[Snowbridge]: Ensure source always from AH for exported message

bridges/snowbridge/primitives/router/Cargo.toml

@@ -23,6 +23,7 @@ sp-runtime = { workspace = true }
 sp-std = { workspace = true }
 
 xcm = { workspace = true }
+xcm-builder = { workspace = true }
 xcm-executor = { workspace = true }
 
 snowbridge-core = { workspace = true }
@@ -43,13 +44,15 @@ std = [
 	"sp-io/std",
 	"sp-runtime/std",
 	"sp-std/std",
+	"xcm-builder/std",
 	"xcm-executor/std",
 	"xcm/std",
 ]
 runtime-benchmarks = [
 	"frame-support/runtime-benchmarks",
 	"snowbridge-core/runtime-benchmarks",
 	"sp-runtime/runtime-benchmarks",
+	"xcm-builder/runtime-benchmarks",
 	"xcm-executor/runtime-benchmarks",
 	"xcm/runtime-benchmarks",
 ]

bridges/snowbridge/primitives/router/src/outbound/barriers.rs

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023 Snowfork <[email protected]>
+
+use core::{marker::PhantomData, ops::ControlFlow};
+use frame_support::traits::{Contains, ProcessMessageError};
+use xcm::prelude::{ExportMessage, Instruction, Location, NetworkId, Weight};
+use xcm_builder::{CreateMatcher, MatchXcm};
+use xcm_executor::traits::{Properties, ShouldExecute};
+
+pub struct DenyFirstExportMessageFrom<FromOrigin, ToGlobalConsensus>(
+	PhantomData<(FromOrigin, ToGlobalConsensus)>,
+);
+
+impl<FromOrigin, ToGlobalConsensus> ShouldExecute
+	for DenyFirstExportMessageFrom<FromOrigin, ToGlobalConsensus>
+where
+	FromOrigin: Contains<Location>,
+	ToGlobalConsensus: Contains<NetworkId>,
+{
+	fn should_execute<RuntimeCall>(
+		origin: &Location,
+		message: &mut [Instruction<RuntimeCall>],
+		_max_weight: Weight,
+		_properties: &mut Properties,
+	) -> Result<(), ProcessMessageError> {
+		message.matcher().match_next_inst_while(
+			|_| true,
+			|inst| match inst {
+				ExportMessage { network, .. } =>
+					if ToGlobalConsensus::contains(network) && FromOrigin::contains(origin) {
+						return Err(ProcessMessageError::Unsupported)
+					} else {
+						Ok(ControlFlow::Continue(()))
+					},
+				_ => Ok(ControlFlow::Continue(())),
+			},
+		)?;
+		Ok(())
+	}
+}
+
+#[cfg(test)]
+mod tests {
+	use super::*;
+	use frame_support::{
+		assert_err, parameter_types,
+		traits::{Equals, Everything, EverythingBut},
+	};
+	use xcm::prelude::*;
+
+	parameter_types! {
+		pub AssetHubLocation: Location = Location::new(1, Parachain(1000));
+		pub EthereumNetwork: NetworkId = Ethereum { chain_id: 1 };
+	}
+
+	#[test]
+	fn deny_export_message_from_source_other_than_asset_hub() {
+		let mut xcm: Vec<Instruction<()>> = vec![ExportMessage {
+			network: EthereumNetwork::get(),
+			destination: Here,
+			xcm: Default::default(),
+		}];
+
+		let result = DenyFirstExportMessageFrom::<
+			EverythingBut<Equals<AssetHubLocation>>,
+			Everything,
+		>::should_execute(
+			&Location::parent(),
+			&mut xcm,
+			Weight::zero(),
+			&mut Properties { weight_credit: Weight::zero(), message_id: None },
+		);
+		assert_err!(result, ProcessMessageError::Unsupported);
+	}
+
+	#[test]
+	fn allow_export_message_from_asset_hub() {
+		let mut xcm: Vec<Instruction<()>> = vec![ExportMessage {
+			network: EthereumNetwork::get(),
+			destination: Here,
+			xcm: Default::default(),
+		}];
+
+		let result = DenyFirstExportMessageFrom::<
+			EverythingBut<Equals<AssetHubLocation>>,
+			Everything,
+		>::should_execute(
+			&AssetHubLocation::get(),
+			&mut xcm,
+			Weight::zero(),
+			&mut Properties { weight_credit: Weight::zero(), message_id: None },
+		);
+		assert!(result.is_ok());
+	}
+
+	#[test]
+	fn allow_xcm_without_export_message() {
+		let mut xcm: Vec<Instruction<()>> = vec![ClearOrigin];
+
+		let result = DenyFirstExportMessageFrom::<Everything, Everything>::should_execute(
+			&Location::parent(),
+			&mut xcm,
+			Weight::zero(),
+			&mut Properties { weight_credit: Weight::zero(), message_id: None },
+		);
+		assert!(result.is_ok());
+	}
+}

