diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/lib.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/lib.rs
index f4fe1478f3ed1c4642d493a0e6ff17b98987dac9..0e43108a417be542b1612a9d22f6d644cbde0a1c 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/lib.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/lib.rs
@@ -51,6 +51,7 @@ mod imports {
pub use rococo_system_emulated_network::{
asset_hub_rococo_emulated_chain::{
asset_hub_rococo_runtime::{
+ self,
xcm_config::{
self as ahr_xcm_config, TokenLocation as RelayLocation,
XcmConfig as AssetHubRococoXcmConfig,
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/hybrid_transfers.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/hybrid_transfers.rs
index 7ff6d6c193c9b414632b13e267220a59c770449a..7bb25d7cec623641005402442f98642be60a2b57 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/hybrid_transfers.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/hybrid_transfers.rs
@@ -449,7 +449,16 @@ fn transfer_foreign_assets_from_para_to_para_through_asset_hub() {
let sov_of_receiver_on_ah = AssetHubRococo::sovereign_account_id_of(receiver_as_seen_by_ah);
let wnd_to_send = ASSET_HUB_ROCOCO_ED * 10_000_000;
- // Configure destination chain to trust AH as reserve of WND
+ // Configure source and destination chains to trust AH as reserve of WND
+ PenpalA::execute_with(|| {
+ assert_ok!(<PenpalA as Chain>::System::set_storage(
+ <PenpalA as Chain>::RuntimeOrigin::root(),
+ vec![(
+ PenpalCustomizableAssetFromSystemAssetHub::key().to_vec(),
+ Location::new(2, [GlobalConsensus(Westend)]).encode(),
+ )],
+ ));
+ });
PenpalB::execute_with(|| {
assert_ok!(<PenpalB as Chain>::System::set_storage(
<PenpalB as Chain>::RuntimeOrigin::root(),
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/reserve_transfer.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/reserve_transfer.rs
index faff5f7660c20ddcfb3b92fe512a6555bb70b374..8aad4b392b2c2ab22a0603f6c2e434f3a92a9af9 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/reserve_transfer.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/reserve_transfer.rs
@@ -1548,3 +1548,58 @@ fn reserve_transfer_usdt_from_para_to_para_through_asset_hub() {
// Receiver's balance is increased
assert!(receiver_assets_after > receiver_assets_before);
}
+
+/// Reserve Withdraw Native Asset from AssetHub to Parachain fails.
+#[test]
+fn reserve_withdraw_from_untrusted_reserve_fails() {
+ // Init values for Parachain Origin
+ let destination = AssetHubRococo::sibling_location_of(PenpalA::para_id());
+ let signed_origin =
+ <AssetHubRococo as Chain>::RuntimeOrigin::signed(AssetHubRococoSender::get().into());
+ let roc_to_send: Balance = ROCOCO_ED * 10000;
+ let roc_location = RelayLocation::get();
+
+ // Assets to send
+ let assets: Vec<Asset> = vec![(roc_location.clone(), roc_to_send).into()];
+ let fee_id: AssetId = roc_location.into();
+
+ // this should fail
+ AssetHubRococo::execute_with(|| {
+ let result = <AssetHubRococo as AssetHubRococoPallet>::PolkadotXcm::transfer_assets_using_type_and_then(
+ signed_origin.clone(),
+ bx!(destination.clone().into()),
+ bx!(assets.clone().into()),
+ bx!(TransferType::DestinationReserve),
+ bx!(fee_id.into()),
+ bx!(TransferType::DestinationReserve),
+ bx!(VersionedXcm::from(Xcm::<()>::new())),
+ Unlimited,
+ );
+ assert_err!(
+ result,
+ DispatchError::Module(sp_runtime::ModuleError {
+ index: 31,
+ error: [22, 0, 0, 0],
+ message: Some("InvalidAssetUnsupportedReserve")
+ })
+ );
+ });
+
+ // this should also fail
+ AssetHubRococo::execute_with(|| {
+ let xcm: Xcm<asset_hub_rococo_runtime::RuntimeCall> = Xcm(vec![
+ WithdrawAsset(assets.into()),
+ InitiateReserveWithdraw {
+ assets: Wild(All),
+ reserve: destination,
+ xcm: Xcm::<()>::new(),
+ },
+ ]);
+ let result = <AssetHubRococo as AssetHubRococoPallet>::PolkadotXcm::execute(
+ signed_origin,
+ bx!(xcm::VersionedXcm::V4(xcm)),
+ Weight::MAX,
+ );
+ assert!(result.is_err());
+ });
+}
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/teleport.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/teleport.rs
index c8da801a14bff5adea1a695313672dfb9c9d8437..d6cf819118e90ad6e77f8b2007d5515b40b48525 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/teleport.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-rococo/src/tests/teleport.rs
@@ -527,3 +527,54 @@ fn bidirectional_teleport_foreign_assets_between_para_and_asset_hub() {
system_para_to_para_transfer_assets,
);
}
+
+/// Teleport Native Asset from AssetHub to Parachain fails.
