paritytech/polkadot-sdk polkadot-stable2609-2

Polkadot stable2609-2

on GitHub

This release contains the changes from polkadot-stable2609-1 to polkadot-stable2609-2.

ℹ️ Please note: ⚠️ this is a patch release for the stable version stable2609 and contains only patches and fixes to the crates (list below). No binary or docker images will be provided for this release.

Once published, polkadot-stable2609-2 will also be tagged as polkadot-v1.25.2.
The following crates were updated to the corresponding versions:

📦 The complete changelog with full descriptions is attached to this release as CHANGELOG.md, and in machine-readable form as changelog.json.

💥 Breaking Changes

7 changes are breaking according to Rust SemVer (each bumps the major version of at least one crate). Details in the 💥-marked entries below.

• Smart Contracts (Revive): #13617 [pallet-revive] Bound per-transaction receipt size (pallet-revive)
• Smart Contracts (Revive): #13689 [pallet-revive] align terminate precompile with opcodes (pallet-revive-fixtures)
• Staking & Elections: #13722 EPMB: determine the signed base deposit at registration (pallet-election-provider-multi-block, asset-hub-westend-runtime)
• Governance: #13673 pallet-bounties: Pay out only spendable funds (pallet-bounties)
• Assets: #13256 pallet-psm: reject the None origin as a PSM admin (pallet-psm)
• Assets: #13626 pallet-psm: simplify PSM account handling (pallet-psm)
• Assets: #13742 pallet-nfts, pallet-uniques: enforce full deposit transfer on collection owner change (pallet-nfts, pallet-uniques)

Changelog

XCM

🛠️ Runtime Dev

#13704: More XCM rollback hardening

Adding more hardening to the XCM executor. None of the fixes are vulnerabilities, but could become so later if executor upstream or downstream assumptions change. This PR reduces the number of assumptions by adding defense in depth directly on the executor, and adds documentation and tests for remaining assumptions. Changes:

1. roll back delivery fees of report instructions and failed BuyExecution state
2. Harden BuyExecution by recording the asset to be used for delivery fees only when BuyExecution succeeds.
3. fail ExportMessage when the exporter cannot deliver
4. run the remaining storage-mutating instructions transactionally
5. document the invariants behind register rollback

_{Crates: staging-xcm-executor (patch), pallet-xcm (none)}

#13720: pallet-xcm: improve weigh_message benchmark

Improves the weigh_message benchmark. Adds pallet_xcm::benchmarking::Config::wrap_call, which defaults to batch_call with a single call. You can override it if you have a call that dispatches a single inner call.

_{Crates: pallet-xcm (minor), asset-hub-westend-runtime (patch)}

Smart Contracts (Revive)

🛠️ Runtime Dev

💥 #13617: [pallet-revive] Bound per-transaction receipt size

_{Also for Runtime User}

No storage migration and no configuration change is needed. The new ReceiptLogsCommitted storage value is only written while an Ethereum transaction or its dry run runs and is empty between transactions.

Error has the new variant ReceiptTooLarge (index 0x45). Index 0x44 is left unused so that the indexes match later releases. Code that matches on the error exhaustively needs an arm for it. …

Breaking: pallet-revive
_{Other crates: pallet-revive-fixtures (minor), pallet-revive-uapi (none), pallet-assets-precompiles (patch)}

💥 #13689: [pallet-revive] align terminate precompile with opcodes

This PR aligns the terminate precompile with the opcodes.

• The precompile now pays out the balance immediately and only deletes the contract if this transaction created it, as SELFDESTRUCT does.
• The deposit is no longer refunded when terminate is called.
• TerminateArgs and schedule_termination are gone; the scheduling map just stores the beneficiary.

…

Breaking: pallet-revive-fixtures
_{Other crates: pallet-revive (minor), pallet-revive-uapi (patch), pallet-revive-types (patch)}

#13230: Dust accounting in fungibles transfers and approvals

_{Also for Runtime User}

pallet_assets::prep_debit promotes a debit to the account's whole balance when debiting the requested amount exactly would strand a remainder below the asset's min_balance. Two consumers assumed the debit equalled the amount they asked for, and each lost track of the difference. …

_{Crates: frame-support (patch), pallet-balances (none), pallet-assets (patch), pallet-assets-precompiles (none)}

#13621: pallet-revive: bound storage deposit refunds by the held deposit

_{Also for Runtime User}

A refund for removed contract storage is now bounded by the storage deposit the contract holds above its base deposit. The refund is still computed pro rata from the item and byte deposits recorded in the contract's ContractInfo, but at the end of the call stack at most the contract's StorageDepositReserve hold minus its storage_base_deposit is released. The base deposit stays on hold until the contract is terminated. The bound uses Deposit::total_on_hold, which for PGasDeposit is the sum of the native and PGAS holds. …

_{Crates: pallet-revive (patch), pallet-revive-fixtures (minor)}

#13678: [pallet-revive] PVM performance: early return on mem read

Small optimization: We can return early when the read would fail anyway.

