Make System Parachains trusted Teleporters (#1368)

Make System Parachain trusted Teleporters of each other.

Migration of https://github.com/paritytech/cumulus/pull/2842

---------

Co-authored-by: command-bot <>
Co-authored-by: joe petrowski <25483142+joepetrowski@users.noreply.github.com>

cumulus/parachains/common/src/xcm_config.rs

@@ -15,6 +15,7 @@
 
 use crate::impls::AccountIdOf;
 use core::marker::PhantomData;
+use cumulus_primitives_core::{IsSystem, ParaId};
 use frame_support::{
 	traits::{fungibles::Inspect, tokens::ConversionToAssetBalance, ContainsPair},
 	weights::Weight,
@@ -78,3 +79,85 @@ impl<Location: Get<MultiLocation>> ContainsPair<MultiAsset, MultiLocation>
 		matches!(asset.id, Concrete(ref id) if id == origin && origin == &Location::get())
 	}
 }
+
+/// Accepts an asset if it is a concrete asset from the system (Relay Chain or system parachain).
+pub struct ConcreteAssetFromSystem<AssetLocation>(PhantomData<AssetLocation>);
+impl<AssetLocation: Get<MultiLocation>> ContainsPair<MultiAsset, MultiLocation>
+	for ConcreteAssetFromSystem<AssetLocation>
+{
+	fn contains(asset: &MultiAsset, origin: &MultiLocation) -> bool {
+		log::trace!(target: "xcm::contains", "ConcreteAssetFromSystem asset: {:?}, origin: {:?}", asset, origin);
+		let is_system = match origin {
+			// The Relay Chain
+			MultiLocation { parents: 1, interior: Here } => true,
+			// System parachain
+			MultiLocation { parents: 1, interior: X1(Parachain(id)) } =>
+				ParaId::from(*id).is_system(),
+			// Others
+			_ => false,
+		};
+		matches!(asset.id, Concrete(id) if id == AssetLocation::get()) && is_system
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use frame_support::parameter_types;
+
+	use super::{
+		ConcreteAssetFromSystem, ContainsPair, GeneralIndex, Here, MultiAsset, MultiLocation,
+		PalletInstance, Parachain, Parent,
+	};
+
+	parameter_types! {
+		pub const RelayLocation: MultiLocation = MultiLocation::parent();
+	}
+
+	#[test]
+	fn concrete_asset_from_relay_works() {
+		let expected_asset: MultiAsset = (Parent, 1000000).into();
+		let expected_origin: MultiLocation = (Parent, Here).into();
+
+		assert!(<ConcreteAssetFromSystem<RelayLocation>>::contains(
+			&expected_asset,
+			&expected_origin
+		));
+	}
+
+	#[test]
+	fn concrete_asset_from_sibling_system_para_fails_for_wrong_asset() {
+		let unexpected_assets: Vec<MultiAsset> = vec![
+			(Here, 1000000).into(),
+			((PalletInstance(50), GeneralIndex(1)), 1000000).into(),
+			((Parent, Parachain(1000), PalletInstance(50), GeneralIndex(1)), 1000000).into(),
+		];
+		let expected_origin: MultiLocation = (Parent, Parachain(1000)).into();
+
+		unexpected_assets.iter().for_each(|asset| {
+			assert!(!<ConcreteAssetFromSystem<RelayLocation>>::contains(asset, &expected_origin));
+		});
+	}
+
+	#[test]
+	fn concrete_asset_from_sibling_system_para_works_for_correct_asset() {
+		// (para_id, expected_result)
+		let test_data = vec![
+			(0, true),
+			(1, true),
+			(1000, true),
+			(1999, true),
+			(2000, false), // Not a System Parachain
+			(2001, false), // Not a System Parachain
+		];
+
+		let expected_asset: MultiAsset = (Parent, 1000000).into();
+
+		for (para_id, expected_result) in test_data {
+			let origin: MultiLocation = (Parent, Parachain(para_id)).into();
+			assert_eq!(
+				expected_result,
+				<ConcreteAssetFromSystem<RelayLocation>>::contains(&expected_asset, &origin)
+			);
+		}
+	}
+}