+#[test]
+fn teleport_to_untrusted_chain_fails() {
+ // Init values for Parachain Origin
+ let destination = AssetHubRococo::sibling_location_of(PenpalA::para_id());
+ let signed_origin =
+ <AssetHubRococo as Chain>::RuntimeOrigin::signed(AssetHubRococoSender::get().into());
+ let roc_to_send: Balance = ROCOCO_ED * 10000;
+ let roc_location = RelayLocation::get();
+
+ // Assets to send
+ let assets: Vec<Asset> = vec![(roc_location.clone(), roc_to_send).into()];
+ let fee_id: AssetId = roc_location.into();
+
+ // this should fail
+ AssetHubRococo::execute_with(|| {
+ let result = <AssetHubRococo as AssetHubRococoPallet>::PolkadotXcm::transfer_assets_using_type_and_then(
+ signed_origin.clone(),
+ bx!(destination.clone().into()),
+ bx!(assets.clone().into()),
+ bx!(TransferType::Teleport),
+ bx!(fee_id.into()),
+ bx!(TransferType::Teleport),
+ bx!(VersionedXcm::from(Xcm::<()>::new())),
+ Unlimited,
+ );
+ assert_err!(
+ result,
+ DispatchError::Module(sp_runtime::ModuleError {
+ index: 31,
+ error: [2, 0, 0, 0],
+ message: Some("Filtered")
+ })
+ );
+ });
+
+ // this should also fail
+ AssetHubRococo::execute_with(|| {
+ let xcm: Xcm<asset_hub_rococo_runtime::RuntimeCall> = Xcm(vec![
+ WithdrawAsset(assets.into()),
+ InitiateTeleport { assets: Wild(All), dest: destination, xcm: Xcm::<()>::new() },
+ ]);
+ let result = <AssetHubRococo as AssetHubRococoPallet>::PolkadotXcm::execute(
+ signed_origin,
+ bx!(xcm::VersionedXcm::V4(xcm)),
+ Weight::MAX,
+ );
+ assert!(result.is_err());
+ });
+}
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/lib.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/lib.rs
index f568fb4101db12e84153faf08f4b67c82d180f5a..d0016b5a1b158ea83adc3ec8d25be8d6de1b0bbb 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/lib.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/lib.rs
@@ -48,6 +48,7 @@ mod imports {
pub use westend_system_emulated_network::{
asset_hub_westend_emulated_chain::{
asset_hub_westend_runtime::{
+ self,
xcm_config::{
self as ahw_xcm_config, WestendLocation as RelayLocation,
XcmConfig as AssetHubWestendXcmConfig,
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/hybrid_transfers.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/hybrid_transfers.rs
index 975bacea7b4fd937c33930f6e3d7fc82fe5a179f..4d6cdd9a94d6b2b37d74c1586dd66986e84fa13a 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/hybrid_transfers.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/hybrid_transfers.rs
@@ -450,7 +450,16 @@ fn transfer_foreign_assets_from_para_to_para_through_asset_hub() {
let sov_of_receiver_on_ah = AssetHubWestend::sovereign_account_id_of(receiver_as_seen_by_ah);
let roc_to_send = ASSET_HUB_WESTEND_ED * 10_000_000;
- // Configure destination chain to trust AH as reserve of ROC
+ // Configure source and destination chains to trust AH as reserve of ROC
+ PenpalA::execute_with(|| {
+ assert_ok!(<PenpalA as Chain>::System::set_storage(
+ <PenpalA as Chain>::RuntimeOrigin::root(),
+ vec![(
+ PenpalCustomizableAssetFromSystemAssetHub::key().to_vec(),
+ Location::new(2, [GlobalConsensus(Rococo)]).encode(),
+ )],
+ ));
+ });
PenpalB::execute_with(|| {
assert_ok!(<PenpalB as Chain>::System::set_storage(
<PenpalB as Chain>::RuntimeOrigin::root(),
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/reserve_transfer.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/reserve_transfer.rs
index 53b6939298da39eb9d61a8888cfdf32dd0e8f71e..0100e8e34ef3f41c12d78ea95b9f8b7d3ddaa7fd 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/reserve_transfer.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/reserve_transfer.rs
@@ -1552,3 +1552,58 @@ fn reserve_transfer_usdt_from_para_to_para_through_asset_hub() {
// Receiver's balance is increased
assert!(receiver_assets_after > receiver_assets_before);
}
+
+/// Reserve Withdraw Native Asset from AssetHub to Parachain fails.
