Why is XCM program execution filtered out on most chains?

Tech Talk
1

While writing some XCM programs and trying to execute them on different chains I realised that most chains would filter them out.

The reason for this is because many chains are configured in the following way:
polkadot xcm configuration

I first thought that this is only disabled on Polkadot chains since I noticed that Kusama allows the execution of XCM messages.

However, after looking at some Kusama parachains I noticed that many of them also filter out any XCM program execution.

A few examples:

Kusama Asset Hub
Karura
Moonriver

What is the reason for not allowing this functionality on these chains?

2 Likes
2

Good question. It may be for security reasons or just simply copying.

1 Like
3

execute was initially filtered out because XCM has not been audited, and we wanted some guarantees on security. Nowadays, it’s probably fine to enable now, since all XCM executions get prepended with a DescendOrigin, which lowers the privilege level to that of the account that called the execute extrinsic.

Another closely related extrinsic is send, and this one is definitely more unsafe to allow for anyone to call. Recall that XCM is meant to be written by developers – it is very easy for non-developers to write an incorrect XCM program which results in a loss of funds, especially in a cross-chain environment. Thus, send should at the very least be filtered not to be allowed by everyone to call.

4 Likes
4

Apart from loss of funds, do you see any other security risks when allowing anyone calling xcm.send?

5

Opened an issue on polkadot-sdk to possibly allow generic XCM execution on Kusama system parachains. link