From 2c85a1aabff34fda1aeb8bed1a48c020c538b70a Mon Sep 17 00:00:00 2001
From: Gav Wood <gavin@parity.io>
Date: Wed, 17 Jun 2020 17:47:03 +0200
Subject: [PATCH] Restrict remove_proxies

---
 frame/proxy/src/lib.rs   | 4 ++++
 frame/proxy/src/tests.rs | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/frame/proxy/src/lib.rs b/frame/proxy/src/lib.rs
index 14c7ced151758..66e3e760389e1 100644
--- a/frame/proxy/src/lib.rs
+++ b/frame/proxy/src/lib.rs
@@ -68,6 +68,8 @@ pub trait Trait: frame_system::Trait {
 
 	/// A kind of proxy; specified with the proxy and passed in to the `IsProxyable` fitler.
 	/// The instance filter determines whether a given call may be proxied under this type.
+	///
+	/// IMPORTANT: `Default` must be provided and MUST BE the the *most permissive* value.
 	type ProxyType: Parameter + Member + Ord + PartialOrd + InstanceFilter<<Self as Trait>::Call>
 		+ Default;
 
@@ -174,6 +176,8 @@ decl_module! {
 				match c.is_sub_type() {
 					Some(Call::add_proxy(_, ref pt)) | Some(Call::remove_proxy(_, ref pt))
 						if !proxy_type.is_superset(&pt) => false,
+					Some(Call::remove_proxies(..)) | Some(Call::kill_anonymous(..))
+					    if proxy_type != T::ProxyType::default() => false,
 					_ => proxy_type.filter(c)
 				}
 			});
diff --git a/frame/proxy/src/tests.rs b/frame/proxy/src/tests.rs
index be99e9424a62b..72c9c0d577c2a 100644
--- a/frame/proxy/src/tests.rs
+++ b/frame/proxy/src/tests.rs
@@ -154,6 +154,7 @@ type Proxy = Module<Test>;
 use frame_system::Call as SystemCall;
 use pallet_balances::Call as BalancesCall;
 use pallet_balances::Error as BalancesError;
+use pallet_balances::Event as BalancesEvent;
 use pallet_utility::Call as UtilityCall;
 use pallet_utility::Event as UtilityEvent;
 use super::Call as ProxyCall;
@@ -242,6 +243,14 @@ fn filtering_works() {
 			UtilityEvent::BatchInterrupted(0, DispatchError::BadOrigin).into(),
 			RawEvent::ProxyExecuted(Ok(())).into(),
 		]);
+
+		let call = Box::new(Call::Proxy(ProxyCall::remove_proxies()));
+		assert_ok!(Proxy::proxy(Origin::signed(3), 1, None, call.clone()));
+		expect_event(RawEvent::ProxyExecuted(Err(DispatchError::BadOrigin)));
+		assert_ok!(Proxy::proxy(Origin::signed(4), 1, None, call.clone()));
+		expect_event(RawEvent::ProxyExecuted(Err(DispatchError::BadOrigin)));
+		assert_ok!(Proxy::proxy(Origin::signed(2), 1, None, call.clone()));
+		expect_events(vec![BalancesEvent::<Test>::Unreserved(1, 5).into(), RawEvent::ProxyExecuted(Ok(())).into()]);
 	});
 }