Merge pull request #2138 from opentensor/fix-crowdloan-refund

Only allow the crowdloan creator to refund

Author: sam0x17

pallets/admin-utils/src/lib.rs

@@ -1252,7 +1252,7 @@ pub mod pallet {
         /// The extrinsic will call the Subtensor pallet to set the minimum delegate take.
         #[pallet::call_index(46)]
         #[pallet::weight((
-            Weight::from_parts(5_000_000, 0).saturating_add(T::DbWeight::get().writes(1_u64)),
+            Weight::from_parts(7_885_000, 0).saturating_add(T::DbWeight::get().writes(1_u64)),
             DispatchClass::Operational,
             Pays::Yes
         ))]
@@ -1999,7 +1999,7 @@ pub mod pallet {
         /// Only callable by root.
         #[pallet::call_index(74)]
         #[pallet::weight((
-			Weight::from_parts(5_771_000, 0)
+			Weight::from_parts(9_418_000, 0)
 				.saturating_add(<T as frame_system::Config>::DbWeight::get().reads(0_u64))
 				.saturating_add(<T as frame_system::Config>::DbWeight::get().writes(1_u64)),
 			DispatchClass::Operational

pallets/crowdloan/src/lib.rs

@@ -638,13 +638,16 @@ pub mod pallet {
             origin: OriginFor<T>,
             #[pallet::compact] crowdloan_id: CrowdloanId,
         ) -> DispatchResultWithPostInfo {
-            ensure_signed(origin)?;
+            let who = ensure_signed(origin)?;
 
             let mut crowdloan = Self::ensure_crowdloan_exists(crowdloan_id)?;
 
             // Ensure the crowdloan is not finalized
             ensure!(!crowdloan.finalized, Error::<T>::AlreadyFinalized);
 
+            // Only the creator can refund the crowdloan
+            ensure!(who == crowdloan.creator, Error::<T>::InvalidOrigin);
+
             let mut refunded_contributors: Vec<T::AccountId> = vec![];
             let mut refund_count = 0;
 

pallets/crowdloan/src/tests.rs

@@ -1618,20 +1618,47 @@ fn test_refund_succeeds() {
 }
 
 #[test]
-fn test_refund_fails_if_bad_origin() {
-    TestState::default().build_and_execute(|| {
-        let crowdloan_id: CrowdloanId = 0;
+fn test_refund_fails_if_bad_or_invalid_origin() {
+    TestState::default()
+        .with_balance(U256::from(1), 100)
+        .build_and_execute(|| {
+            // create a crowdloan
+            let crowdloan_id: CrowdloanId = 0;
+            let creator: AccountOf<Test> = U256::from(1);
+            let initial_deposit: BalanceOf<Test> = 50;
+            let min_contribution: BalanceOf<Test> = 10;
+            let cap: BalanceOf<Test> = 300;
+            let end: BlockNumberFor<Test> = 50;
+            assert_ok!(Crowdloan::create(
+                RuntimeOrigin::signed(creator),
+                initial_deposit,
+                min_contribution,
+                cap,
+                end,
+                Some(noop_call()),
+                None,
+            ));
 
-        assert_err!(
-            Crowdloan::refund(RuntimeOrigin::none(), crowdloan_id),
-            DispatchError::BadOrigin
-        );
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::none(), crowdloan_id),
+                DispatchError::BadOrigin
+            );
 
-        assert_err!(
-            Crowdloan::refund(RuntimeOrigin::root(), crowdloan_id),
-            DispatchError::BadOrigin
-        );
-    });
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::root(), crowdloan_id),
+                DispatchError::BadOrigin
+            );
+
+            // run some blocks
+            run_to_block(60);
+
+            // try to refund
+            let unknown_contributor: AccountOf<Test> = U256::from(2);
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::signed(unknown_contributor), crowdloan_id),
+                pallet_crowdloan::Error::<Test>::InvalidOrigin,
+            );
+        });
 }
 
 #[test]