• Bastian Köcher's avatar
    `pallet-treasury`: Ensure we respect `max_amount` for spend across batch calls (#13468) · 6aa4127a
    Bastian Köcher authored
    * `pallet-treasury`: Ensure we respect `max_amount` for spend across batch calls
    
    When calling `spend` the origin defines the `max_amount` of tokens it is allowed to spend. The
    problem is that someone can send a `batch(spend, spend)` to circumvent this restriction as we don't
    check across different calls that the `max_amount` is respected. This pull request fixes this
    behavior by introducing a so-called dispatch context. This dispatch context is created once per
    outer most `dispatch` call. For more information see the docs in this pr. The treasury then uses
    this dispatch context to attach information about already spent funds per `max_amount` (we assume
    that each origin has a different `max_amount` configured). So, a `batch(spend, spend)` is now
    checked to stay inside the allowed spending bounds.
    
    Fixes: https://github.com/paritytech/substrate/issues/13167
    
    * Import `Box` for wasm
    
    * FMT
    6aa4127a