Security vulnerability: Executing unauthorized XCM messages

The pattern is not wrong and is valid code. The problem here is more that multiple things need to come together to make this work. I also relaxed my initial fix pr later: pallet-utility: Only disallow the `None` origin by bkchr · Pull Request #12351 · paritytech/substrate · GitHub So, we now only reject the None origin.

I think we should also make all inherents required, meaning if they don’t appear in the extrinsics the block is invalid. This would also allow us again to bring back the None origin to batch. So, a lint is not that easy :stuck_out_tongue:

Nevertheless, playing around with these lints would probably nice. I read the docs once, but not that detailed and don’t remember everything. However, I think a good lint would be that a pallet that provides a SignedExtension throws an error lint if the SignedExtension is not added to the runtime. I this happens, I would vote for some large tip :slight_smile: