diff --git a/Cargo.lock b/Cargo.lock
index c6fefcfdfe186d9c1515d58a8bdfbb435c4937f4..dffc8310b8f004bd404d9f7f0db838410ad0fdf9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -28539,6 +28539,7 @@ dependencies = [
name = "staging-xcm-builder"
version = "7.0.0"
dependencies = [
+ "environmental",
"frame-support 28.0.0",
"frame-system 28.0.0",
"impl-trait-for-tuples",
diff --git a/cumulus/parachains/runtimes/assets/asset-hub-rococo/src/xcm_config.rs b/cumulus/parachains/runtimes/assets/asset-hub-rococo/src/xcm_config.rs
index 0c6ff5e4bfddc6c236fe1ec4a5a5f425027f41f5..84526b2e4f2ee0df214b53737b5d4676b1080ee4 100644
--- a/cumulus/parachains/runtimes/assets/asset-hub-rococo/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/assets/asset-hub-rococo/src/xcm_config.rs
@@ -51,7 +51,7 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH, WESTEND_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AliasChildLocation, AllowExplicitUnpaidExecutionFrom,
AllowHrmpNotificationsFromRelayChain, AllowKnownQueryResponses, AllowSubscriptionsFrom,
- AllowTopLevelPaidExecutionFrom, DenyReserveTransferToRelayChain, DenyThenTry,
+ AllowTopLevelPaidExecutionFrom, DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry,
DescribeAllTerminal, DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor,
FungibleAdapter, FungiblesAdapter, GlobalConsensusParachainConvertsFor, HashedDescription,
IsConcrete, LocalMint, MatchedConvertedConcreteId, NetworkExportTableItem, NoChecking,
@@ -269,7 +269,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
TakeWeightCredit,
// Expected responses are OK.
diff --git a/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs b/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs
index 1ea2ce5136abd09348e8843b48b7a356b00c57f0..e144f36dd6b88ae9794fc29a10db9a86bfdc2f58 100644
--- a/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/assets/asset-hub-westend/src/xcm_config.rs
@@ -48,7 +48,7 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH, WESTEND_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AliasChildLocation, AllowExplicitUnpaidExecutionFrom,
AllowHrmpNotificationsFromRelayChain, AllowKnownQueryResponses, AllowSubscriptionsFrom,
- AllowTopLevelPaidExecutionFrom, DenyReserveTransferToRelayChain, DenyThenTry,
+ AllowTopLevelPaidExecutionFrom, DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry,
DescribeAllTerminal, DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor,
FungibleAdapter, FungiblesAdapter, GlobalConsensusParachainConvertsFor, HashedDescription,
IsConcrete, LocalMint, MatchedConvertedConcreteId, NetworkExportTableItem, NoChecking,
@@ -281,7 +281,7 @@ impl Contains<Location> for AmbassadorEntities {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
TakeWeightCredit,
// Expected responses are OK.
diff --git a/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/xcm_config.rs b/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/xcm_config.rs
index 12dc7e5dd7332873418905407be250286b18484b..13145a723baa67f23ff3105c79408a42d943c884 100644
--- a/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-rococo/src/xcm_config.rs
@@ -44,12 +44,12 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HandleFee, HashedDescription,
- IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SendXcmFeeToAccount,
- SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
- SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId,
- UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HandleFee,
+ HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative,
+ SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
+ TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
};
use xcm_executor::{
traits::{FeeManager, FeeReason, FeeReason::Export},
@@ -131,7 +131,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend/src/xcm_config.rs b/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend/src/xcm_config.rs
index 1585ef692fd52306a0beb186454eda6278a5ca65..3e844f9841654e62acaecb7e317b3962df90c9f6 100644
--- a/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/bridge-hubs/bridge-hub-westend/src/xcm_config.rs
@@ -43,12 +43,12 @@ use xcm::latest::{prelude::*, WESTEND_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HandleFee, HashedDescription,
- IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SendXcmFeeToAccount,
- SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
- SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId,
- UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HandleFee,
+ HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative,
+ SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
+ TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
};
use xcm_executor::{
traits::{FeeManager, FeeReason, FeeReason::Export},
@@ -129,7 +129,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/collectives/collectives-westend/src/xcm_config.rs b/cumulus/parachains/runtimes/collectives/collectives-westend/src/xcm_config.rs
index c5ab21fe8f904372fc4d12b20961006fd01df612..71208b7ce875fd708ae038518c8f43800c5ae6f5 100644
--- a/cumulus/parachains/runtimes/collectives/collectives-westend/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/collectives/collectives-westend/src/xcm_config.rs
@@ -37,13 +37,13 @@ use xcm_builder::{
AccountId32Aliases, AliasChildLocation, AliasOriginRootUsingFilter,
AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HashedDescription, IsConcrete,
- LocatableAssetId, OriginToPluralityVoice, ParentAsSuperuser, ParentIsPreset,
- RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
- SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
- TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
- XcmFeeManagerFromComponents,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter,
+ HashedDescription, IsConcrete, LocatableAssetId, OriginToPluralityVoice, ParentAsSuperuser,
+ ParentIsPreset, RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative,
+ SiblingParachainConvertsVia, SignedAccountId32AsNative, SignedToAccountId32,
+ SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId, UsingComponents,
