Context
DefaultTransactionExtensions lets callers supply metadata-encoded values for
chain-specific transaction extensions that Subxt has no typed support for, via
DefaultExtrinsicParamsBuilder::custom_extension.
Its is_authorization_extension implementation forwards only to the known typed
extensions:
fn is_authorization_extension(&self, name: &str) -> bool {
frame_decode::extrinsics::TransactionExtensions::is_authorization_extension(
&self.known,
name,
)
}
So a chain-specific extension supplied through custom_extension always reports
false, even if that extension authorizes the transaction.
Why it matters
In V5, frame-decode excludes the value and implicit bytes of the last
authorization extension and of every extension before it from the signer
payload. If a chain declares its own authorization extension and a user supplies
it via custom_extension, Subxt would sign over bytes the runtime excludes,
producing a signer payload the runtime will not agree with.
VerifySignature (VerifyMultiSignature) is currently the only authorization
extension Subxt knows about, so this is latent rather than an active bug, and
custom_extension documents custom authorization extensions as unsupported.
Raised in review of #2273:
#2273 (comment)
Context
DefaultTransactionExtensionslets callers supply metadata-encoded values forchain-specific transaction extensions that Subxt has no typed support for, via
DefaultExtrinsicParamsBuilder::custom_extension.Its
is_authorization_extensionimplementation forwards only to the known typedextensions:
So a chain-specific extension supplied through
custom_extensionalways reportsfalse, even if that extension authorizes the transaction.Why it matters
In V5,
frame-decodeexcludes the value and implicit bytes of the lastauthorization extension and of every extension before it from the signer
payload. If a chain declares its own authorization extension and a user supplies
it via
custom_extension, Subxt would sign over bytes the runtime excludes,producing a signer payload the runtime will not agree with.
VerifySignature(VerifyMultiSignature) is currently the only authorizationextension Subxt knows about, so this is latent rather than an active bug, and
custom_extensiondocuments custom authorization extensions as unsupported.Raised in review of #2273:
#2273 (comment)