cumulus/parachains/integration-tests/emulated/assets/asset-hub-rococo/Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "asset-hub-rococo-integration-tests"
+version = "1.0.0"
+authors.workspace = true
+edition.workspace = true
+description = "Asset Hub Rococo runtime integration tests with xcm-emulator"
+publish = false
+
+[dependencies]
+codec = { package = "parity-scale-codec", version = "3.4.0", default-features = false }
+
+# Substrate
+frame-support = { path = "../../../../../../substrate/frame/support", default-features = false}
+xcm = { package = "staging-xcm", path = "../../../../../../polkadot/xcm", default-features = false}
+
+# Local
+xcm-emulator = { path = "../../../../../xcm/xcm-emulator", default-features = false}
+integration-tests-common = { path = "../../common", default-features = false}
+
+[features]
+runtime-benchmarks = [
+	"frame-support/runtime-benchmarks",
+	"integration-tests-common/runtime-benchmarks",
+]

cumulus/parachains/integration-tests/emulated/assets/asset-hub-rococo/src/lib.rs

@@ -0,0 +1,26 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+pub use frame_support::assert_ok;
+pub use integration_tests_common::{
+	constants::asset_hub_rococo::ED as ASSET_HUB_ROCOCO_ED, test_parachain_is_trusted_teleporter,
+	AssetHubRococo, AssetHubRococoPallet, AssetHubRococoSender, BridgeHubRococo,
+	BridgeHubRococoReceiver,
+};
+pub use xcm::prelude::*;
+pub use xcm_emulator::{assert_expected_events, bx, Chain, Parachain, TestExt};
+
+#[cfg(test)]
+mod tests;

cumulus/parachains/integration-tests/emulated/assets/asset-hub-rococo/src/tests/mod.rs

@@ -0,0 +1,16 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+mod teleport;

cumulus/parachains/integration-tests/emulated/assets/asset-hub-rococo/src/tests/teleport.rs

@@ -0,0 +1,28 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::*;
+
+#[test]
+fn teleport_to_other_system_parachains_works() {
+	let amount = ASSET_HUB_ROCOCO_ED * 100;
+	let native_asset: VersionedMultiAssets = (Parent, amount).into();
+
+	test_parachain_is_trusted_teleporter!(
+		AssetHubRococo,        // Origin
+		vec![BridgeHubRococo], // Destinations
+		(native_asset, amount)
+	);
+}

cumulus/parachains/integration-tests/emulated/assets/asset-hub-westend/src/lib.rs

@@ -27,6 +27,7 @@ pub use integration_tests_common::{
 		asset_hub_westend::ED as ASSET_HUB_WESTEND_ED, westend::ED as WESTEND_ED,
 		PROOF_SIZE_THRESHOLD, REF_TIME_THRESHOLD, XCM_V3,
 	},
+	test_parachain_is_trusted_teleporter,
 	xcm_helpers::{xcm_transact_paid_execution, xcm_transact_unpaid_execution},
 	AssetHubWestend, AssetHubWestendPallet, AssetHubWestendReceiver, AssetHubWestendSender,
 	PenpalWestendA, PenpalWestendAPallet, PenpalWestendAReceiver, PenpalWestendASender, Westend,
@@ -88,5 +89,4 @@ pub fn system_para_test_args(
 }
 
 #[cfg(test)]
-#[cfg(not(feature = "runtime-benchmarks"))]
 mod tests;

cumulus/parachains/integration-tests/emulated/assets/asset-hub-westend/src/tests/teleport.rs

@@ -357,3 +357,17 @@ fn teleport_native_assets_from_system_para_to_relay_fails() {
 	// Receiver's balance does not change
 	assert_eq!(receiver_balance_after, receiver_balance_before);
 }
+
+// TODO: uncomment when CollectivesWestend and BridgeHubWestend are implemented
+// https://github.com/paritytech/polkadot-sdk/pull/1737 (CollectivesWestend)
+// #[test]
+// fn teleport_to_other_system_parachains_works() {
+// 	let amount = ASSET_HUB_WESTEND_ED * 100;
+// 	let native_asset: VersionedMultiAssets = (Parent, amount).into();
+
+// 	test_parachain_is_trusted_teleporter!(
+// 		AssetHubWestend,                            // Origin
+// 		vec![CollectivesWestend, BridgeHubWestend], // Destinations
+// 		(native_asset, amount)
+// 	);
+// }

cumulus/parachains/integration-tests/emulated/bridges/bridge-hub-rococo/src/lib.rs