_{Crates: pallet-revive (patch)}

Staking & Elections

🛠️ Runtime Dev

💥 #13722: EPMB: determine the signed base deposit at registration

The base deposit of a signed submission is now charged once, when the submitter calls register, and stored in the submission metadata as base. On every submit_page, the held deposit becomes that base plus the per-page deposit of the stored pages. Previously, every submit_page re-computed the whole deposit from the current queue length, so the held amount depended on registrations made by other accounts after the submitter registered. That re-computation also counted the submitter itself, so a submitter that stored pages held the base one step of DepositBase higher than at registration. The base now stays at the registration price. …

Breaking: pallet-election-provider-multi-block, asset-hub-westend-runtime

#13690: pallet-staking-async: Only move spendable funds out of expired era pots

When an era expires, its reward pot now only sends its spendable balance to UnclaimedRewardHandler. Locked funds stay in the pot.

_{Crates: pallet-staking-async (patch)}

Governance

🛠️ Runtime Dev

💥 #13673: pallet-bounties: Pay out only spendable funds

Bounty and child-bounty payouts now only use funds the account can transfer, and a failed transfer makes the claim fail instead of being ignored.

pallet_bounties::Config now requires the treasury Currency to also implement fungible::Inspect with the same balance type. pallet-balances already does, so runtimes using it need no changes.

Breaking: pallet-bounties
_{Other crates: pallet-child-bounties (minor)}

Assets

🛠️ Runtime Dev

💥 #13256: pallet-psm: reject the None origin as a PSM admin

_{Also for Runtime User}

The None origin is now rejected both when storing an admin, via the new Error::InvalidAdminOrigin, and when checking one in ensure_psm_admin. The latter also covers admin records already in storage.

Previously a PSM admin could be set to the system None origin. The pool rejects unsigned PSM calls, but a block author bypasses the pool, so such a PSM would be managed by whoever authors the block. This is now fixed.

Breaking: pallet-psm

💥 #13626: pallet-psm: simplify PSM account handling

PSMs no longer manage provider refs on their reserve account and fee destination, so both follow the standard account rules.

• create_psm and remove_psm no longer touch provider refs.
• mint and redeem waive the fee when the fee destination can't receive it.
• add_external_asset requires the reserve account to be able to receive the external
  asset, and fails with ReserveCannotReceive otherwise. For a non-sufficient asset, create the reserve's asset account first (e.g. with touch_other).
• New reserve_account view function returns the reserve account of a PSM instance.

Breaking: pallet-psm
_{Other crates: pallet-assets (none), asset-hub-westend-runtime (patch)}

💥 #13742: pallet-nfts, pallet-uniques: enforce full deposit transfer on collection owner change

Aligns pallet-nfts and pallet-uniques with pallet-assets (#12366).

Changing a collection's owner moves its deposit with repatriate_reserved, which is best-effort. Under Polite fortitude, a lock or freeze on the current owner that overlaps their free balance can leave part of the reserved deposit behind. The remainder was discarded, so the collection's recorded deposit could end up out of sync with what is actually reserved on the new owner. …

Breaking: pallet-nfts, pallet-uniques

#13059: Add is_sufficient to the fungibles::Inspect trait

Adds an is_sufficient method to the fungibles::Inspect trait, reporting whether an asset is sufficient. The method has a default implementation returning false, so the change is non-breaking; however, implementations which track sufficiency should override it. It is implemented for pallet-assets (reading the asset's is_sufficient flag, and forwarded by the pallet-assets-freezer and pallet-assets-holder wrappers) and forwarded through fungibles::UnionOf and the right branch of fungible::UnionOf. The left (fungible) branch of fungible::UnionOf reports false, as the fungible trait family carries no sufficiency information.

_{Crates: frame-support (minor), pallet-assets (minor), pallet-assets-freezer (minor), pallet-assets-holder (minor)}

Node

🔧 Node Dev

#13736: Make the collator protocol revamp the default implementation (on Polkadot)

The collator protocol revamp is now the default validator side collator protocol implementation on all chains. Previously it was enabled by default only on Kusama. With this change Polkadot validators will run the revamped protocol.

Pass --experimental-collator-protocol=false to the binary to use the legacy implementation.

_{Crates: polkadot-cli (patch), polkadot-collator-protocol (patch)}

Tooling & Benchmarking

🛠️ Runtime Dev

#13390: benchmarking-cli: drop constant components from per-prefix proof-size analysis

Fixes benchmark pallet --output failing with "Parameter n only has 1 unique value(s)" for benchmarks touching a storage key only at some component values, e.g. a distinct key per item. The per-storage-prefix proof-size analysis now drops components that have a single value across the samples touching that prefix, since they determine no slope. This applies to every --analysis choice. Regenerated weights may change for such keys: under min-squares with three or more samples, the constant component previously produced a spurious slope, and it now contributes a constant.

_{Crates: frame-benchmarking-cli (patch)}

Rust compiler versions

The crates and node binaries in this release were built and tested with the following rustc toolchain; other versions may work.

• Rust Stable: 1.93.0