[phantom]: enforce phantom bid window < interval in governance setters

- set_phantom_order_config and set_phantom_bid_window now reject a config where
  the effective bid window (resolving the 0 fallback to PhantomOrderBidWindowBlocks)
  is not strictly shorter than interval_blocks. This guarantees the on_finalize
  invariant: a batch is never replaced on the same block its window closes, so its
  PhantomBidWindowExhausted snapshot is never dropped. interval_blocks == 0
  (generate-once) is exempt as there is no regeneration to race.
- New error PhantomBidWindowNotShorterThanInterval.
- tests: add PhantomOrderBidWindowBlocks to the mock Config (was missing, which
  broke the test build) and cover both setters' guard plus the no-config case.

Author: Wizdave97

modules/pallets/intents-coprocessor/src/lib.rs

@@ -234,6 +234,10 @@ pub mod pallet {
 		PhantomOrderBidWindowClosed,
 		/// A filler already has a bid for this phantom order
 		DuplicatePhantomBid,
+		/// The effective phantom bid window is not shorter than the generation interval.
+		/// They must satisfy `window < interval_blocks` so a batch is never replaced on the
+		/// same block its bid window closes (which would drop its exhaustion snapshot).
+		PhantomBidWindowNotShorterThanInterval,
 	}
 
 	#[pallet::call]
@@ -546,6 +550,14 @@ pub mod pallet {
 			let interval_blocks = config.interval_blocks;
 			let chain = config.chain.clone();
 
+			// The bid window must close strictly before the next generation so on_finalize emits
+			// each batch's exhaustion before on_initialize replaces it. interval_blocks == 0 means
+			// generate once and never regenerate, so there is no replacement to race.
+			ensure!(
+				interval_blocks == 0 || Self::phantom_bid_window() < interval_blocks,
+				Error::<T>::PhantomBidWindowNotShorterThanInterval
+			);
+
 			PhantomOrderConfig::<T>::put(&config);
 			CurrentPhantomOrder::<T>::kill();
 			LastPhantomGeneration::<T>::kill();
@@ -565,6 +577,18 @@ pub mod pallet {
 		pub fn set_phantom_bid_window(origin: OriginFor<T>, window: u32) -> DispatchResult {
 			T::GovernanceOrigin::ensure_origin(origin)?;
 
+			// Resolve the window the way phantom_bid_window() would: 0 falls back to the
+			// configured constant. Enforce window < interval_blocks against the active config
+			// (if any) so a batch is never replaced on the block its bid window closes.
+			let effective_window =
+				if window == 0 { T::PhantomOrderBidWindowBlocks::get() } else { window };
+			if let Some(config) = PhantomOrderConfig::<T>::get() {
+				ensure!(
+					config.interval_blocks == 0 || effective_window < config.interval_blocks,
+					Error::<T>::PhantomBidWindowNotShorterThanInterval
+				);
+			}
+
 			PhantomBidWindow::<T>::put(window);
 
 			Self::deposit_event(Event::PhantomBidWindowUpdated { window });

modules/pallets/intents-coprocessor/src/tests.rs

@@ -25,7 +25,7 @@ use frame_support::{
 	BoundedVec,
 };
 use frame_system::EnsureRoot;
-use ismp::host::StateMachine;
+use ismp::{consensus::StateMachineId, host::StateMachine};
 use ismp_testsuite::mocks::MockRouter;
 
 use polkadot_sdk::*;
@@ -136,12 +136,14 @@ impl pallet_ismp::Config for Test {
 
 parameter_types! {
 	pub const StorageDepositFee: Balance = 100;
+	pub const PhantomOrderBidWindowBlocks: u32 = 100;
 }
 
 impl pallet_intents::Config for Test {
 	type Dispatcher = Ismp;
 	type Currency = Balances;
 	type StorageDepositFee = StorageDepositFee;
+	type PhantomOrderBidWindowBlocks = PhantomOrderBidWindowBlocks;
 	type GovernanceOrigin = EnsureRoot<AccountId>;
 	type WeightInfo = ();
 }
@@ -588,3 +590,68 @@ fn multiple_fillers_can_bid_on_same_order() {
 		assert!(Bids::<Test>::contains_key(&commitment, &filler2));
 	});
 }
+
+fn phantom_config(interval_blocks: u32) -> types::PhantomOrderConfiguration {
+	types::PhantomOrderConfiguration {
+		chain: StateMachineId { state_id: StateMachine::Evm(1), consensus_state_id: *b"ETH0" },
+		token_pairs: BoundedVec::try_from(vec![types::PhantomTokenPair {
+			token_a: H160::repeat_byte(1),
+			token_b: H160::repeat_byte(2),
+			standard_amount: 1_000_000,
+		}])
+		.unwrap(),
+		interval_blocks,
+	}
+}
+
+#[test]
+fn set_phantom_order_config_rejects_window_not_shorter_than_interval() {
+	new_test_ext().execute_with(|| {
+		// Default PhantomBidWindow is 0, so the effective window is the fallback constant (100).
+		// An interval equal to or below the window must be rejected.
+		assert_noop!(
+			Intents::set_phantom_order_config(RuntimeOrigin::root(), phantom_config(100)),
+			Error::<Test>::PhantomBidWindowNotShorterThanInterval
+		);
+		assert_noop!(
+			Intents::set_phantom_order_config(RuntimeOrigin::root(), phantom_config(50)),
+			Error::<Test>::PhantomBidWindowNotShorterThanInterval
+		);
+
+		// An interval strictly greater than the window is accepted.
+		assert_ok!(Intents::set_phantom_order_config(RuntimeOrigin::root(), phantom_config(200)));
+
+		// interval_blocks == 0 means generate-once (no regeneration), so the invariant is vacuous.
+		assert_ok!(Intents::set_phantom_order_config(RuntimeOrigin::root(), phantom_config(0)));
+	});
+}
+
+#[test]
+fn set_phantom_bid_window_rejects_window_not_shorter_than_interval() {
+	new_test_ext().execute_with(|| {
+		assert_ok!(Intents::set_phantom_order_config(RuntimeOrigin::root(), phantom_config(200)));
+
+		// A window equal to or above the active interval must be rejected.
+		assert_noop!(
+			Intents::set_phantom_bid_window(RuntimeOrigin::root(), 200),
+			Error::<Test>::PhantomBidWindowNotShorterThanInterval
+		);
+		assert_noop!(
+			Intents::set_phantom_bid_window(RuntimeOrigin::root(), 250),
+			Error::<Test>::PhantomBidWindowNotShorterThanInterval
+		);
+
+		// A window of 0 resolves to the fallback constant (100), which is < 200.
+		assert_ok!(Intents::set_phantom_bid_window(RuntimeOrigin::root(), 0));
+		// An explicit window below the interval is accepted.
+		assert_ok!(Intents::set_phantom_bid_window(RuntimeOrigin::root(), 50));
+	});
+}
+
+#[test]
+fn set_phantom_bid_window_allows_any_window_when_no_config() {
+	new_test_ext().execute_with(|| {
+		// With no active config there is no interval to violate.
+		assert_ok!(Intents::set_phantom_bid_window(RuntimeOrigin::root(), 1_000_000));
+	});
+}