+ WeightInfoBounds, WithComputedOrigin, WithUniqueTopic, XcmFeeManagerFromComponents,
};
use xcm_executor::XcmExecutor;
@@ -146,7 +146,7 @@ impl Contains<Location> for LocalPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/contracts/contracts-rococo/src/xcm_config.rs b/cumulus/parachains/runtimes/contracts/contracts-rococo/src/xcm_config.rs
index 532ad4ff4ce008ca9cabe5660ea1f6bdbce7dda8..e1da08ae80670a7aa46658e366bef07380c62671 100644
--- a/cumulus/parachains/runtimes/contracts/contracts-rococo/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/contracts/contracts-rococo/src/xcm_config.rs
@@ -40,9 +40,9 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FixedWeightBounds, FrameTransactionalProcessor, FungibleAdapter,
- HashedDescription, IsConcrete, NativeAsset, ParentAsSuperuser, ParentIsPreset,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FixedWeightBounds, FrameTransactionalProcessor,
+ FungibleAdapter, HashedDescription, IsConcrete, NativeAsset, ParentAsSuperuser, ParentIsPreset,
RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
TrailingSetTopicAsId, UsingComponents, WithComputedOrigin, WithUniqueTopic,
@@ -134,7 +134,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
TakeWeightCredit,
// Expected responses are OK.
diff --git a/cumulus/parachains/runtimes/coretime/coretime-rococo/src/xcm_config.rs b/cumulus/parachains/runtimes/coretime/coretime-rococo/src/xcm_config.rs
index 7c3f8a365856cce2f773223a152200abbdd669f1..35b3b6fb5575717b98960f07b09fcb981573d2dd 100644
--- a/cumulus/parachains/runtimes/coretime/coretime-rococo/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/coretime/coretime-rococo/src/xcm_config.rs
@@ -41,12 +41,12 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HashedDescription, IsConcrete,
- NonFungibleAdapter, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SendXcmFeeToAccount,
- SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
- SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId,
- UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter,
+ HashedDescription, IsConcrete, NonFungibleAdapter, ParentAsSuperuser, ParentIsPreset,
+ RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
+ TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
XcmFeeManagerFromComponents,
};
use xcm_executor::XcmExecutor;
@@ -145,7 +145,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/coretime/coretime-westend/src/xcm_config.rs b/cumulus/parachains/runtimes/coretime/coretime-westend/src/xcm_config.rs
index a124c1978309e5ed4aca61f14588473c9eaea4d2..bff798259dfeb1bc623a1c9508e2d3b8fa75981d 100644
--- a/cumulus/parachains/runtimes/coretime/coretime-westend/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/coretime/coretime-westend/src/xcm_config.rs
@@ -42,12 +42,12 @@ use xcm_builder::{
AccountId32Aliases, AliasChildLocation, AliasOriginRootUsingFilter,
AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter, HashedDescription, IsConcrete,
- NonFungibleAdapter, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative, SendXcmFeeToAccount,
- SiblingParachainAsNative, SiblingParachainConvertsVia, SignedAccountId32AsNative,
- SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit, TrailingSetTopicAsId,
- UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter,
+ HashedDescription, IsConcrete, NonFungibleAdapter, ParentAsSuperuser, ParentIsPreset,
+ RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
+ TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
XcmFeeManagerFromComponents,
};
use xcm_executor::XcmExecutor;
@@ -154,7 +154,7 @@ impl Contains<Location> for FellowsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/people/people-rococo/src/xcm_config.rs b/cumulus/parachains/runtimes/people/people-rococo/src/xcm_config.rs
index 724d87587c6c51ac5d7b564862d0694f0dd7141b..9e89cd465e45c06c523a0fccd508a816916f0880 100644
--- a/cumulus/parachains/runtimes/people/people-rococo/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/people/people-rococo/src/xcm_config.rs
@@ -38,10 +38,10 @@ use xcm::latest::{prelude::*, ROCOCO_GENESIS_HASH};
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- DescribeTerminus, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter,
- HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative,
- SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, DescribeTerminus, EnsureXcmOrigin, FrameTransactionalProcessor,
+ FungibleAdapter, HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset,
+ RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
XcmFeeManagerFromComponents,
@@ -153,7 +153,7 @@ impl Contains<Location> for ParentOrParentsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/cumulus/parachains/runtimes/people/people-westend/src/xcm_config.rs b/cumulus/parachains/runtimes/people/people-westend/src/xcm_config.rs
index 7eaa43c05b208fd9107976572fbd71e1e5b4cd27..bd319e3ac3b4812a00465ec5feb6b03541afe7a9 100644
--- a/cumulus/parachains/runtimes/people/people-westend/src/xcm_config.rs
+++ b/cumulus/parachains/runtimes/people/people-westend/src/xcm_config.rs
@@ -39,10 +39,10 @@ use xcm_builder::{
AccountId32Aliases, AliasChildLocation, AliasOriginRootUsingFilter,
AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal, DescribeFamily,
- DescribeTerminus, EnsureXcmOrigin, FrameTransactionalProcessor, FungibleAdapter,
- HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset, RelayChainAsNative,
- SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
+ DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry, DescribeAllTerminal,
+ DescribeFamily, DescribeTerminus, EnsureXcmOrigin, FrameTransactionalProcessor,
+ FungibleAdapter, HashedDescription, IsConcrete, ParentAsSuperuser, ParentIsPreset,
+ RelayChainAsNative, SendXcmFeeToAccount, SiblingParachainAsNative, SiblingParachainConvertsVia,
SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
TrailingSetTopicAsId, UsingComponents, WeightInfoBounds, WithComputedOrigin, WithUniqueTopic,
XcmFeeManagerFromComponents,
@@ -162,7 +162,7 @@ impl Contains<Location> for FellowsPlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
// Allow local users to buy weight credit.
