be strict on locks

Author: enthusiastmartin

Cargo.lock

@@ -1114,7 +1114,7 @@ fn cancel_unstake_should_fail_when_no_pending() {
 
 		assert_noop!(
 			GigaHdx::cancel_unstake(RuntimeOrigin::signed(alice), 0),
-			pallet_gigahdx::Error::<Runtime>::NoPendingUnstake,
+			pallet_gigahdx::Error::<Runtime>::PendingUnstakeNotFound,
 		);
 	});
 }
@@ -1681,3 +1681,64 @@ fn unlock_should_release_full_compounded_amount_e2e() {
 		assert_eq!(locked_under_ghdx(&alice), 0);
 	});
 }
+
+// Strict admission: any non-overlap-allowed lock (legacy staking, vesting,
+// democracy, …) blocks `giga_stake` entirely, even when free_balance is
+// sufficient. This prevents the lock-layering exploit at the root: the
+// `stk_stks` + `ghdxlock` overlap can never be set up in the first place.
+#[test]
+fn giga_stake_should_fail_when_caller_has_legacy_staking_lock() {
+	use frame_support::traits::{LockableCurrency, WithdrawReasons};
+
+	TestNet::reset();
+	hydra_live_ext(PATH_TO_SNAPSHOT).execute_with(|| {
+		reset_giga_state_for_fixture();
+		let alice: AccountId = ALICE.into();
+
+		assert_ok!(Balances::force_set_balance(
+			RawOrigin::Root.into(),
+			alice.clone(),
+			2_000 * UNITS,
+		));
+		let _ = EVMAccounts::bind_evm_address(RuntimeOrigin::signed(alice.clone()));
+		<Balances as LockableCurrency<_>>::set_lock(*b"stk_stks", &alice, 1_000 * UNITS, WithdrawReasons::all());
+
+		assert_noop!(
+			GigaHdx::giga_stake(RuntimeOrigin::signed(alice), 500 * UNITS),
+			pallet_gigahdx::Error::<Runtime>::BlockedByExternalLock,
+		);
+	});
+}
+
+// `pyconvot` is in the runtime's overlap allowlist (HdxExternalClaims), so a
+// conviction-voting lock must NOT block stake admission — the voter's HDX is
+// only earmarked, not committed to a payout, so sharing it with a gigahdx
+// stake is safe.
+#[test]
+fn giga_stake_should_succeed_when_caller_has_conviction_voting_lock() {
+	TestNet::reset();
+	hydra_live_ext(PATH_TO_SNAPSHOT).execute_with(|| {
+		reset_giga_state_for_fixture();
+		fund_bob_for_decision_deposit();
+
+		let alice: AccountId = ALICE.into();
+		fund(&alice, 1_000 * UNITS);
+
+		let ref_index = begin_referendum_by_bob();
+		assert_ok!(ConvictionVoting::vote(
+			RuntimeOrigin::signed(alice.clone()),
+			ref_index,
+			aye_with_conviction(800 * UNITS, Conviction::Locked1x),
+		));
+
+		let conviction_lock = pallet_balances::Locks::<Runtime>::get(&alice)
+			.iter()
+			.find(|l| l.id == *b"pyconvot")
+			.map(|l| l.amount)
+			.unwrap_or(0);
+		assert_eq!(conviction_lock, 800 * UNITS);
+
+		assert_ok!(GigaHdx::giga_stake(RuntimeOrigin::signed(alice.clone()), 500 * UNITS));
+		assert_eq!(pallet_gigahdx::Stakes::<Runtime>::get(&alice).unwrap().hdx, 500 * UNITS,);
+	});
+}

integration-tests/src/gigahdx.rs

@@ -33,6 +33,8 @@
 
 pub use pallet::*;
 
+pub mod traits;
+
 #[cfg(test)]
 mod tests;
 
