'static> {
+			points: & [ #points_tokens ],
+			maximum: _sr_primitives::Perbill::from_parts(#max),
+		}
+	)
+}
+
+fn generate_test_module(input: &INposInput) -> TokenStream2 {
+	let inpos = INPoS::from_input(input);
+
+	let ident = &input.ident;
+	let precision = input.test_precision;
+	let i_0 = inpos.i_0 as f64/ MILLION as f64;
+	let i_ideal_times_x_ideal = inpos.i_ideal_times_x_ideal as f64 / MILLION as f64;
+	let i_ideal = inpos.i_ideal as f64 / MILLION as f64;
+	let x_ideal = inpos.x_ideal as f64 / MILLION as f64;
+	let d = inpos.d as f64 / MILLION as f64;
+	let max_piece_count = input.max_piece_count;
+
+	quote!(
+		#[cfg(test)]
+		mod __pallet_staking_reward_curve_test_module {
+			fn i_npos(x: f64) -> f64 {
+				if x <= #x_ideal {
+					#i_0 + x * (#i_ideal - #i_0 / #x_ideal)
+				} else {
+					#i_0 + (#i_ideal_times_x_ideal - #i_0) * 2_f64.powf((#x_ideal - x) / #d)
+				}
+			}
+
+			const MILLION: u32 = 1_000_000;
+
+			#[test]
+			fn reward_curve_precision() {
+				for &base in [MILLION, u32::max_value()].into_iter() {
+					let number_of_check = 100_000.min(base);
+					for check_index in 0..=number_of_check {
+						let i = (check_index as u64 * base as u64 / number_of_check as u64) as u32;
+						let x = i as f64 / base as f64;
+						let float_res = (i_npos(x) * base as f64).round() as u32;
+						let int_res = super::#ident.calculate_for_fraction_times_denominator(i, base);
+						let err = (
+							(float_res.max(int_res) - float_res.min(int_res)) as u64
+							* MILLION as u64
+							/ float_res as u64
+						) as u32;
+						if err > #precision {
+							panic!(format!("\n\
+								Generated reward curve approximation differ from real one:\n\t\
+								for i = {} and base = {}, f(i/base) * base = {},\n\t\
+								but approximation = {},\n\t\
+								err = {:07} millionth,\n\t\
+								try increase the number of segment: {} or the test_error: {}.\n",
+								i, base, float_res, int_res, err, #max_piece_count, #precision
+							));
+						}
+					}
+				}
+			}
+
+			#[test]
+			fn reward_curve_piece_count() {
+				assert!(
+					super::#ident.points.len() as u32 - 1 <= #max_piece_count,
+					"Generated reward curve approximation is invalid: \
+					has more points than specified, please fill an issue."
+				);
+			}
+		}
+	).into()
+}

substrate/frame/staking/reward-curve/src/log.rs

@@ -0,0 +1,70 @@
+use std::convert::TryInto;
+
+/// Return Per-million value.
+pub fn log2(p: u32, q: u32) -> u32 {
+	assert!(p >= q);
+	assert!(p <= u32::max_value()/2);
+
+	// This restriction should not be mandatory. But function is only tested and used for this.
+	assert!(p <= 1_000_000);
+	assert!(q <= 1_000_000);
+
+	if p == q {
+		return 0
+	}
+
+	let mut n = 0u32;
+	while !(p >= 2u32.pow(n)*q) || !(p < 2u32.pow(n+1)*q) {
+		n += 1;
+	}
+	assert!(p < 2u32.pow(n+1) * q);
+
+	let y_num: u32 = (p - 2u32.pow(n) * q).try_into().unwrap();
+	let y_den: u32 = (p + 2u32.pow(n) * q).try_into().unwrap();
+
+	let _2_div_ln_2 = 2_885_390u32;
+
+	let taylor_term = |k: u32| -> u32 {
+		if k == 0 {
+			(_2_div_ln_2 as u128 * (y_num as u128).pow(1) / (y_den as u128).pow(1))
+				.try_into().unwrap()
+		} else {
+			let mut res = _2_div_ln_2 as u128 * (y_num as u128).pow(3) / (y_den as u128).pow(3);
+			for _ in 1..k {
+				res = res * (y_num as u128).pow(2) / (y_den as u128).pow(2);
+			}
+			res /= 2 * k as u128 + 1;
+
+			res.try_into().unwrap()
+		}
+	};
+
+	let mut res = n * 1_000_000u32;
+	let mut k = 0;
+	loop {
+		let term = taylor_term(k);
+		if term == 0 {
+			break
+		}
+
+		res += term;
+		k += 1;
+	}
+
+	res
+}
+
+#[test]
+fn test_log() {
+	let div = 1_000;
+	for p in 0..=div {
+		for q in 1..=p {
+			let p: u32 = (1_000_000 as u64 * p as u64 / div as u64).try_into().unwrap();
+			let q: u32 = (1_000_000 as u64 * q as u64 / div as u64).try_into().unwrap();
+
+			let res = - (log2(p, q) as i64);
+			let expected = ((q as f64 / p as f64).log(2.0) * 1_000_000 as f64).round() as i64;
+			assert!((res - expected).abs() <= 6);
+		}
+	}
+}