TakeWeightCredit,
diff --git a/polkadot/xcm/xcm-builder/Cargo.toml b/polkadot/xcm/xcm-builder/Cargo.toml
index 5169f586d723784e408afc3b4437635a6485ec02..764c788f2d0f4bf393338ec2e56fde4ff36eca9f 100644
--- a/polkadot/xcm/xcm-builder/Cargo.toml
+++ b/polkadot/xcm/xcm-builder/Cargo.toml
@@ -13,6 +13,7 @@ workspace = true
[dependencies]
codec = { features = ["derive"], workspace = true }
+environmental = { workspace = true }
frame-support = { workspace = true }
frame-system = { workspace = true }
impl-trait-for-tuples = { workspace = true }
@@ -21,6 +22,7 @@ pallet-asset-conversion = { workspace = true }
pallet-transaction-payment = { workspace = true }
scale-info = { features = ["derive"], workspace = true }
sp-arithmetic = { workspace = true }
+sp-core = { workspace = true }
sp-io = { workspace = true }
sp-runtime = { workspace = true }
sp-weights = { workspace = true }
@@ -39,7 +41,6 @@ polkadot-primitives = { workspace = true, default-features = true }
polkadot-runtime-parachains = { workspace = true, default-features = true }
polkadot-test-runtime = { workspace = true }
primitive-types = { features = ["codec", "num-traits", "scale-info"], workspace = true }
-sp-core = { workspace = true, default-features = true }
[features]
default = ["std"]
@@ -62,6 +63,7 @@ runtime-benchmarks = [
]
std = [
"codec/std",
+ "environmental/std",
"frame-support/std",
"frame-system/std",
"log/std",
@@ -71,6 +73,7 @@ std = [
"primitive-types/std",
"scale-info/std",
"sp-arithmetic/std",
+ "sp-core/std",
"sp-io/std",
"sp-runtime/std",
"sp-weights/std",
diff --git a/polkadot/xcm/xcm-builder/src/barriers.rs b/polkadot/xcm/xcm-builder/src/barriers.rs
index ba916abecf053613f400d1fca40dbfced205b921..6eda6bd2bbeef7ebe8bb191a8006df4895c19393 100644
--- a/polkadot/xcm/xcm-builder/src/barriers.rs
+++ b/polkadot/xcm/xcm-builder/src/barriers.rs
@@ -573,3 +573,96 @@ impl DenyExecution for DenyReserveTransferToRelayChain {
Ok(())
}
}
+
+environmental::environmental!(recursion_count: u8);
+
+/// Denies execution if the XCM contains instructions not meant to run on this chain,
+/// first checking at the top-level and then **recursively**.
+///
+/// This barrier only applies to **locally executed** XCM instructions (`SetAppendix`,
+/// `SetErrorHandler`, and `ExecuteWithOrigin`). Remote parts of the XCM are expected to be
+/// validated by the receiving chain's barrier.
+///
+/// Note: Ensures that restricted instructions do not execute on the local chain, enforcing stricter
+/// execution policies while allowing remote chains to enforce their own rules.
+pub struct DenyRecursively<Inner>(PhantomData<Inner>);
+
+impl<Inner: DenyExecution> DenyRecursively<Inner> {
+ /// Recursively applies the deny filter to a nested XCM.
+ ///
+ /// Ensures that restricted instructions are blocked at any depth within the XCM.
+ /// Uses a **recursion counter** to prevent stack overflows from deep nesting.
+ fn deny_recursively<RuntimeCall>(
+ origin: &Location,
+ xcm: &mut Xcm<RuntimeCall>,
+ max_weight: Weight,
+ properties: &mut Properties,
+ ) -> Result<ControlFlow<()>, ProcessMessageError> {
+ // Initialise recursion counter for this execution context.