+#[test]
+fn reserve_withdraw_from_untrusted_reserve_fails() {
+ // Init values for Parachain Origin
+ let destination = AssetHubWestend::sibling_location_of(PenpalA::para_id());
+ let signed_origin =
+ <AssetHubWestend as Chain>::RuntimeOrigin::signed(AssetHubWestendSender::get().into());
+ let roc_to_send: Balance = WESTEND_ED * 10000;
+ let roc_location = RelayLocation::get();
+
+ // Assets to send
+ let assets: Vec<Asset> = vec![(roc_location.clone(), roc_to_send).into()];
+ let fee_id: AssetId = roc_location.into();
+
+ // this should fail
+ AssetHubWestend::execute_with(|| {
+ let result = <AssetHubWestend as AssetHubWestendPallet>::PolkadotXcm::transfer_assets_using_type_and_then(
+ signed_origin.clone(),
+ bx!(destination.clone().into()),
+ bx!(assets.clone().into()),
+ bx!(TransferType::DestinationReserve),
+ bx!(fee_id.into()),
+ bx!(TransferType::DestinationReserve),
+ bx!(VersionedXcm::from(Xcm::<()>::new())),
+ Unlimited,
+ );
+ assert_err!(
+ result,
+ DispatchError::Module(sp_runtime::ModuleError {
+ index: 31,
+ error: [22, 0, 0, 0],
+ message: Some("InvalidAssetUnsupportedReserve")
+ })
+ );
+ });
+
+ // this should also fail
+ AssetHubWestend::execute_with(|| {
+ let xcm: Xcm<asset_hub_westend_runtime::RuntimeCall> = Xcm(vec![
+ WithdrawAsset(assets.into()),
+ InitiateReserveWithdraw {
+ assets: Wild(All),
+ reserve: destination,
+ xcm: Xcm::<()>::new(),
+ },
+ ]);
+ let result = <AssetHubWestend as AssetHubWestendPallet>::PolkadotXcm::execute(
+ signed_origin,
+ bx!(xcm::VersionedXcm::V4(xcm)),
+ Weight::MAX,
+ );
+ assert!(result.is_err());
+ });
+}
diff --git a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/teleport.rs b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/teleport.rs
index 15d39858acca4b099cd0215a55d017b42a695dda..ddb82a954a877193b3a0236c72926acf87947540 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/teleport.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/assets/asset-hub-westend/src/tests/teleport.rs
@@ -530,3 +530,54 @@ fn bidirectional_teleport_foreign_assets_between_para_and_asset_hub() {
system_para_to_para_transfer_assets,
);
}
+
+/// Teleport Native Asset from AssetHub to Parachain fails.