@@ -60,6 +62,7 @@ impl<AccountId> BenchmarkHelper<AccountId> for () {
 
 #[frame_support::pallet]
 pub mod pallet {
+	pub use crate::traits::ExternalClaims;
 	pub use crate::weights::WeightInfo;
 	use codec::{Decode, DecodeWithMemTracking, Encode, MaxEncodedLen};
 	use frame_support::pallet_prelude::*;
@@ -69,7 +72,7 @@ pub mod pallet {
 	use frame_support::traits::fungibles::Mutate as FungiblesMutate;
 	use frame_support::traits::tokens::{Fortitude, Precision, Preservation};
 	use frame_support::traits::{
-		fungible, fungibles, Currency, ExistenceRequirement, LockIdentifier, LockableCurrency, WithdrawReasons,
+		fungibles, Currency, ExistenceRequirement, LockIdentifier, LockableCurrency, WithdrawReasons,
 	};
 	use frame_support::{transactional, PalletId};
 	use frame_system::pallet_prelude::*;
@@ -121,11 +124,7 @@ pub mod pallet {
 
 	#[pallet::config]
 	pub trait Config: frame_system::Config<RuntimeEvent: From<Event<Self>>> {
-		/// Native (HDX) lockable currency. The `fungible::Inspect` bound is
-		/// required so `giga_stake` can use `reducible_balance` (free balance
-		/// minus transfer-blocking locks) instead of raw `free_balance`.
-		type NativeCurrency: LockableCurrency<Self::AccountId, Balance = Balance, Moment = BlockNumberFor<Self>>
-			+ fungible::Inspect<Self::AccountId, Balance = Balance>;
+		type NativeCurrency: LockableCurrency<Self::AccountId, Balance = Balance, Moment = BlockNumberFor<Self>>;
 
 		/// Multi-asset register that holds stHDX (and any other registered
 		/// fungible). Only this pallet mints / burns stHDX through it.
@@ -163,6 +162,12 @@ pub mod pallet {
 		#[pallet::constant]
 		type MaxPendingUnstakes: Get<u32>;
 
+		/// Inspector returning the sum of non-overlapping HDX claims on the
+		/// caller. Any non-zero value blocks `giga_stake` admission — the
+		/// strict policy rejects stakes whenever the account carries a lock
+		/// the runtime has not whitelisted for overlap (e.g. `pyconvot`).
+		type ExternalClaims: crate::traits::ExternalClaims<Self::AccountId>;
+
 		type WeightInfo: WeightInfo;
 
 		/// Benchmark helper for setting up state that can't be created from
@@ -237,10 +242,15 @@ pub mod pallet {
 	pub enum Error<T> {
 		/// Stake amount is below `Config::MinStake`.
 		BelowMinStake,
-		/// Caller does not have enough unlocked HDX to back this stake (the
-		/// admission check uses `reducible_balance`, which subtracts every
-		/// transfer-blocking lock — including this pallet's own lock).
+		/// Caller doesn't have enough unencumbered HDX to back the stake
+		/// after subtracting their existing gigahdx commitment.
 		InsufficientFreeBalance,
+		/// Caller holds a non-overlapping lock (legacy staking, vesting, …)
+		/// reported by `Config::ExternalClaims`. Strict policy: gigahdx
+		/// admission requires the caller to have no claims on their HDX
+		/// other than those the runtime explicitly allows to coexist
+		/// (e.g. `pyconvot`). Release the conflicting lock before staking.
+		BlockedByExternalLock,
 		/// Unstake amount exceeds the caller's `Stakes.gigahdx`.
 		InsufficientStake,
 		/// Caller has no active stake record.
@@ -289,10 +299,12 @@ pub mod pallet {
 		/// money market (may differ from the requested mint amount by rounding).
 		///
 		/// Fails with `BelowMinStake` if `amount < Config::MinStake`, with
-		/// `InsufficientFreeBalance` if the caller's `reducible_balance` does not cover
-		/// `amount`, with `StHdxMintFailed` if stHDX minting fails (asset not registered,
-		/// max issuance hit), or with `MoneyMarketSupplyFailed` if the AAVE `Pool.supply`
-		/// call reverts.
+		/// `BlockedByExternalLock` if `Config::ExternalClaims::on(caller) > 0`
+		/// (the caller holds a non-allowed lock — strict policy rejects
+		/// stake admission entirely), with `InsufficientFreeBalance` if
+		/// `free_balance − own_gigahdx_commitment < amount`, with
+		/// `StHdxMintFailed` if stHDX minting fails, or with
+		/// `MoneyMarketSupplyFailed` if the AAVE `Pool.supply` call reverts.
 		///
 		/// Parameters:
 		/// - `amount`: HDX amount to stake. Must be at least `Config::MinStake`.
@@ -305,15 +317,19 @@ pub mod pallet {
 			let who = ensure_signed(origin)?;
 			ensure!(amount >= T::MinStake::get(), Error::<T>::BelowMinStake);
 