+ recursion_count::using_once(&mut 1, || {
+ // Prevent stack overflow by enforcing a recursion depth limit.
+ recursion_count::with(|count| {
+ if *count > xcm_executor::RECURSION_LIMIT {
+ log::debug!(
+ target: "xcm::barriers",
+ "Recursion limit exceeded (count: {count}), origin: {:?}, xcm: {:?}, max_weight: {:?}, properties: {:?}",
+ origin, xcm, max_weight, properties
+ );
+ return None;
+ }
+ *count = count.saturating_add(1);
+ Some(())
+ }).flatten().ok_or(ProcessMessageError::StackLimitReached)?;
+
+ // Ensure the counter is decremented even if an early return occurs.
+ sp_core::defer! {
+ recursion_count::with(|count| {
+ *count = count.saturating_sub(1);
+ });
+ }
+
+ // Recursively check the nested XCM instructions.
+ Self::deny_execution(origin, xcm.inner_mut(), max_weight, properties)
+ })?;
+
+ Ok(ControlFlow::Continue(()))
+ }
+}
+
+impl<Inner: DenyExecution> DenyExecution for DenyRecursively<Inner> {
+ /// Denies execution of restricted local nested XCM instructions.
+ ///
+ /// This checks for `SetAppendix`, `SetErrorHandler`, and `ExecuteWithOrigin` instruction
+ /// applying the deny filter **recursively** to any nested XCMs found.
+ fn deny_execution<RuntimeCall>(
+ origin: &Location,
+ instructions: &mut [Instruction<RuntimeCall>],
+ max_weight: Weight,
+ properties: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ // First, check if the top-level message should be denied.
+ Inner::deny_execution(origin, instructions, max_weight, properties).inspect_err(|e| {
+ log::warn!(
+ target: "xcm::barriers",
+ "DenyRecursively::Inner denied execution, origin: {:?}, instructions: {:?}, max_weight: {:?}, properties: {:?}, error: {:?}",
+ origin, instructions, max_weight, properties, e
+ );
+ })?;
+
+ // If the top-level check passes, check nested instructions recursively.
+ instructions.matcher().match_next_inst_while(
+ |_| true,
+ |inst| match inst {
+ SetAppendix(nested_xcm) |
+ SetErrorHandler(nested_xcm) |
+ ExecuteWithOrigin { xcm: nested_xcm, .. } => Self::deny_recursively::<RuntimeCall>(
+ origin, nested_xcm, max_weight, properties,
+ ),
+ _ => Ok(ControlFlow::Continue(())),
+ },
+ )?;
+
+ // Permit everything else
+ Ok(())
+ }
+}
diff --git a/polkadot/xcm/xcm-builder/src/lib.rs b/polkadot/xcm/xcm-builder/src/lib.rs
index e23412a97ebcb3e6f2999d0f48d555e53d02503e..4c48589e6712714f0abf858447eb72b9536f0a55 100644
--- a/polkadot/xcm/xcm-builder/src/lib.rs
+++ b/polkadot/xcm/xcm-builder/src/lib.rs
@@ -42,9 +42,9 @@ mod barriers;
pub use barriers::{
AllowExplicitUnpaidExecutionFrom, AllowHrmpNotificationsFromRelayChain,
AllowKnownQueryResponses, AllowSubscriptionsFrom, AllowTopLevelPaidExecutionFrom,
- AllowUnpaidExecutionFrom, DenyReserveTransferToRelayChain, DenyThenTry, IsChildSystemParachain,
- IsParentsOnly, IsSiblingSystemParachain, RespectSuspension, TakeWeightCredit,
- TrailingSetTopicAsId, WithComputedOrigin,
+ AllowUnpaidExecutionFrom, DenyRecursively, DenyReserveTransferToRelayChain, DenyThenTry,
+ IsChildSystemParachain, IsParentsOnly, IsSiblingSystemParachain, RespectSuspension,
+ TakeWeightCredit, TrailingSetTopicAsId, WithComputedOrigin,
};
mod controller;
diff --git a/polkadot/xcm/xcm-builder/src/tests/barriers.rs b/polkadot/xcm/xcm-builder/src/tests/barriers.rs
index 6ece92f623ef407a2c975d7c1b532e5b62051c6e..f3da1745d3d1b4efbba030119635feb10b8419e9 100644
--- a/polkadot/xcm/xcm-builder/src/tests/barriers.rs
+++ b/polkadot/xcm/xcm-builder/src/tests/barriers.rs
@@ -14,6 +14,7 @@
// You should have received a copy of the GNU General Public License
// along with Polkadot. If not, see <http://www.gnu.org/licenses/>.