+#[test]
+fn teleport_to_untrusted_chain_fails() {
+ // Init values for Parachain Origin
+ let destination = AssetHubWestend::sibling_location_of(PenpalA::para_id());
+ let signed_origin =
+ <AssetHubWestend as Chain>::RuntimeOrigin::signed(AssetHubWestendSender::get().into());
+ let roc_to_send: Balance = WESTEND_ED * 10000;
+ let roc_location = RelayLocation::get();
+
+ // Assets to send
+ let assets: Vec<Asset> = vec![(roc_location.clone(), roc_to_send).into()];
+ let fee_id: AssetId = roc_location.into();
+
+ // this should fail
+ AssetHubWestend::execute_with(|| {
+ let result = <AssetHubWestend as AssetHubWestendPallet>::PolkadotXcm::transfer_assets_using_type_and_then(
+ signed_origin.clone(),
+ bx!(destination.clone().into()),
+ bx!(assets.clone().into()),
+ bx!(TransferType::Teleport),
+ bx!(fee_id.into()),
+ bx!(TransferType::Teleport),
+ bx!(VersionedXcm::from(Xcm::<()>::new())),
+ Unlimited,
+ );
+ assert_err!(
+ result,
+ DispatchError::Module(sp_runtime::ModuleError {
+ index: 31,
+ error: [2, 0, 0, 0],
+ message: Some("Filtered")
+ })
+ );
+ });
+
+ // this should also fail
+ AssetHubWestend::execute_with(|| {
+ let xcm: Xcm<asset_hub_westend_runtime::RuntimeCall> = Xcm(vec![
+ WithdrawAsset(assets.into()),
+ InitiateTeleport { assets: Wild(All), dest: destination, xcm: Xcm::<()>::new() },
+ ]);
+ let result = <AssetHubWestend as AssetHubWestendPallet>::PolkadotXcm::execute(
+ signed_origin,
+ bx!(xcm::VersionedXcm::V4(xcm)),
+ Weight::MAX,
+ );
+ assert!(result.is_err());
+ });
+}
diff --git a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/lib.rs b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/lib.rs
index 9d54d431e83916d68805eeb5a99a5fc70240ad9c..e83b2807678934185ebb7d6078dce255cec468d4 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/lib.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/lib.rs
@@ -16,6 +16,7 @@
#[cfg(test)]
mod imports {
// Substrate
+ pub use codec::Encode;
pub use frame_support::{assert_err, assert_ok, pallet_prelude::DispatchResult};
pub use sp_runtime::DispatchError;
diff --git a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/tests/asset_transfers.rs b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/tests/asset_transfers.rs
index 6df51c5f7048aac5e4a16959acb01ad3986088b2..11930798da44abc175a31b2277781a820bdf41d7 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/tests/asset_transfers.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-rococo/src/tests/asset_transfers.rs
@@ -432,6 +432,16 @@ fn send_back_wnds_from_penpal_rococo_through_asset_hub_rococo_to_asset_hub_weste
ASSET_MIN_BALANCE,
vec![(sender.clone(), amount * 2)],
);
+ // Configure source Penpal chain to trust local AH as reserve of bridged WND
+ PenpalA::execute_with(|| {
+ assert_ok!(<PenpalA as Chain>::System::set_storage(
+ <PenpalA as Chain>::RuntimeOrigin::root(),
+ vec![(
+ PenpalCustomizableAssetFromSystemAssetHub::key().to_vec(),
+ wnd_at_rococo_parachains.encode(),
+ )],
+ ));
+ });
// fund the AHR's SA on AHW with the WND tokens held in reserve
let sov_ahr_on_ahw = AssetHubWestend::sovereign_account_of_parachain_on_other_global_consensus(
diff --git a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/lib.rs b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/lib.rs
index 5e0462d14882a9922c8d6232dd7ebe781ca5c88a..d9b92cb11e92b638f30fa6bae86a94914d93c444 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/lib.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/lib.rs
@@ -16,6 +16,7 @@
#[cfg(test)]
mod imports {
// Substrate
+ pub use codec::Encode;
pub use frame_support::{assert_err, assert_ok, pallet_prelude::DispatchResult};
pub use sp_runtime::DispatchError;
@@ -52,7 +53,10 @@ mod imports {
BridgeHubWestendParaPallet as BridgeHubWestendPallet, BridgeHubWestendXcmConfig,
},
penpal_emulated_chain::{
- penpal_runtime::xcm_config::UniversalLocation as PenpalUniversalLocation,
+ penpal_runtime::xcm_config::{
+ CustomizableAssetFromSystemAssetHub as PenpalCustomizableAssetFromSystemAssetHub,