substrate/frame/staking/reward-curve/tests/test.rs

@@ -0,0 +1,44 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Test crate for pallet-staking-reward-curve. Allows to test for procedural macro.
+//! See tests directory.
+
+mod test_small_falloff {
+	pallet_staking_reward_curve::build! {
+		const REWARD_CURVE: sr_primitives::curve::PiecewiseLinear<'static> = curve!(
+			min_inflation: 0_020_000,
+			max_inflation: 0_200_000,
+			ideal_stake: 0_600_000,
+			falloff: 0_010_000,
+			max_piece_count: 200,
+			test_precision: 0_005_000,
+			);
+	}
+}
+
+mod test_big_falloff {
+	pallet_staking_reward_curve::build! {
+		const REWARD_CURVE: sr_primitives::curve::PiecewiseLinear<'static> = curve!(
+			min_inflation: 0_100_000,
+			max_inflation: 0_400_000,
+			ideal_stake: 0_400_000,
+			falloff: 1_000_000,
+			max_piece_count: 40,
+			test_precision: 0_005_000,
+			);
+	}
+}

substrate/frame/staking/src/inflation.rs

@@ -0,0 +1,103 @@
+// Copyright 2019 Parity Technologies (UK) Ltd.
+// This file is part of Substrate.
+
+// Substrate is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Substrate is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Substrate.  If not, see <http://www.gnu.org/licenses/>.
+
+//! This module expose one function `P_NPoS` (Payout NPoS) or `compute_total_payout` which returns
+//! the total payout for the era given the era duration and the staking rate in NPoS.
+//! The staking rate in NPoS is the total amount of tokens staked by nominators and validators,
+//! divided by the total token supply.
+
+use sr_primitives::{Perbill, traits::SimpleArithmetic, curve::PiecewiseLinear};
+
+/// The total payout to all validators (and their nominators) per era.
+///
+/// Defined as such:
+/// `payout = yearly_inflation(npos_token_staked / total_tokens) * total_tokans / era_per_year`
+///
+/// `era_duration` is expressed in millisecond.
+pub fn compute_total_payout<N>(
+	yearly_inflation: &PiecewiseLinear<'static>,
+	npos_token_staked: N,
+	total_tokens: N,
+	era_duration: u64
+) -> (N, N) where N: SimpleArithmetic + Clone {
+	// Milliseconds per year for the Julian year (365.25 days).
+	const MILLISECONDS_PER_YEAR: u64 = 1000 * 3600 * 24 * 36525 / 100;
+
+	let portion = Perbill::from_rational_approximation(era_duration as u64, MILLISECONDS_PER_YEAR);
+	let payout = portion * yearly_inflation.calculate_for_fraction_times_denominator(
+		npos_token_staked,
+		total_tokens.clone(),
+	);
+	let maximum = portion * (yearly_inflation.maximum * total_tokens);
+	(payout, maximum)
+}
+
+#[cfg(test)]
+mod test {
+	use sr_primitives::curve::PiecewiseLinear;
+
+	pallet_staking_reward_curve::build! {
+		const I_NPOS: PiecewiseLinear<'static> = curve!(
+			min_inflation: 0_025_000,
+			max_inflation: 0_100_000,
+			ideal_stake: 0_500_000,
+			falloff: 0_050_000,
+			max_piece_count: 40,
+			test_precision: 0_005_000,
+		);
+	}
+
+	#[test]
+	fn npos_curve_is_sensible() {
+		const YEAR: u64 = 365 * 24 * 60 * 60 * 1000;
+
+		// check maximum inflation.
+		// not 10_000 due to rounding error.
+		assert_eq!(super::compute_total_payout(&I_NPOS, 0, 100_000u64, YEAR).1, 9_993);
+
+		//super::I_NPOS.calculate_for_fraction_times_denominator(25, 100)
+		assert_eq!(super::compute_total_payout(&I_NPOS, 0, 100_000u64, YEAR).0, 2_498);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 5_000, 100_000u64, YEAR).0, 3_248);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 25_000, 100_000u64, YEAR).0, 6_246);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 40_000, 100_000u64, YEAR).0, 8_494);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 50_000, 100_000u64, YEAR).0, 9_993);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 60_000, 100_000u64, YEAR).0, 4_379);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 75_000, 100_000u64, YEAR).0, 2_733);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 95_000, 100_000u64, YEAR).0, 2_513);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 100_000, 100_000u64, YEAR).0, 2_505);
+
+		const DAY: u64 = 24 * 60 * 60 * 1000;
+		assert_eq!(super::compute_total_payout(&I_NPOS, 25_000, 100_000u64, DAY).0, 17);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 50_000, 100_000u64, DAY).0, 27);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 75_000, 100_000u64, DAY).0, 7);
+
+		const SIX_HOURS: u64 = 6 * 60 * 60 * 1000;
+		assert_eq!(super::compute_total_payout(&I_NPOS, 25_000, 100_000u64, SIX_HOURS).0, 4);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 50_000, 100_000u64, SIX_HOURS).0, 7);
+		assert_eq!(super::compute_total_payout(&I_NPOS, 75_000, 100_000u64, SIX_HOURS).0, 2);
+
+		const HOUR: u64 = 60 * 60 * 1000;
+		assert_eq!(
+			super::compute_total_payout(
+				&I_NPOS,
+				2_500_000_000_000_000_000_000_000_000u128,
+				5_000_000_000_000_000_000_000_000_000u128,
+				HOUR
+			).0,
+			57_038_500_000_000_000_000_000
+		);
+	}
+}