@@ -17,12 +17,13 @@ pub use bp_messages::LaneId;
 pub use frame_support::assert_ok;
 pub use integration_tests_common::{
 	constants::{
-		asset_hub_rococo::ED as ASSET_HUB_ROCOCO_ED, rococo::ED as ROCOCO_ED, PROOF_SIZE_THRESHOLD,
-		REF_TIME_THRESHOLD, XCM_V3,
+		bridge_hub_rococo::ED as BRIDGE_HUB_ROCOCO_ED, rococo::ED as ROCOCO_ED,
+		PROOF_SIZE_THRESHOLD, REF_TIME_THRESHOLD, XCM_V3,
 	},
+	test_parachain_is_trusted_teleporter,
 	xcm_helpers::{xcm_transact_paid_execution, xcm_transact_unpaid_execution},
-	AssetHubRococo, AssetHubRococoReceiver, AssetHubWococo, BridgeHubRococo, BridgeHubWococo,
-	PenpalRococoA, Rococo, RococoPallet,
+	AssetHubRococo, AssetHubRococoReceiver, AssetHubWococo, BridgeHubRococo, BridgeHubRococoPallet,
+	BridgeHubRococoSender, BridgeHubWococo, PenpalRococoA, Rococo, RococoPallet,
 };
 pub use parachains_common::{AccountId, Balance};
 pub use xcm::{
@@ -63,5 +64,4 @@ pub fn relay_test_args(amount: Balance) -> TestArgs {
 }
 
 #[cfg(test)]
-#[cfg(not(feature = "runtime-benchmarks"))]
 mod tests;

cumulus/parachains/integration-tests/emulated/bridges/bridge-hub-rococo/src/tests/mod.rs

@@ -14,3 +14,4 @@
 // limitations under the License.
 
 mod example;
+mod teleport;

cumulus/parachains/integration-tests/emulated/bridges/bridge-hub-rococo/src/tests/teleport.rs

@@ -0,0 +1,28 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+use crate::*;
+
+#[test]
+fn teleport_to_other_system_parachains_works() {
+	let amount = BRIDGE_HUB_ROCOCO_ED * 100;
+	let native_asset: VersionedMultiAssets = (Parent, amount).into();
+
+	test_parachain_is_trusted_teleporter!(
+		BridgeHubRococo,      // Origin
+		vec![AssetHubRococo], // Destinations
+		(native_asset, amount)
+	);
+}

cumulus/parachains/integration-tests/emulated/common/Cargo.toml

@@ -19,6 +19,7 @@ frame-support = { path = "../../../../../substrate/frame/support", default-featu
 sp-core = { path = "../../../../../substrate/primitives/core", default-features = false}
 sp-consensus-babe = { path = "../../../../../substrate/primitives/consensus/babe", default-features = false}
 pallet-assets = { path = "../../../../../substrate/frame/assets", default-features = false}
+pallet-balances = { path = "../../../../../substrate/frame/balances", default-features = false}
 pallet-staking = { path = "../../../../../substrate/frame/staking", default-features = false}
 pallet-message-queue = { path = "../../../../../substrate/frame/message-queue", default-features = false}
 pallet-im-online = { path = "../../../../../substrate/frame/im-online", default-features = false}
@@ -70,6 +71,7 @@ runtime-benchmarks = [
 	"cumulus-pallet-xcmp-queue/runtime-benchmarks",
 	"frame-support/runtime-benchmarks",
 	"pallet-assets/runtime-benchmarks",
+	"pallet-balances/runtime-benchmarks",
 	"pallet-bridge-messages/runtime-benchmarks",
 	"pallet-im-online/runtime-benchmarks",
 	"pallet-message-queue/runtime-benchmarks",

cumulus/parachains/integration-tests/emulated/common/src/lib.rs

@@ -15,6 +15,7 @@
 
 pub mod constants;
 pub mod impls;
+pub mod macros;
 pub mod xcm_helpers;
 
 use constants::{
@@ -22,16 +23,24 @@ use constants::{
 	asset_hub_rococo, asset_hub_westend, bridge_hub_rococo, penpal, rococo, westend,
 };
 use impls::{RococoWococoMessageHandler, WococoRococoMessageHandler};
+pub use paste;
 