-			// Use `reducible_balance` so the check respects every transfer-blocking
-			// lock — including this pallet's own combined `LockId` lock (active
-			// stake + pending unstake) and any unrelated conviction/vesting locks.
-			let usable = <T::NativeCurrency as fungible::Inspect<T::AccountId>>::reducible_balance(
-				&who,
-				Preservation::Expendable,
-				Fortitude::Polite,
-			);
-			ensure!(usable >= amount, Error::<T>::InsufficientFreeBalance);
+			// Strict policy: refuse if the caller carries any lock the runtime
+			// does not whitelist for overlap. Lock-layering via `max()` would
+			// otherwise let the same HDX back both a gigahdx stake and another
+			// pallet's claim after a single transfer of the unlocked portion.
+			ensure!(T::ExternalClaims::on(&who) == 0, Error::<T>::BlockedByExternalLock);
+
+			// Own commitment (active + pending unstakes) still has to fit
+			// under free_balance — re-staking under the same `ghdxlock` must
+			// not exceed what the user actually owns.
+			let stake = Stakes::<T>::get(&who).unwrap_or_default();
+			let own_claim = stake.hdx.saturating_add(stake.unstaking);
+			let stakeable = T::NativeCurrency::free_balance(&who).saturating_sub(own_claim);
+			ensure!(stakeable >= amount, Error::<T>::InsufficientFreeBalance);
 
 			Self::do_stake(&who, amount)?;
 			Ok(())
@@ -613,9 +629,12 @@ pub mod pallet {
 		/// `Staked`.
 		///
 		/// Caller invariant: `amount` HDX must already be in `who`'s free
-		/// balance. This helper does not enforce the `MinStake` floor — callers
-		/// requiring that check (e.g. the `giga_stake` extrinsic) must perform
-		/// it before invoking `do_stake`.
+		/// balance. This helper performs **no admission control** — neither
+		/// the `MinStake` floor nor the `ExternalClaims`/headroom checks that
+		/// `giga_stake` applies. It is intended for trusted internal callers
+		/// (e.g. `cancel_unstake` rearranging already-locked HDX, or
+		/// `pallet-gigahdx-rewards` compounding accrued rewards). Untrusted
+		/// callers must replicate the `giga_stake` checks before invoking.
 		#[transactional]
 		pub fn do_stake(who: &T::AccountId, amount: Balance) -> Result<Balance, DispatchError> {
 			ensure!(amount > 0, Error::<T>::ZeroAmount);

pallets/gigahdx/src/lib.rs

@@ -181,6 +181,26 @@ impl MoneyMarketOperations<AccountId, AssetId, Balance> for TestMoneyMarket {
 	}
 }
 
