[PM-22085] fix: ensure motion removal on failed dispatch in federated-authority pallet#938
Merged
Merged
Conversation
Contributor
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
gilescope
pushed a commit
that referenced
this pull request
Apr 8, 2026
28ca8d1 to
05b8c56
Compare
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
14 tasks
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
356f72b to
597a825
Compare
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Add `create_root_failing_call()` test helper that constructs a `pallet_collective::Call::vote` which fails with BadOrigin when dispatched as Root. This provides infrastructure for testing motion removal on dispatch failure. Refs: PM-22085 Signed-off-by: Mike Clay <mike.clay@shielded.io>
Add test `motion_close_removes_motion_on_failed_dispatch` that creates an approved motion with a Root-failing call (pallet_collective::vote), closes it, and verifies the motion is removed from storage and the correct events (MotionDispatched with Err, MotionRemoved) are emitted. Refs: PM-22085 Signed-off-by: Mike Clay <mike.clay@shielded.io>
Remove `motion_result?` from the approved branch of `motion_close`. The dispatch outcome is captured in the MotionDispatched event; the motion is unconditionally removed regardless of dispatch success. Propagating the error via `?` caused the pallet's transactional storage layer to roll back the motion removal, leaving failed motions stuck in storage indefinitely — the original bug reported in PM-22085. Also remove three unused error variants (MotionTooEarlyToClose, MotionAlreadyExists, MotionExpired) that were never constructed. Refs: PM-22085 Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Mike Clay <mike.clay@shielded.io>
m2ux
added a commit
that referenced
this pull request
Apr 23, 2026
…ta (#938) Signed-off-by: Mike Clay <mike.clay@shielded.io>
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
gilescope
approved these changes
Apr 30, 2026
gilescope
reviewed
Apr 30, 2026
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
…emoval-failed-dispatch Signed-off-by: Mike Clay <mike.clay@shielded.io> # Conflicts: # metadata/static/midnight_metadata.scale # metadata/static/midnight_metadata_1.0.0.scale
Contributor
Author
|
/bot rebuild-metadata |
Contributor
|
✅ Metadata rebuild complete! Changes have been committed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.








Summary
Ensure that approved motions in the federated-authority pallet are always removed from on-chain storage after
motion_close, regardless of whether the dispatched call succeeds or fails. Adds test coverage for the failure scenario and removes dead error variants.🎫 Ticket 📐 Engineering
Motivation
The
motion_closeextrinsic in the federated-authority pallet usedmotion_result?to propagate dispatch errors after callingmotion_remove. While this appeared to work, the#[pallet::call]transactional storage layer rolls back all mutations when the extrinsic returnsErr— including the motion removal. This left motions with failing dispatches permanently stuck in storage with no recovery path, as identified by the Least Authority security audit (PM-19974).Changes
motion_result?from the approved branch ofmotion_close. The dispatch outcome is captured in theMotionDispatchedevent; the extrinsic returnsOkregardless of dispatch success since the close operation itself (removal + events) always succeeds.motion_close_removes_motion_on_failed_dispatchtest that creates an approved motion with a Root-failing call (pallet_collective::Call::vote), closes it, and verifies the motion is removed and correct events are emitted.MotionTooEarlyToClose,MotionAlreadyExists,MotionExpired) that were never constructed.📌 Submission Checklist
🔱 Fork Strategy
🗹 TODO before merging