 // Substrate
 use frame_support::traits::OnInitialize;
+pub use pallet_balances;
 
 // Cumulus
+pub use cumulus_pallet_xcmp_queue;
+pub use xcm_emulator::Chain;
 use xcm_emulator::{
 	decl_test_bridges, decl_test_networks, decl_test_parachains, decl_test_relay_chains,
 	decl_test_sender_receiver_accounts_parameter_types, DefaultMessageProcessor,
 };
 
+// Polkadot
+pub use pallet_xcm;
+pub use xcm::prelude::{AccountId32, WeightLimit};
+
 decl_test_relay_chains! {
 	#[api_version(8)]
 	pub struct Westend {
@@ -120,6 +129,7 @@ decl_test_parachains! {
 		pallets = {
 			PolkadotXcm: penpal_runtime::PolkadotXcm,
 			Assets: penpal_runtime::Assets,
+			Balances: penpal_runtime::Balances,
 		}
 	},
 	// Rococo Parachains
@@ -156,6 +166,7 @@ decl_test_parachains! {
 		pallets = {
 			PolkadotXcm: asset_hub_kusama_runtime::PolkadotXcm,
 			Assets: asset_hub_kusama_runtime::Assets,
+			Balances: asset_hub_kusama_runtime::Balances,
 		}
 	},
 	// Wococo Parachains
@@ -190,6 +201,7 @@ decl_test_parachains! {
 		pallets = {
 			PolkadotXcm: asset_hub_polkadot_runtime::PolkadotXcm,
 			Assets: asset_hub_polkadot_runtime::Assets,
+			Balances: asset_hub_polkadot_runtime::Balances,
 		}
 	},
 	pub struct PenpalRococoA {

cumulus/parachains/integration-tests/emulated/common/src/macros.rs

@@ -0,0 +1,102 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#[macro_export]
+macro_rules! test_parachain_is_trusted_teleporter {
+	( $sender_para:ty, vec![$( $receiver_para:ty ),+], ($assets:expr, $amount:expr) ) => {
+		$crate::paste::paste! {
+			// init Origin variables
+			let sender = [<$sender_para Sender>]::get();
+			let mut para_sender_balance_before =
+				<$sender_para as $crate::Chain>::account_data_of(sender.clone()).free;
+			let origin = <$sender_para as $crate::Chain>::RuntimeOrigin::signed(sender.clone());
+			let fee_asset_item = 0;
+			let weight_limit = $crate::WeightLimit::Unlimited;
+
+			$(
+				{
+					// init Destination variables
+					let receiver = [<$receiver_para Receiver>]::get();
+					let para_receiver_balance_before =
+						<$receiver_para as $crate::Chain>::account_data_of(receiver.clone()).free;
+					let para_destination =
+						<$sender_para>::sibling_location_of(<$receiver_para>::para_id()).into();
+					let beneficiary =
+						$crate::AccountId32 { network: None, id: receiver.clone().into() }.into();
+
+					// Send XCM message from Origin Parachain
+					// We are only testing the limited teleport version, which should be ok since success will
+					// depend only on a proper `XcmConfig` at destination.
+					<$sender_para>::execute_with(|| {
+						assert_ok!(<$sender_para as [<$sender_para Pallet>]>::PolkadotXcm::limited_teleport_assets(
+							origin.clone(),
+							bx!(para_destination),
+							bx!(beneficiary),
+							bx!($assets.clone()),
+							fee_asset_item,
+							weight_limit.clone(),
+						));
+
+						type RuntimeEvent = <$sender_para as $crate::Chain>::RuntimeEvent;
+
+						assert_expected_events!(
+							$sender_para,
+							vec![
+								RuntimeEvent::PolkadotXcm(
+									$crate::pallet_xcm::Event::Attempted { outcome: Outcome::Complete { .. } }
+								) => {},
+								RuntimeEvent::XcmpQueue(
+									$crate::cumulus_pallet_xcmp_queue::Event::XcmpMessageSent { .. }
+								) => {},
+								RuntimeEvent::Balances(
+									$crate::pallet_balances::Event::Withdraw { who: sender, amount }
+								) => {},
+							]
+						);
+					});
+
+					// Receive XCM message in Destination Parachain
+					<$receiver_para>::execute_with(|| {
+						type RuntimeEvent = <$receiver_para as $crate::Chain>::RuntimeEvent;
+
+						assert_expected_events!(
+							$receiver_para,
+							vec![
+								RuntimeEvent::Balances(
+									$crate::pallet_balances::Event::Deposit { who: receiver, .. }
+								) => {},
+								RuntimeEvent::XcmpQueue(
+									$crate::cumulus_pallet_xcmp_queue::Event::Success { .. }
+								) => {},
+							]
+						);
+					});
+
+					// Check if balances are updated accordingly in Origin and Destination Parachains
+					let para_sender_balance_after =
+						<$sender_para as $crate::Chain>::account_data_of(sender.clone()).free;
+					let para_receiver_balance_after =
+						<$receiver_para as $crate::Chain>::account_data_of(receiver.clone()).free;
+
+					assert_eq!(para_sender_balance_before - $amount, para_sender_balance_after);
+					assert!(para_receiver_balance_after > para_receiver_balance_before);
+
+					// Update sender balance
+					para_sender_balance_before = <$sender_para as $crate::Chain>::account_data_of(sender.clone()).free;
+				}
+			)+
+		}
+	};
+}