+ UniversalLocation as PenpalUniversalLocation,
+ },
PenpalAssetOwner, PenpalBParaPallet as PenpalBPallet,
},
westend_emulated_chain::{
diff --git a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/asset_transfers.rs b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/asset_transfers.rs
index c3f81175da23f8716efc4e19db0a429d1cb4d2f4..6492c520234f46fd23af5bedcdf55cf64ad58070 100644
--- a/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/asset_transfers.rs
+++ b/cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/asset_transfers.rs
@@ -452,6 +452,16 @@ fn send_back_rocs_from_penpal_westend_through_asset_hub_westend_to_asset_hub_roc
ASSET_MIN_BALANCE,
vec![(sender.clone(), amount * 2)],
);
+ // Configure source Penpal chain to trust local AH as reserve of bridged ROC
+ PenpalB::execute_with(|| {
+ assert_ok!(<PenpalB as Chain>::System::set_storage(
+ <PenpalB as Chain>::RuntimeOrigin::root(),
+ vec![(
+ PenpalCustomizableAssetFromSystemAssetHub::key().to_vec(),
+ roc_at_westend_parachains.encode(),
+ )],
+ ));
+ });
// fund the AHW's SA on AHR with the ROC tokens held in reserve
let sov_ahw_on_ahr = AssetHubRococo::sovereign_account_of_parachain_on_other_global_consensus(
diff --git a/polkadot/xcm/pallet-xcm/src/lib.rs b/polkadot/xcm/pallet-xcm/src/lib.rs
index 05d9046ab192ae160c68b10f865ce587bb9bd4e0..ee448c3df60660701cc0564b5de1452cbdaf3ff1 100644
--- a/polkadot/xcm/pallet-xcm/src/lib.rs
+++ b/polkadot/xcm/pallet-xcm/src/lib.rs
@@ -1939,6 +1939,10 @@ impl<T: Config> Pallet<T> {
) -> Result<(Xcm<<T as Config>::RuntimeCall>, Xcm<()>), Error<T>> {
let value = (origin, vec![fees.clone()]);
ensure!(T::XcmReserveTransferFilter::contains(&value), Error::<T>::Filtered);
+ ensure!(
+ <T::XcmExecutor as XcmAssetTransfers>::IsReserve::contains(&fees, &dest),
+ Error::<T>::InvalidAssetUnsupportedReserve
+ );
let context = T::UniversalLocation::get();
let reanchored_fees = fees
@@ -1973,6 +1977,12 @@ impl<T: Config> Pallet<T> {
let value = (origin, assets);
ensure!(T::XcmReserveTransferFilter::contains(&value), Error::<T>::Filtered);
let (_, assets) = value;
+ for asset in assets.iter() {
+ ensure!(
+ <T::XcmExecutor as XcmAssetTransfers>::IsReserve::contains(&asset, &dest),
+ Error::<T>::InvalidAssetUnsupportedReserve
+ );
+ }
// max assets is `assets` (+ potentially separately handled fee)
let max_assets =
@@ -2079,6 +2089,10 @@ impl<T: Config> Pallet<T> {
) -> Result<(Xcm<<T as Config>::RuntimeCall>, Xcm<()>), Error<T>> {
let value = (origin, vec![fees.clone()]);
ensure!(T::XcmTeleportFilter::contains(&value), Error::<T>::Filtered);
+ ensure!(
+ <T::XcmExecutor as XcmAssetTransfers>::IsTeleporter::contains(&fees, &dest),
+ Error::<T>::Filtered
+ );
let context = T::UniversalLocation::get();
let reanchored_fees = fees
@@ -2134,6 +2148,12 @@ impl<T: Config> Pallet<T> {
let value = (origin, assets);
ensure!(T::XcmTeleportFilter::contains(&value), Error::<T>::Filtered);
let (_, assets) = value;
+ for asset in assets.iter() {
+ ensure!(
+ <T::XcmExecutor as XcmAssetTransfers>::IsTeleporter::contains(&asset, &dest),
+ Error::<T>::Filtered
+ );
+ }
// max assets is `assets` (+ potentially separately handled fee)
let max_assets =
diff --git a/polkadot/xcm/xcm-builder/tests/scenarios.rs b/polkadot/xcm/xcm-builder/tests/scenarios.rs
index ee1aeffbb4e71d5c42cb92376395961d4d95de81..99c14f5bba1bc8fad67605ce8eddbf8185fa7caf 100644
--- a/polkadot/xcm/xcm-builder/tests/scenarios.rs
+++ b/polkadot/xcm/xcm-builder/tests/scenarios.rs
@@ -22,7 +22,7 @@ use mock::{
};
use polkadot_parachain_primitives::primitives::Id as ParaId;
use sp_runtime::traits::AccountIdConversion;
-use xcm::latest::prelude::*;
+use xcm::latest::{prelude::*, Error::UntrustedTeleportLocation};
use xcm_executor::XcmExecutor;
pub const ALICE: AccountId = AccountId::new([0u8; 32]);
@@ -217,7 +217,7 @@ fn teleport_to_asset_hub_works() {
];
let weight = BaseXcmWeight::get() * 3;
- // teleports are allowed to community chains, even in the absence of trust from their side.