+use std::marker::PhantomData;
use xcm_executor::traits::Properties;
use super::*;
@@ -1124,3 +1125,258 @@ fn deny_reserve_transfer_to_relaychain_should_work() {
// others instructions should pass
assert_deny_execution(vec![ClearOrigin], Here.into_location(), Ok(()));
}
+
+// Dummy Barriers
+// Dummy filter to allow all
+struct AllowAll;
+impl ShouldExecute for AllowAll {
+ fn should_execute<RuntimeCall>(
+ _: &Location,
+ _: &mut [Instruction<RuntimeCall>],
+ _: Weight,
+ _: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ Ok(())
+ }
+}
+
+// Dummy filter which denies `ClearOrigin`
+struct DenyClearOrigin;
+impl DenyExecution for DenyClearOrigin {
+ fn deny_execution<RuntimeCall>(
+ _: &Location,
+ instructions: &mut [Instruction<RuntimeCall>],
+ _: Weight,
+ _: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ instructions.matcher().match_next_inst_while(
+ |_| true,
+ |inst| match inst {
+ ClearOrigin => Err(ProcessMessageError::Unsupported),
+ _ => Ok(ControlFlow::Continue(())),
+ },
+ )?;
+ Ok(())
+ }
+}
+
+// Dummy filter which denies nothing
+struct DenyNothing;
+impl DenyExecution for DenyNothing {
+ fn deny_execution<RuntimeCall>(
+ _origin: &Location,
+ _instructions: &mut [Instruction<RuntimeCall>],
+ _max_weight: Weight,
+ _properties: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ Ok(())
+ }
+}
+
+// Test helper: Adapts a `DenyExecution` barrier to the `ShouldExecute` trait
+struct Executable<Barrier: DenyExecution>(PhantomData<Barrier>);
+impl<Barrier: DenyExecution> ShouldExecute for Executable<Barrier> {
+ fn should_execute<RuntimeCall>(
+ origin: &Location,
+ instructions: &mut [Instruction<RuntimeCall>],
+ max_weight: Weight,
+ properties: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ Barrier::deny_execution(origin, instructions, max_weight, properties)
+ }
+}
+
+#[test]
+fn deny_recursively_then_try_works() {
+ type Barrier = DenyThenTry<DenyRecursively<DenyReserveTransferToRelayChain>, AllowAll>;
+ let xcm = Xcm::<Instruction<()>>(vec![DepositReserveAsset {
+ assets: Wild(All),
+ dest: Location::parent(),
+ xcm: vec![].into(),
+ }]);
+ let origin = Here.into_location();
+ let max_weight = Weight::from_parts(10, 10);
+ let mut properties = props(Weight::zero());
+
+ // Should deny the original XCM
+ let result =
+ Barrier::should_execute(&origin, xcm.clone().inner_mut(), max_weight, &mut properties);
+ assert!(result.is_err());
+
+ // Should deny with `SetAppendix`
+ let mut message = Xcm::<Instruction<()>>(vec![SetAppendix(xcm.clone())]);
+ let result =
+ Barrier::should_execute(&origin, message.clone().inner_mut(), max_weight, &mut properties);
+ assert!(result.is_err());
+
+ // Should allow with `SetAppendix` for the original `DenyThenTry`
+ type OriginalBarrier = DenyThenTry<DenyReserveTransferToRelayChain, AllowAll>;
+ let result =
+ OriginalBarrier::should_execute(&origin, message.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_ok());
+
+ // Should deny with `SetErrorHandler`
+ let mut message = Xcm::<Instruction<()>>(vec![SetErrorHandler(xcm.clone())]);
+ let result = Barrier::should_execute(&origin, message.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_err());
+
+ // Should deny with `ExecuteWithOrigin`
+ let mut message = Xcm::<Instruction<()>>(vec![ExecuteWithOrigin {
+ xcm: xcm.clone(),
+ descendant_origin: None,
+ }]);
+ let result = Barrier::should_execute(&origin, message.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_err());
+
+ // Should deny with more levels
+ let mut message = Xcm::<Instruction<()>>(vec![ExecuteWithOrigin {
+ xcm: vec![SetErrorHandler(vec![SetAppendix(xcm.clone())].into())].into(),
+ descendant_origin: None,
+ }]);
+ let result = Barrier::should_execute(&origin, message.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_err());
+
+ // Should allow for valid XCM with `SetAppendix`
+ let xcm = Xcm::<Instruction<()>>(vec![DepositReserveAsset {
+ assets: Wild(All),
+ dest: Here.into_location(),
+ xcm: vec![].into(),
+ }]);
+ let mut message = Xcm::<Instruction<()>>(vec![SetAppendix(xcm.clone())]);
+ let result = Barrier::should_execute(&origin, message.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_ok());
+
+ // Should ensure unrelated XCMs are not blocked
+ let mut unrelated_xcm = Xcm::<Instruction<()>>(vec![BuyExecution {
+ fees: (Parent, 100).into(),
+ weight_limit: Unlimited,
+ }]);
+ let result =