bridges/snowbridge/primitives/router/src/outbound/mod.rs

@@ -20,6 +20,8 @@ use sp_std::{iter::Peekable, marker::PhantomData, prelude::*};
 use xcm::prelude::*;
 use xcm_executor::traits::{ConvertLocation, ExportXcm};
 
+pub mod barriers;
+
 pub struct EthereumBlobExporter<
 	UniversalLocation,
 	EthereumNetwork,

bridges/snowbridge/runtime/test-common/src/lib.rs

@@ -623,3 +623,56 @@ pub fn ethereum_to_polkadot_message_extrinsics_work<Runtime>(
 			assert_ok!(sync_committee_outcome);
 		});
 }
+
+#[allow(clippy::too_many_arguments)]
+pub fn send_transfer_token_message_from_source_other_than_asset_hub_failure<Runtime, XcmConfig>(
+	ethereum_chain_id: u64,
+	collator_session_key: CollatorSessionKeys<Runtime>,
+	runtime_para_id: u32,
+	assethub_parachain_id: u32,
+	another_parachain_id: u32,
+	initial_amount: u128,
+	weth_contract_address: H160,
+	destination_address: H160,
+	fee_amount: u128,
+	expected_error: XcmError,
+) where
+	Runtime: frame_system::Config
+		+ pallet_balances::Config
+		+ pallet_session::Config
+		+ pallet_xcm::Config
+		+ parachain_info::Config
+		+ pallet_collator_selection::Config
+		+ cumulus_pallet_parachain_system::Config
+		+ snowbridge_pallet_outbound_queue::Config
+		+ snowbridge_pallet_system::Config
+		+ pallet_timestamp::Config,
+	XcmConfig: xcm_executor::Config,
+	ValidatorIdOf<Runtime>: From<AccountIdOf<Runtime>>,
+{
+	ExtBuilder::<Runtime>::default()
+		.with_collators(collator_session_key.collators())
+		.with_session_keys(collator_session_key.session_keys())
+		.with_para_id(runtime_para_id.into())
+		.with_tracing()
+		.build()
+		.execute_with(|| {
+			<snowbridge_pallet_system::Pallet<Runtime>>::initialize(
+				runtime_para_id.into(),
+				assethub_parachain_id.into(),
+			)
+			.unwrap();
+
+			// fund asset hub sovereign account enough so it can pay fees
+			initial_fund::<Runtime>(assethub_parachain_id, initial_amount);
+
+			let outcome = send_transfer_token_message::<Runtime, XcmConfig>(
+				ethereum_chain_id,
+				another_parachain_id,
+				weth_contract_address,
+				destination_address,
+				fee_amount,
+			);
+			assert_err!(outcome.ensure_complete(), expected_error);
+		});
+}

cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/mod.rs

@@ -20,6 +20,7 @@ mod claim_assets;
 mod register_bridged_assets;
 mod send_xcm;
 mod snowbridge;
+mod snowbridge_edge_case;
 mod teleport;
 mod transact;
 

cumulus/parachains/integration-tests/emulated/tests/bridges/bridge-hub-westend/src/tests/snowbridge.rs

@@ -31,7 +31,7 @@ use xcm_executor::traits::ConvertLocation;
 const INITIAL_FUND: u128 = 5_000_000_000_000;
 pub const CHAIN_ID: u64 = 11155111;
 pub const WETH: [u8; 20] = hex!("87d1f7fdfEe7f651FaBc8bFCB6E086C278b77A7d");
-const ETHEREUM_DESTINATION_ADDRESS: [u8; 20] = hex!("44a57ee2f2FCcb85FDa2B0B18EBD0D8D2333700e");
+pub const ETHEREUM_DESTINATION_ADDRESS: [u8; 20] = hex!("44a57ee2f2FCcb85FDa2B0B18EBD0D8D2333700e");
 const XCM_FEE: u128 = 100_000_000_000;
 const TOKEN_AMOUNT: u128 = 100_000_000_000;