ensure none

Author: enthusiastmartin

integration-tests/src/pepl.rs

@@ -1411,7 +1411,7 @@ fn liquidate_with_pool_should_liquidate_when_pool_matches_deployed_pool() {
 		let decision = v2_decision(caller, borrower_evm);
 
 		assert_ok!(Liquidation::liquidate_with_pool(
-			RuntimeOrigin::signed(BOB.into()),
+			RuntimeOrigin::none(),
 			pool_contract,
 			decision.collateral_asset,
 			decision.debt_asset,
@@ -1438,7 +1438,7 @@ fn liquidate_with_pool_should_fail_when_pool_is_wrong() {
 
 		frame_support::assert_noop!(
 			Liquidation::liquidate_with_pool(
-				RuntimeOrigin::signed(BOB.into()),
+				RuntimeOrigin::none(),
 				EvmAddress::from_slice(&[0x42; 20]),
 				decision.collateral_asset,
 				decision.debt_asset,

pallets/liquidation/src/lib.rs

@@ -40,7 +40,7 @@ use frame_support::{
 	},
 	PalletId,
 };
-use frame_system::{pallet_prelude::OriginFor, RawOrigin};
+use frame_system::{ensure_none, pallet_prelude::OriginFor, RawOrigin};
 use hydradx_traits::evm::CallResult;
 use hydradx_traits::evm::Erc20Mapping;
 use hydradx_traits::gigahdx::Seize;
@@ -369,8 +369,13 @@ pub mod pallet {
 		/// This lets a multi-money-market worker state which market a decision was made
 		/// against and guarantees the liquidation can never execute against a different one.
 		///
+		/// Unlike `liquidate`, this call is not publicly dispatchable: the origin must be
+		/// none, and `ValidateUnsigned` rejects externally received transactions, so only
+		/// a collator's own liquidation worker can submit it. The public permissionless
+		/// path remains `liquidate`.
+		///
 		/// Parameters:
-		/// - `origin`: Signed origin.
+		/// - `origin`: Must be none (unsigned transaction).
 		/// - `pool`: EVM address of the money-market pool this liquidation targets.
 		/// - `collateral_asset`: Asset ID used as collateral in the MM position.
 		/// - `debt_asset`: Asset ID used as debt in the MM position.
@@ -402,7 +407,7 @@ pub mod pallet {
 		)]
 		#[allow(clippy::too_many_arguments)]
 		pub fn liquidate_with_pool(
-			_origin: OriginFor<T>,
+			origin: OriginFor<T>,
 			pool: EvmAddress,
 			collateral_asset: AssetId,
 			debt_asset: AssetId,
@@ -411,6 +416,8 @@ pub mod pallet {
 			route: Route<AssetId>,
 			_unsigned_priority: Option<Priority>,
 		) -> DispatchResult {
+			ensure_none(origin)?;
+
 			let expected = if collateral_asset == T::GigaHdx::gigahdx_asset_id() {
 				T::GigaHdx::pool_contract().ok_or(Error::<T>::GigaHdxPoolNotSet)?
 			} else {

pallets/liquidation/src/tests/liquidation.rs

@@ -389,7 +389,7 @@ fn liquidate_with_pool_should_liquidate_when_pool_matches_borrowing_contract() {
 
 		// Act
 		assert_ok!(Liquidation::liquidate_with_pool(
-			RuntimeOrigin::signed(ALICE),
+			RuntimeOrigin::none(),
 			pool,
 			HDX, // collateral
 			DOT, // debt
@@ -433,7 +433,7 @@ fn liquidate_with_pool_should_fail_when_pool_does_not_match_borrowing_contract()
 
 		assert_noop!(
 			Liquidation::liquidate_with_pool(
-				RuntimeOrigin::signed(ALICE),
+				RuntimeOrigin::none(),
 				EvmAddress::from_slice(&[8; 20]), // not the borrowing contract
 				HDX,
 				DOT,
@@ -457,7 +457,7 @@ fn liquidate_with_pool_should_fail_when_gigahdx_pool_is_not_set() {
 
 		assert_noop!(
 			Liquidation::liquidate_with_pool(
-				RuntimeOrigin::signed(ALICE),
+				RuntimeOrigin::none(),
 				EvmAddress::from_slice(&[9; 20]),
 				67,  // GIGAHDX collateral routes the pool check to `pool_contract()`
 				222, // HOLLAR
@@ -471,6 +471,29 @@ fn liquidate_with_pool_should_fail_when_gigahdx_pool_is_not_set() {
 	});
 }
 
+// `liquidate_with_pool` is the worker-only channel — the public permissionless path is
+// `liquidate`. Signed submissions must be rejected before any liquidation logic runs.
+#[test]
+fn liquidate_with_pool_should_fail_when_origin_is_signed() {
+	ExtBuilder::default().build().execute_with(|| {
+		let bob_evm_address = EvmAccounts::evm_address(&BOB);
+
+		assert_noop!(
+			Liquidation::liquidate_with_pool(
+				RuntimeOrigin::signed(ALICE),
+				EvmAddress::from_slice(&[9; 20]),
+				HDX,
+				DOT,
+				bob_evm_address,
+				1_000 * ONE,
+				BoundedVec::new(),
+				None,
+			),
+			sp_runtime::traits::BadOrigin
+		);
+	});
+}
+
 #[test]
 fn validate_unsigned_should_provide_user_and_pool_when_call_is_liquidate_with_pool() {
 	ExtBuilder::default().build().execute_with(|| {