+ Barrier::should_execute(&origin, unrelated_xcm.inner_mut(), max_weight, &mut properties);
+ assert!(result.is_ok());
+
+ // Should deny recursively before allow
+ type BarrierDenyClearOrigin = DenyThenTry<DenyRecursively<DenyClearOrigin>, AllowAll>;
+ assert_deny_instructions_recursively::<BarrierDenyClearOrigin>();
+}
+
+#[test]
+fn deny_recursively_works() {
+ type Barrier = Executable<DenyRecursively<DenyClearOrigin>>;
+ assert_deny_instructions_recursively::<Barrier>();
+}
+
+#[test]
+fn compare_deny_filters() {
+ type Denies = (DenyNothing, DenyReserveTransferToRelayChain);
+
+ fn assert_barrier<Barrier: ShouldExecute>(
+ top_level_result: Result<(), ProcessMessageError>,
+ nested_result: Result<(), ProcessMessageError>,
+ ) {
+ let origin = Here.into_location();
+ let max_weight = Weight::zero();
+ let mut properties = props(Weight::zero());
+
+ // Validate Top-Level
+ let xcm = Xcm::<Instruction<()>>(
+ vec![DepositReserveAsset {
+ assets: Wild(All),
+ dest: Location::parent(),
+ xcm: Xcm(vec![ClearOrigin]),
+ }]
+ .into(),
+ );
+ let result =
+ Barrier::should_execute(&origin, xcm.clone().inner_mut(), max_weight, &mut properties);
+ assert_eq!(top_level_result, result);
+
+ // Validate Nested
+ let mut nested_xcm = Xcm::<Instruction<()>>(vec![SetErrorHandler(xcm.into())].into());
+ let result =
+ Barrier::should_execute(&origin, nested_xcm.inner_mut(), max_weight, &mut properties);
+ assert_eq!(nested_result, result);
+ }
+
+ // `DenyThenTry`: Top-level=Deny, Nested=Allow, TryAllow=Yes
+ assert_barrier::<DenyThenTry<Denies, AllowAll>>(Err(ProcessMessageError::Unsupported), Ok(()));
+
+ // `DenyThenTry<DenyRecursively<Deny>>`: Top-level=Deny, Nested=Deny, TryAllow=Yes
+ assert_barrier::<DenyThenTry<DenyRecursively<Denies>, AllowAll>>(
+ Err(ProcessMessageError::Unsupported),
+ Err(ProcessMessageError::Unsupported),
+ );
+
+ // `DenyRecursively`: Top-level=Deny, Nested=Deny, TryAllow=No
+ assert_barrier::<Executable<DenyRecursively<Denies>>>(
+ Err(ProcessMessageError::Unsupported),
+ Err(ProcessMessageError::Unsupported),
+ );
+}
+
+fn assert_deny_instructions_recursively<Barrier: ShouldExecute>() {
+ // closure for (xcm, origin) testing with `Barrier` which denies `ClearOrigin`
+ // instruction
+ let test_barrier = |mut xcm: Vec<Instruction<()>>, origin| {
+ Barrier::should_execute(
+ &origin,
+ &mut xcm,
+ Weight::from_parts(10, 10),
+ &mut props(Weight::zero()),
+ )
+ };
+
+ // ok
+ assert_eq!(test_barrier(vec![ClearTransactStatus], Location::parent()), Ok(()));
+ // invalid top-level contains `ClearOrigin`
+ assert_eq!(
+ test_barrier(vec![ClearOrigin], Location::parent()),
+ Err(ProcessMessageError::Unsupported)
+ );
+ // ok - SetAppendix with XCM without ClearOrigin
+ assert_eq!(
+ test_barrier(vec![SetAppendix(Xcm(vec![ClearTransactStatus]))], Location::parent()),
+ Ok(())
+ );
+ // ok - DepositReserveAsset with XCM contains ClearOrigin
+ assert_eq!(
+ test_barrier(
+ vec![DepositReserveAsset {
+ assets: Wild(All),
+ dest: Here.into(),
+ xcm: Xcm(vec![ClearOrigin]),
+ }],
+ Location::parent()
+ ),
+ Ok(()),
+ );
+
+ // invalid - empty XCM
+ assert_eq!(test_barrier(vec![], Location::parent()), Err(ProcessMessageError::BadFormat));
+ // invalid - SetAppendix with empty XCM
+ assert_eq!(
+ test_barrier(vec![SetAppendix(Xcm(vec![]))], Location::parent()),
+ Err(ProcessMessageError::BadFormat),
+ );
+ // invalid SetAppendix contains `ClearOrigin`
+ assert_eq!(
+ test_barrier(vec![SetAppendix(Xcm(vec![ClearOrigin]))], Location::parent()),
+ Err(ProcessMessageError::Unsupported),
+ );
+ // invalid nested SetAppendix contains `ClearOrigin`
+ assert_eq!(
+ test_barrier(
+ vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![
+ SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![
+ SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![
+ SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![
+ ClearOrigin
+ ]))])),]))
+ ]))])),]))
+ ]))]))]),)
+ ]))]))]))],
+ Location::parent()
+ ),
+ Err(ProcessMessageError::StackLimitReached),
+ );
+}
diff --git a/polkadot/xcm/xcm-builder/tests/scenarios.rs b/polkadot/xcm/xcm-builder/tests/scenarios.rs
index 99c14f5bba1bc8fad67605ce8eddbf8185fa7caf..d7993e89eeebd79b07f5baf2009857d090e3ee3d 100644
--- a/polkadot/xcm/xcm-builder/tests/scenarios.rs
+++ b/polkadot/xcm/xcm-builder/tests/scenarios.rs
@@ -322,3 +322,101 @@ fn reserve_based_transfer_works() {
);
});
}
+
+/// Scenario:
+/// A recursive XCM that triggers itself via `SetAppendix`.