+// ---------- TestExternalClaims ----------
+
+thread_local! {
+	pub static EXTERNAL_CLAIMS: RefCell<Balance> = const { RefCell::new(0) };
+}
+
+pub struct TestExternalClaims;
+
+impl TestExternalClaims {
+	pub fn set(value: Balance) {
+		EXTERNAL_CLAIMS.with(|v| *v.borrow_mut() = value);
+	}
+}
+
+impl pallet_gigahdx::traits::ExternalClaims<AccountId> for TestExternalClaims {
+	fn on(_who: &AccountId) -> Balance {
+		EXTERNAL_CLAIMS.with(|v| *v.borrow())
+	}
+}
+
 // ---------- pallet-gigahdx config ----------
 
 parameter_types! {
@@ -203,6 +223,7 @@ impl pallet_gigahdx::Config for Test {
 	type MinStake = GigaHdxMinStake;
 	type CooldownPeriod = GigaHdxCooldownPeriod;
 	type MaxPendingUnstakes = GigaHdxMaxPendingUnstakes;
+	type ExternalClaims = TestExternalClaims;
 	type WeightInfo = ();
 	#[cfg(feature = "runtime-benchmarks")]
 	type BenchmarkHelper = ();
@@ -282,6 +303,7 @@ impl ExtBuilder {
 		let mut ext: sp_io::TestExternalities = t.into();
 		ext.execute_with(|| {
 			TestMoneyMarket::reset();
+			TestExternalClaims::set(0);
 			System::set_block_number(1);
 		});
 		ext

pallets/gigahdx/src/tests/mock.rs

@@ -185,3 +185,63 @@ fn giga_stake_should_revert_storage_when_mm_supply_fails() {
 		assert_eq!(TestMoneyMarket::balance_of(&ALICE), 0);
 	});
 }
+
+#[test]
+fn giga_stake_should_subtract_own_existing_stake() {
+	// Alice has 1000 ONE total. Two 500 stakes max out her balance; a third
+	// stake of 1 must fail because own_claim now equals her whole balance.
+	ExtBuilder::default().build().execute_with(|| {
+		assert_ok!(GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 500 * ONE));
+		assert_ok!(GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 500 * ONE));
+		assert_noop!(
+			GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), ONE),
+			Error::<Test>::InsufficientFreeBalance,
+		);
+	});
+}
+
+#[test]
+fn giga_stake_should_fail_when_external_claims_nonzero() {
+	// Strict policy: any non-zero external claim blocks admission,
+	// regardless of how much free balance the caller has.
+	ExtBuilder::default().build().execute_with(|| {
+		TestExternalClaims::set(ONE);
+		assert_noop!(
+			GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 100 * ONE),
+			Error::<Test>::BlockedByExternalLock,
+		);
+	});
+}
+
+#[test]
+fn giga_stake_should_fail_when_external_claim_appears_after_stake() {
+	// Existing staker who later acquires another lock (e.g. legacy
+	// staking) can't grow their gigahdx position.
+	ExtBuilder::default().build().execute_with(|| {
+		assert_ok!(GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 400 * ONE));
+		TestExternalClaims::set(ONE);
+		assert_noop!(
+			GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), ONE),
+			Error::<Test>::BlockedByExternalLock,
+		);
+	});
+}
+
+#[test]
+fn giga_stake_should_treat_unstaking_as_own_claim() {
+	// After a full unstake, stake.hdx → 0 and stake.unstaking holds the pending
+	// amount. A fresh stake must still see that pending portion as committed.
+	ExtBuilder::default().build().execute_with(|| {
+		assert_ok!(GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 600 * ONE));
+		assert_ok!(GigaHdx::giga_unstake(RawOrigin::Signed(ALICE).into(), 600 * ONE));
+		let s = Stakes::<Test>::get(ALICE).unwrap();
+		assert_eq!(s.hdx, 0);
+		assert_eq!(s.unstaking, 600 * ONE);
+
+		assert_noop!(
+			GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 500 * ONE),
+			Error::<Test>::InsufficientFreeBalance,
+		);
+		assert_ok!(GigaHdx::giga_stake(RawOrigin::Signed(ALICE).into(), 400 * ONE));
+	});
+}