cumulus/parachains/integration-tests/emulated/common/src/xcm_helpers.rs

@@ -1,18 +1,17 @@
-// Copyright Parity Technologies (UK) Ltd.
-// This file is part of Cumulus.
+// Copyright (C) Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
 
-// Cumulus is free software: you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-
-// Cumulus is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-// GNU General Public License for more details.
-
-// You should have received a copy of the GNU General Public License
-// along with Cumulus.  If not, see <http://www.gnu.org/licenses/>.
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// 	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
 
 use parachains_common::AccountId;
 use xcm::{

cumulus/parachains/runtimes/assets/asset-hub-kusama/src/xcm_config.rs

@@ -31,7 +31,10 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::AssetFeeAsExistentialDepositMultiplier};
+use parachains_common::{
+	impls::ToStakingPot,
+	xcm_config::{AssetFeeAsExistentialDepositMultiplier, ConcreteAssetFromSystem},
+};
 use polkadot_parachain_primitives::primitives::Sibling;
 use sp_runtime::traits::ConvertInto;
 use xcm::latest::prelude::*;
@@ -39,8 +42,8 @@ use xcm_builder::{
 	AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowKnownQueryResponses,
 	AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom, CurrencyAdapter,
 	DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
-	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NativeAsset,
-	NoChecking, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
+	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NoChecking,
+	ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
 	SiblingParachainConvertsVia, SignedAccountId32AsNative, SignedToAccountId32,
 	SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId, UsingComponents,
 	WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
@@ -470,6 +473,15 @@ pub type AssetFeeAsExistentialDepositMultiplierFeeCharger = AssetFeeAsExistentia
 	TrustBackedAssetsInstance,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+///
+/// - KSM with the parent Relay Chain and sibling system parachains; and
+/// - Sibling parachains' assets from where they originate (as `ForeignCreators`).
+pub type TrustedTeleporters = (
+	ConcreteAssetFromSystem<KsmLocation>,
+	IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
+);
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -480,13 +492,7 @@ impl xcm_executor::Config for XcmConfig {
 	// Asset Hub acting _as_ a reserve location for KSM and assets created under `pallet-assets`.
 	// For KSM, users must use teleport where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	// We allow:
-	// - teleportation of KSM
-	// - teleportation of sibling parachain's assets (as ForeignCreators)
-	type IsTeleporter = (
-		NativeAsset,
-		IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
-	);
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/assets/asset-hub-polkadot/src/xcm_config.rs