+ // teleports are not allowed to other chains, in the absence of trust from their side
let message = Xcm(vec![
WithdrawAsset((Here, amount).into()),
buy_execution(),
@@ -235,16 +235,7 @@ fn teleport_to_asset_hub_works() {
weight,
Weight::zero(),
);
- assert_eq!(r, Outcome::Complete { used: weight });
- let expected_msg = Xcm(vec![ReceiveTeleportedAsset((Parent, amount).into()), ClearOrigin]
- .into_iter()
- .chain(teleport_effects.clone().into_iter())
- .collect());
- let expected_hash = fake_message_hash(&expected_msg);
- assert_eq!(
- mock::sent_xcm(),
- vec![(Parachain(other_para_id).into(), expected_msg, expected_hash,)]
- );
+ assert_eq!(r, Outcome::Incomplete { used: weight, error: UntrustedTeleportLocation });
// teleports are allowed from asset hub to kusama.
let message = Xcm(vec![
@@ -274,10 +265,7 @@ fn teleport_to_asset_hub_works() {
let expected_hash = fake_message_hash(&expected_msg);
assert_eq!(
mock::sent_xcm(),
- vec![
- (Parachain(other_para_id).into(), expected_msg.clone(), expected_hash,),
- (Parachain(asset_hub_id).into(), expected_msg, expected_hash,)
- ]
+ vec![(Parachain(asset_hub_id).into(), expected_msg, expected_hash,)]
);
});
}
diff --git a/polkadot/xcm/xcm-executor/src/lib.rs b/polkadot/xcm/xcm-executor/src/lib.rs
index a8110ca3d19f7e622b7fe1facbd9c656d29d36ac..14920f36445b8c99ca5f56a76750b8b894ca1c0b 100644
--- a/polkadot/xcm/xcm-executor/src/lib.rs
+++ b/polkadot/xcm/xcm-executor/src/lib.rs
@@ -1002,13 +1002,18 @@ impl<Config: config::Config> XcmExecutor<Config> {
InitiateReserveWithdraw { assets, reserve, xcm } => {
let old_holding = self.holding.clone();
let result = Config::TransactionalProcessor::process(|| {
+ let assets = self.holding.saturating_take(assets);
+ // Must ensure that we recognise the assets as being managed by the destination.
+ #[cfg(not(feature = "runtime-benchmarks"))]
+ for asset in assets.assets_iter() {
+ ensure!(
+ Config::IsReserve::contains(&asset, &reserve),
+ XcmError::UntrustedReserveLocation
+ );
+ }
// Note that here we are able to place any assets which could not be reanchored
// back into Holding.
- let assets = Self::reanchored(
- self.holding.saturating_take(assets),
- &reserve,
- Some(&mut self.holding),
- );
+ let assets = Self::reanchored(assets, &reserve, Some(&mut self.holding));
let mut message = vec![WithdrawAsset(assets), ClearOrigin];
message.extend(xcm.0.into_iter());
self.send(reserve, Xcm(message), FeeReason::InitiateReserveWithdraw)?;
@@ -1024,6 +1029,14 @@ impl<Config: config::Config> XcmExecutor<Config> {
let result = (|| -> Result<(), XcmError> {
// We must do this first in order to resolve wildcards.
let assets = self.holding.saturating_take(assets);
+ // Must ensure that we have teleport trust with destination for these assets.