+/// The execution should fail due to inner filter.
+#[test]
+fn recursive_xcm_execution_fail() {
+ use crate::mock::*;
+ use frame_support::traits::{Everything, Nothing, ProcessMessageError};
+ use staging_xcm_builder::*;
+ use std::ops::ControlFlow;
+ use xcm::opaque::latest::prelude::*;
+ use xcm_executor::traits::{DenyExecution, Properties, ShouldExecute};
+
+ // Dummy filter to allow all
+ struct AllowAll;
+ impl ShouldExecute for AllowAll {
+ fn should_execute<RuntimeCall>(
+ _: &Location,
+ _: &mut [Instruction<RuntimeCall>],
+ _: Weight,
+ _: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ Ok(())
+ }
+ }
+
+ // Dummy filter which denies `ClearOrigin`
+ struct DenyClearOrigin;
+ impl DenyExecution for DenyClearOrigin {
+ fn deny_execution<RuntimeCall>(
+ _: &Location,
+ instructions: &mut [Instruction<RuntimeCall>],
+ _: Weight,
+ _: &mut Properties,
+ ) -> Result<(), ProcessMessageError> {
+ instructions.matcher().match_next_inst_while(
+ |_| true,
+ |inst| match inst {
+ ClearOrigin => Err(ProcessMessageError::Unsupported),
+ _ => Ok(ControlFlow::Continue(())),
+ },
+ )?;
+ Ok(())
+ }
+ }
+
+ struct XcmTestConfig;
+ impl xcm_executor::Config for XcmTestConfig {
+ type RuntimeCall = RuntimeCall;
+ type XcmSender = TestXcmRouter;
+ type AssetTransactor = LocalAssetTransactor;
+ type OriginConverter = ();
+ type IsReserve = ();
+ type IsTeleporter = TrustedTeleporters;
+ type UniversalLocation = UniversalLocation;
+ type Barrier = DenyThenTry<DenyRecursively<DenyClearOrigin>, AllowAll>;
+ type Weigher = FixedWeightBounds<BaseXcmWeight, RuntimeCall, MaxInstructions>;
+ type Trader = FixedRateOfFungible<KsmPerSecondPerByte, ()>;
+ type ResponseHandler = XcmPallet;
+ type AssetTrap = XcmPallet;
+ type AssetLocker = ();
+ type AssetExchanger = ();
+ type AssetClaims = XcmPallet;
+ type SubscriptionService = XcmPallet;
+ type PalletInstancesInfo = AllPalletsWithSystem;
+ type MaxAssetsIntoHolding = MaxAssetsIntoHolding;
+ type FeeManager = ();
+ type MessageExporter = ();
+ type UniversalAliases = Nothing;
+ type CallDispatcher = RuntimeCall;
+ type SafeCallFilter = Everything;
+ type Aliasers = Nothing;
+ type TransactionalProcessor = ();
+ type HrmpNewChannelOpenRequestHandler = ();
+ type HrmpChannelAcceptedHandler = ();
+ type HrmpChannelClosingHandler = ();
+ type XcmRecorder = XcmPallet;
+ }
+
+ let para_acc: AccountId = ParaId::from(PARA_ID).into_account_truncating();
+ let balances = vec![(ALICE, INITIAL_BALANCE), (para_acc.clone(), INITIAL_BALANCE)];
+ let origin = Parachain(PARA_ID);
+ let message = Xcm(vec![SetAppendix(Xcm(vec![SetAppendix(Xcm(vec![ClearOrigin]))]))]);
+ let mut hash = fake_message_hash(&message);
+ let weight = BaseXcmWeight::get() * 3;
+
+ kusama_like_with_balances(balances).execute_with(|| {
+ let outcome = XcmExecutor::<XcmTestConfig>::prepare_and_execute(
+ origin,
+ message,
+ &mut hash,
+ weight,
+ Weight::zero(),
+ );
+
+ assert_eq!(outcome, Outcome::Error { error: XcmError::Barrier });
+ });
+}
diff --git a/polkadot/xcm/xcm-executor/src/lib.rs b/polkadot/xcm/xcm-executor/src/lib.rs
index e2becdbdcd386c2245ca074af8d10610681acd61..19a6a645083f2925aa4d4d228808a2c1a12827cd 100644
--- a/polkadot/xcm/xcm-executor/src/lib.rs
+++ b/polkadot/xcm/xcm-executor/src/lib.rs
@@ -60,7 +60,13 @@ pub struct FeesMode {
pub jit_withdraw: bool,
}
-const RECURSION_LIMIT: u8 = 10;
+/// The maximum recursion depth allowed when executing nested XCM instructions.