pallets/gigahdx/src/tests/stake.rs

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Hooks injected by the runtime to customize gigahdx admission logic.
+
+use primitives::Balance;
+
+/// Sum of HDX claimed by other pallets on `who`. `giga_stake` subtracts this
+/// from the caller's free balance to ensure the new stake doesn't overlap
+/// with HDX already pledged elsewhere. The runtime decides which lock ids
+/// count as claims (legacy staking, vesting, …) and which are allowed to
+/// overlap with a gigahdx stake (e.g. conviction voting).
+pub trait ExternalClaims<AccountId> {
+	fn on(who: &AccountId) -> Balance;
+}
+
+impl<AccountId> ExternalClaims<AccountId> for () {
+	fn on(_who: &AccountId) -> Balance {
+		0
+	}
+}

pallets/gigahdx/src/traits.rs

@@ -1,6 +1,6 @@
 [package]
 name = "hydradx-runtime"
-version = "418.0.0"
+version = "420.0.0"
 authors = ["GalacticCouncil"]
 edition = "2021"
 license = "Apache 2.0"

runtime/hydradx/Cargo.toml

@@ -1907,6 +1907,7 @@ impl pallet_gigahdx::Config for Runtime {
 	type MinStake = GigaHdxMinStake;
 	type CooldownPeriod = GigaHdxCooldownPeriod;
 	type MaxPendingUnstakes = GigaHdxMaxPendingUnstakes;
+	type ExternalClaims = crate::gigahdx::HdxExternalClaims;
 	type WeightInfo = weights::pallet_gigahdx::HydraWeight<Runtime>;
 	#[cfg(feature = "runtime-benchmarks")]
 	type BenchmarkHelper = GigaHdxBenchmarkHelper;

runtime/hydradx/src/assets.rs

@@ -20,6 +20,7 @@ use crate::Runtime;
 use evm::ExitReason::Succeed;
 use frame_support::sp_runtime::traits::Convert;
 use frame_support::sp_runtime::DispatchError;
+use frame_support::traits::LockIdentifier;
 use frame_support::weights::Weight;
 use hydradx_traits::evm::{CallContext, CallResult, Erc20Mapping, InspectEvmAccounts, ERC20, EVM};
 use hydradx_traits::gigahdx::MoneyMarketOperations;
@@ -189,3 +190,20 @@ impl ReferendaTrackInspect<ReferendumIndex, u16> for RuntimeReferenda {
 		}
 	}
 }
+
+/// `ExternalClaims` impl: sum of HDX claimed by other pallets that should NOT
+/// overlap with a gigahdx stake. `ghdxlock` is excluded because the pallet
+/// accounts for it from its own ledger; `pyconvot` is excluded because a
+/// conviction vote is intentionally permitted to share HDX with a stake.
+pub struct HdxExternalClaims;
+
+impl pallet_gigahdx::traits::ExternalClaims<AccountId> for HdxExternalClaims {
+	fn on(who: &AccountId) -> Balance {
+		const ALLOWED_OVERLAP: &[LockIdentifier] = &[*b"ghdxlock", *b"pyconvot"];
+		pallet_balances::Locks::<Runtime>::get(who)
+			.iter()
+			.filter(|l| !ALLOWED_OVERLAP.contains(&l.id))
+			.map(|l| l.amount)
+			.fold(0, Balance::saturating_add)
+	}
+}

runtime/hydradx/src/gigahdx.rs

@@ -129,7 +129,7 @@ pub const VERSION: RuntimeVersion = RuntimeVersion {
 	spec_name: Cow::Borrowed("hydradx"),
 	impl_name: Cow::Borrowed("hydradx"),
 	authoring_version: 1,
-	spec_version: 418,
+	spec_version: 420,
 	impl_version: 0,
 	apis: RUNTIME_API_VERSIONS,
 	transaction_version: 1,