@@ -27,7 +27,10 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::AssetFeeAsExistentialDepositMultiplier};
+use parachains_common::{
+	impls::ToStakingPot,
+	xcm_config::{AssetFeeAsExistentialDepositMultiplier, ConcreteAssetFromSystem},
+};
 use polkadot_parachain_primitives::primitives::Sibling;
 use sp_runtime::traits::ConvertInto;
 use xcm::latest::prelude::*;
@@ -35,8 +38,8 @@ use xcm_builder::{
 	AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowKnownQueryResponses,
 	AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom, CurrencyAdapter,
 	DenyReserveTransferToRelayChain, DenyThenTry, DescribeFamily, DescribePalletTerminal,
-	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NativeAsset,
-	NoChecking, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
+	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NoChecking,
+	ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
 	SiblingParachainConvertsVia, SignedAccountId32AsNative, SignedToAccountId32,
 	SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId, UsingComponents,
 	WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
@@ -394,6 +397,15 @@ pub type AssetFeeAsExistentialDepositMultiplierFeeCharger = AssetFeeAsExistentia
 	TrustBackedAssetsInstance,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+///
+/// - DOT with the parent Relay Chain and sibling system parachains; and
+/// - Sibling parachains' assets from where they originate (as `ForeignCreators`).
+pub type TrustedTeleporters = (
+	ConcreteAssetFromSystem<DotLocation>,
+	IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
+);
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -404,13 +416,7 @@ impl xcm_executor::Config for XcmConfig {
 	// Asset Hub acting _as_ a reserve location for DOT and assets created under `pallet-assets`.
 	// For DOT, users must use teleport where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	// We allow:
-	// - teleportation of DOT
-	// - teleportation of sibling parachain's assets (as ForeignCreators)
-	type IsTeleporter = (
-		NativeAsset,
-		IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
-	);
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs

@@ -31,7 +31,10 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::AssetFeeAsExistentialDepositMultiplier};
+use parachains_common::{
+	impls::ToStakingPot,
+	xcm_config::{AssetFeeAsExistentialDepositMultiplier, ConcreteAssetFromSystem},
+};
 use polkadot_parachain_primitives::primitives::Sibling;
 use sp_runtime::traits::ConvertInto;
 use xcm::latest::prelude::*;
@@ -39,8 +42,8 @@ use xcm_builder::{
 	AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowKnownQueryResponses,
 	AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom, CurrencyAdapter,
 	DenyReserveTransferToRelayChain, DenyThenTry, DescribeFamily, DescribePalletTerminal,
-	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NativeAsset,
-	NoChecking, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
+	EnsureXcmOrigin, FungiblesAdapter, HashedDescription, IsConcrete, LocalMint, NoChecking,
+	ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SiblingParachainAsNative,
 	SiblingParachainConvertsVia, SignedAccountId32AsNative, SignedToAccountId32,
 	SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId, UsingComponents,
 	WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
@@ -481,6 +484,15 @@ pub type AssetFeeAsExistentialDepositMultiplierFeeCharger = AssetFeeAsExistentia
 	TrustBackedAssetsInstance,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+///
+/// - WND with the parent Relay Chain and sibling system parachains; and
+/// - Sibling parachains' assets from where they originate (as `ForeignCreators`).
+pub type TrustedTeleporters = (
+	ConcreteAssetFromSystem<WestendLocation>,
+	IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
+);
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -491,13 +503,7 @@ impl xcm_executor::Config for XcmConfig {
 	// Asset Hub acting _as_ a reserve location for WND and assets created under `pallet-assets`.
 	// For WND, users must use teleport where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	// We allow:
-	// - teleportation of WND
-	// - teleportation of sibling parachain's assets (as ForeignCreators)
-	type IsTeleporter = (
-		NativeAsset,
-		IsForeignConcreteAsset<FromSiblingParachain<parachain_info::Pallet<Runtime>>>,
-	);
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-kusama/src/xcm_config.rs

@@ -24,7 +24,7 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteNativeAssetFrom};
+use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteAssetFromSystem};
 use polkadot_parachain_primitives::primitives::Sibling;
 use xcm::latest::prelude::*;
 use xcm_builder::{
@@ -177,6 +177,10 @@ pub type Barrier = TrailingSetTopicAsId<
 	>,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+/// - KSM with the parent Relay Chain and sibling parachains.
+pub type TrustedTeleporters = ConcreteAssetFromSystem<KsmRelayLocation>;
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -186,8 +190,7 @@ impl xcm_executor::Config for XcmConfig {
 	// BridgeHub does not recognize a reserve location for any asset. Users must teleport KSM
 	// where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	/// Only allow teleportation of KSM.
-	type IsTeleporter = ConcreteNativeAssetFrom<KsmRelayLocation>;
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-polkadot/src/xcm_config.rs