+///
+/// Exceeding this limit results in `XcmError::ExceedsStackLimit` or
+/// `ProcessMessageError::StackLimitReached`.
+///
+/// Also used in the `DenyRecursively` barrier.
+pub const RECURSION_LIMIT: u8 = 10;
environmental::environmental!(recursion_count: u8);
@@ -794,13 +800,13 @@ impl<Config: config::Config> XcmExecutor<Config> {
let inst_res = recursion_count::using_once(&mut 1, || {
recursion_count::with(|count| {
if *count > RECURSION_LIMIT {
- return Err(XcmError::ExceedsStackLimit)
+ return None
}
*count = count.saturating_add(1);
- Ok(())
+ Some(())
})
- // This should always return `Some`, but let's play it safe.
- .unwrap_or(Ok(()))?;
+ .flatten()
+ .ok_or(XcmError::ExceedsStackLimit)?;
// Ensure that we always decrement the counter whenever we finish processing
// the instruction.
diff --git a/prdoc/pr_7200.prdoc b/prdoc/pr_7200.prdoc
new file mode 100644
index 0000000000000000000000000000000000000000..62d010e843075329142924a5a5293a75c510f496
--- /dev/null
+++ b/prdoc/pr_7200.prdoc
@@ -0,0 +1,40 @@
+title: 'XCM: Deny barrier checks for nested XCMs with specific instructions to be
+ executed on the local chain'
+doc:
+- audience: Runtime Dev
+ description: |-
+ This PR improves the validation of nested XCM instructions by introducing a
+ new barrier, `DenyRecursively`, which provides more precise control over
+ instruction denial. Previously, `DenyThenTry<Deny, Allow>`` was used, which
+ primarily applied denial rules at the top level. This has now been replaced
+ with `DenyThenTry<DenyRecursively<Deny>, Allow>`, ensuring that both
+ top-level and nested local instructions are properly checked. This change
+ enhances the security and predictability of XCM execution by enforcing
+ consistent denial policies across all levels of message execution. If you
+ need to deny instructions recursively make sure to change your barrier in
+ the XCM configuration.
+crates:
+- name: staging-xcm-builder
+ bump: minor
+- name: staging-xcm-executor
+ bump: minor
+- name: asset-hub-rococo-runtime
+ bump: patch
+- name: asset-hub-westend-runtime
+ bump: patch
+- name: bridge-hub-rococo-runtime
+ bump: patch
+- name: bridge-hub-westend-runtime
+ bump: patch
+- name: collectives-westend-runtime
+ bump: patch
+- name: contracts-rococo-runtime
+ bump: patch
+- name: coretime-rococo-runtime
+ bump: patch
+- name: coretime-westend-runtime
+ bump: patch
+- name: people-rococo-runtime
+ bump: patch
+- name: people-westend-runtime
+ bump: patch
diff --git a/templates/parachain/runtime/src/configs/xcm_config.rs b/templates/parachain/runtime/src/configs/xcm_config.rs
index 3da3b711f4ff3ccec15bd94947e0eb4c9f5e110f..ab1ce0d41d66681e020b59a5c19b5f06c47cc2a6 100644
--- a/templates/parachain/runtime/src/configs/xcm_config.rs
+++ b/templates/parachain/runtime/src/configs/xcm_config.rs
@@ -16,10 +16,11 @@ use frame_system::EnsureRoot;
use pallet_xcm::XcmPassthrough;
use polkadot_parachain_primitives::primitives::Sibling;
use polkadot_runtime_common::impls::ToAuthor;
+use polkadot_sdk::staging_xcm_builder::{DenyRecursively, DenyThenTry};
use xcm::latest::prelude::*;
use xcm_builder::{
AccountId32Aliases, AllowExplicitUnpaidExecutionFrom, AllowTopLevelPaidExecutionFrom,
- DenyReserveTransferToRelayChain, DenyThenTry, EnsureXcmOrigin, FixedWeightBounds,
+ DenyReserveTransferToRelayChain, EnsureXcmOrigin, FixedWeightBounds,
FrameTransactionalProcessor, FungibleAdapter, IsConcrete, NativeAsset, ParentIsPreset,
RelayChainAsNative, SiblingParachainAsNative, SiblingParachainConvertsVia,
SignedAccountId32AsNative, SignedToAccountId32, SovereignSignedViaLocation, TakeWeightCredit,
@@ -99,7 +100,7 @@ impl Contains<Location> for ParentOrParentsExecutivePlurality {
pub type Barrier = TrailingSetTopicAsId<
DenyThenTry<
- DenyReserveTransferToRelayChain,
+ DenyRecursively<DenyReserveTransferToRelayChain>,
(
TakeWeightCredit,
WithComputedOrigin<