+ #[cfg(not(feature = "runtime-benchmarks"))]
+ for asset in assets.assets_iter() {
+ ensure!(
+ Config::IsTeleporter::contains(&asset, &dest),
+ XcmError::UntrustedTeleportLocation
+ );
+ }
for asset in assets.assets_iter() {
// We should check that the asset can actually be teleported out (for this
// to be in error, there would need to be an accounting violation by
diff --git a/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/mod.rs b/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/mod.rs
index c5d5fa66732b939b9a03e1da2cf9c658c4e61acb..6218915cd12d632bfc4415d88bbe3f3784f8baa0 100644
--- a/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/mod.rs
+++ b/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/mod.rs
@@ -19,6 +19,7 @@ pub mod barrier;
pub mod constants;
pub mod location_converter;
pub mod origin_converter;
+pub mod teleporter;
pub mod weigher;
use crate::relay_chain::{RuntimeCall, XcmPallet};
@@ -36,7 +37,7 @@ impl Config for XcmConfig {
type AssetTransactor = asset_transactor::AssetTransactor;
type OriginConverter = origin_converter::OriginConverter;
type IsReserve = ();
- type IsTeleporter = ();
+ type IsTeleporter = teleporter::TrustedTeleporters;
type UniversalLocation = constants::UniversalLocation;
type Barrier = barrier::Barrier;
type Weigher = weigher::Weigher;
diff --git a/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/teleporter.rs b/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/teleporter.rs
new file mode 100644
index 0000000000000000000000000000000000000000..92e5065044e63a75b2c2fc84bb4d3535dc8dc538
--- /dev/null
+++ b/polkadot/xcm/xcm-simulator/example/src/relay_chain/xcm_config/teleporter.rs
@@ -0,0 +1,26 @@
+// Copyright (C) Parity Technologies (UK) Ltd.
+// This file is part of Polkadot.
+
+// Polkadot is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// Polkadot is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Polkadot. If not, see <http://www.gnu.org/licenses/>.
+
+use frame_support::parameter_types;
+use xcm::latest::prelude::*;
+
+parameter_types! {
+ pub NftCollectionOnRelay: AssetFilter
+ = Wild(AllOf { fun: WildNonFungible, id: AssetId(GeneralIndex(1).into()) });
+ pub NftCollectionForChild: (AssetFilter, Location)
+ = (NftCollectionOnRelay::get(), Parachain(1).into());
+}
+pub type TrustedTeleporters = xcm_builder::Case<NftCollectionForChild>;
diff --git a/prdoc/pr_5660.prdoc b/prdoc/pr_5660.prdoc
new file mode 100644
index 0000000000000000000000000000000000000000..fce791cebb65a5a11c37a85587b4afc9174a2cb8
--- /dev/null
+++ b/prdoc/pr_5660.prdoc
@@ -0,0 +1,30 @@
+# Schema: Polkadot SDK PRDoc Schema (prdoc) v1.0.0
+# See doc at https://raw.githubusercontent.com/paritytech/polkadot-sdk/master/prdoc/schema_user.json
+
+title: "xcm-executor: validate destinations for ReserveWithdraw and Teleport transfers"
+
+doc:
+ - audience:
+ - Runtime User
+ - Runtime Dev
+ description: |
+ This change adds the required validation for stronger UX guarantees when using
+ `InitiateReserveWithdraw` or `InitiateTeleport` XCM instructions. Execution of
+ the instructions will fail if the local chain is not configured to trust the
+ "destination" or "reserve" chain as a reserve/trusted-teleporter for the provided
+ "assets".
+ With this change, misuse of `InitiateReserveWithdraw`/`InitiateTeleport` fails on
+ origin with no overall side-effects, rather than failing on destination (with
+ side-effects to origin's assets issuance).
+ The commit also makes the same validations for pallet-xcm transfers, and adds
+ regression tests.
+
+crates:
+ - name: staging-xcm-executor
+ bump: patch
+ - name: staging-xcm-builder
+ bump: patch
+ - name: pallet-xcm
+ bump: patch
+ - name: xcm-simulator-example
+ bump: patch