Skip to content

[PM-22085] fix: ensure motion removal on failed dispatch in federated-authority pallet#938

Merged
m2ux merged 26 commits into
mainfrom
fix/PM-22085-motion-removal-failed-dispatch
May 7, 2026
Merged

[PM-22085] fix: ensure motion removal on failed dispatch in federated-authority pallet#938
m2ux merged 26 commits into
mainfrom
fix/PM-22085-motion-removal-failed-dispatch

Conversation

@m2ux

@m2ux m2ux commented Mar 13, 2026

Copy link
Copy Markdown
Contributor

Summary

Ensure that approved motions in the federated-authority pallet are always removed from on-chain storage after motion_close, regardless of whether the dispatched call succeeds or fails. Adds test coverage for the failure scenario and removes dead error variants.

🎫 Ticket 📐 Engineering


Motivation

The motion_close extrinsic in the federated-authority pallet used motion_result? to propagate dispatch errors after calling motion_remove. While this appeared to work, the #[pallet::call] transactional storage layer rolls back all mutations when the extrinsic returns Err — including the motion removal. This left motions with failing dispatches permanently stuck in storage with no recovery path, as identified by the Least Authority security audit (PM-19974).


Changes

  • Dispatch error handling — Remove motion_result? from the approved branch of motion_close. The dispatch outcome is captured in the MotionDispatched event; the extrinsic returns Ok regardless of dispatch success since the close operation itself (removal + events) always succeeds.
  • Test coverage — Add motion_close_removes_motion_on_failed_dispatch test that creates an approved motion with a Root-failing call (pallet_collective::Call::vote), closes it, and verifies the motion is removed and correct events are emitted.
  • Dead code cleanup — Remove 3 unused error variants (MotionTooEarlyToClose, MotionAlreadyExists, MotionExpired) that were never constructed.

📌 Submission Checklist

  • Changes are backward-compatible (or flagged if breaking)
  • Pull request description explains why the change is needed
  • Self-reviewed the diff
  • I have included a change file, or skipped for this reason: audit fix, no new features
  • If the changes introduce a new feature, I have bumped the node minor version
  • Update documentation (if relevant)
  • No new todos introduced

🔱 Fork Strategy

  • Node Runtime Update
  • Node Client Update
  • Other
  • N/A

🗹 TODO before merging

  • Ready for review

@github-actions

Copy link
Copy Markdown
Contributor

kics-logo

KICS version: v2.1.19

Category Results
CRITICAL CRITICAL 0
HIGH HIGH 2
MEDIUM MEDIUM 52
LOW LOW 3
INFO INFO 64
TRACE TRACE 0
TOTAL TOTAL 121
Metric Values
Files scanned placeholder 27
Files parsed placeholder 27
Files failed to scan placeholder 0
Total executed queries placeholder 73
Queries failed to execute placeholder 0
Execution time placeholder 11

@m2ux m2ux marked this pull request as ready for review March 13, 2026 15:59
@m2ux m2ux requested a review from a team as a code owner March 13, 2026 15:59
@m2ux m2ux self-assigned this Mar 13, 2026
@m2ux m2ux closed this Mar 13, 2026
@m2ux m2ux reopened this Mar 13, 2026
@m2ux

m2ux commented Mar 16, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux m2ux requested a review from ozgb March 24, 2026 11:01
@m2ux m2ux changed the title fix: ensure motion removal on failed dispatch in federated-authority pallet [PM-22085] fix: [PM-22085] ensure motion removal on failed dispatch in federated-authority pallet Mar 30, 2026
@m2ux

m2ux commented Mar 30, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux m2ux force-pushed the fix/PM-22085-motion-removal-failed-dispatch branch from 28ca8d1 to 05b8c56 Compare April 13, 2026 09:09
@m2ux

m2ux commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@m2ux m2ux enabled auto-merge April 13, 2026 09:25
@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux

m2ux commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux m2ux force-pushed the fix/PM-22085-motion-removal-failed-dispatch branch from 356f72b to 597a825 Compare April 13, 2026 14:33
m2ux and others added 8 commits April 14, 2026 09:58
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Add `create_root_failing_call()` test helper that constructs a
`pallet_collective::Call::vote` which fails with BadOrigin when
dispatched as Root. This provides infrastructure for testing motion
removal on dispatch failure.

Refs: PM-22085
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Add test `motion_close_removes_motion_on_failed_dispatch` that creates
an approved motion with a Root-failing call (pallet_collective::vote),
closes it, and verifies the motion is removed from storage and the
correct events (MotionDispatched with Err, MotionRemoved) are emitted.

Refs: PM-22085
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Remove `motion_result?` from the approved branch of `motion_close`.
The dispatch outcome is captured in the MotionDispatched event; the
motion is unconditionally removed regardless of dispatch success.

Propagating the error via `?` caused the pallet's transactional storage
layer to roll back the motion removal, leaving failed motions stuck in
storage indefinitely — the original bug reported in PM-22085.

Also remove three unused error variants (MotionTooEarlyToClose,
MotionAlreadyExists, MotionExpired) that were never constructed.

Refs: PM-22085
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Made-with: Cursor
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Mike Clay <mike.clay@shielded.io>
m2ux added a commit that referenced this pull request Apr 23, 2026
…ta (#938)

Signed-off-by: Mike Clay <mike.clay@shielded.io>
@m2ux

m2ux commented Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux

m2ux commented Apr 24, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux m2ux changed the title fix: [PM-22085] ensure motion removal on failed dispatch in federated-authority pallet [PM-22085] fix: ensure motion removal on failed dispatch in federated-authority pallet Apr 29, 2026
@m2ux m2ux added this pull request to the merge queue Apr 30, 2026
Comment thread pallets/federated-authority/src/lib.rs
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Apr 30, 2026
Signed-off-by: Mike Clay <mike.clay@shielded.io>
@m2ux

m2ux commented May 6, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

…emoval-failed-dispatch

Signed-off-by: Mike Clay <mike.clay@shielded.io>

# Conflicts:
#	metadata/static/midnight_metadata.scale
#	metadata/static/midnight_metadata_1.0.0.scale
@m2ux

m2ux commented May 6, 2026

Copy link
Copy Markdown
Contributor Author

/bot rebuild-metadata

@github-actions

github-actions Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

✅ Metadata rebuild complete! Changes have been committed.

@m2ux m2ux enabled auto-merge May 7, 2026 09:29
@m2ux m2ux added this pull request to the merge queue May 7, 2026
Merged via the queue into main with commit c06fbbd May 7, 2026
35 checks passed
@m2ux m2ux deleted the fix/PM-22085-motion-removal-failed-dispatch branch May 7, 2026 10:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Approved motions with failing dispatch stuck permanently in storage (federated-authority pallet)

2 participants