@@ -24,7 +24,7 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteNativeAssetFrom};
+use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteAssetFromSystem};
 use polkadot_parachain_primitives::primitives::Sibling;
 use xcm::latest::prelude::*;
 use xcm_builder::{
@@ -181,6 +181,10 @@ pub type Barrier = TrailingSetTopicAsId<
 	>,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+/// - DOT with the parent Relay Chain and sibling parachains.
+pub type TrustedTeleporters = ConcreteAssetFromSystem<DotRelayLocation>;
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -190,8 +194,7 @@ impl xcm_executor::Config for XcmConfig {
 	// BridgeHub does not recognize a reserve location for any asset. Users must teleport DOT
 	// where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	/// Only allow teleportation of DOT.
-	type IsTeleporter = ConcreteNativeAssetFrom<DotRelayLocation>;
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/xcm_config.rs

@@ -30,7 +30,7 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteNativeAssetFrom};
+use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteAssetFromSystem};
 use polkadot_parachain_primitives::primitives::Sibling;
 use sp_core::Get;
 use xcm::latest::prelude::*;
@@ -224,6 +224,10 @@ pub type Barrier = TrailingSetTopicAsId<
 	>,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+/// - NativeToken with the parent Relay Chain and sibling parachains.
+pub type TrustedTeleporters = ConcreteAssetFromSystem<RelayLocation>;
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -233,8 +237,7 @@ impl xcm_executor::Config for XcmConfig {
 	// BridgeHub does not recognize a reserve location for any asset. Users must teleport Native
 	// token where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	/// Only allow teleportation of NativeToken of relay chain.
-	type IsTeleporter = ConcreteNativeAssetFrom<RelayLocation>;
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = WeightInfoBounds<

cumulus/parachains/runtimes/collectives/collectives-polkadot/src/xcm_config.rs

@@ -24,7 +24,7 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::XcmPassthrough;
-use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteNativeAssetFrom};
+use parachains_common::{impls::ToStakingPot, xcm_config::ConcreteAssetFromSystem};
 use polkadot_parachain_primitives::primitives::Sibling;
 use xcm::latest::prelude::*;
 use xcm_builder::{
@@ -240,6 +240,10 @@ pub type Barrier = TrailingSetTopicAsId<
 	>,
 >;
 
+/// Cases where a remote origin is accepted as trusted Teleporter for a given asset:
+/// - DOT with the parent Relay Chain and sibling parachains.
+pub type TrustedTeleporters = ConcreteAssetFromSystem<DotLocation>;
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -249,8 +253,7 @@ impl xcm_executor::Config for XcmConfig {
 	// Collectives does not recognize a reserve location for any asset. Users must teleport DOT
 	// where allowed (e.g. with the Relay Chain).
 	type IsReserve = ();
-	/// Only allow teleportation of DOT.
-	type IsTeleporter = ConcreteNativeAssetFrom<DotLocation>;
+	type IsTeleporter = TrustedTeleporters;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = FixedWeightBounds<TempFixedXcmWeight, RuntimeCall, MaxInstructions>;

cumulus/parachains/runtimes/contracts/contracts-rococo/src/xcm_config.rs

@@ -24,6 +24,7 @@ use frame_support::{
 };
 use frame_system::EnsureRoot;
 use pallet_xcm::{EnsureXcm, IsMajorityOfBody, XcmPassthrough};
+use parachains_common::xcm_config::ConcreteAssetFromSystem;
 use polkadot_parachain_primitives::primitives::Sibling;
 use xcm::latest::prelude::*;
 use xcm_builder::{
@@ -144,6 +145,8 @@ pub type Barrier = TrailingSetTopicAsId<
 	>,
 >;
 
+pub type TrustedTeleporter = ConcreteAssetFromSystem<RelayLocation>;
+
 pub struct XcmConfig;
 impl xcm_executor::Config for XcmConfig {
 	type RuntimeCall = RuntimeCall;
@@ -151,7 +154,7 @@ impl xcm_executor::Config for XcmConfig {
 	type AssetTransactor = CurrencyTransactor;
 	type OriginConverter = XcmOriginToTransactDispatchOrigin;
 	type IsReserve = NativeAsset;
-	type IsTeleporter = NativeAsset;
+	type IsTeleporter = TrustedTeleporter;
 	type UniversalLocation = UniversalLocation;
 	type Barrier = Barrier;
 	type Weigher = FixedWeightBounds<UnitWeightCost, RuntimeCall, MaxInstructions>;