fix(proxy): some calls should never be authorized from proxy

runtime/g1/src/lib.rs

@@ -159,19 +159,25 @@ impl Contains<Call> for BaseCallFilter {
 )]
 #[allow(clippy::unnecessary_cast)]
 pub enum ProxyType {
-    Any = 0,
+    AlmostAny = 0,
     TransferOnly = 1,
     CancelProxy = 2,
 }
 impl Default for ProxyType {
     fn default() -> Self {
-        Self::Any
+        Self::AlmostAny
     }
 }
 impl frame_support::traits::InstanceFilter<Call> for ProxyType {
     fn filter(&self, c: &Call) -> bool {
         match self {
-            ProxyType::Any => true,
+            ProxyType::AlmostAny => {
+                // Some calls are never authorized from a proxied account
+                !matches!(
+                    c,
+                    Call::Cert(..) | Call::Identity(..) | Call::SmithsCert(..)
+                )
+            }
             ProxyType::TransferOnly => {
                 matches!(c, Call::Balances(..) | Call::UniversalDividend(..))
             }

runtime/gdev/src/lib.rs

@@ -181,20 +181,26 @@ impl Contains<Call> for BaseCallFilter {
 )]
 #[allow(clippy::unnecessary_cast)]
 pub enum ProxyType {
-    Any = 0,
+    AlmostAny = 0,
     TransferOnly = 1,
     CancelProxy = 2,
     SmithsCollectivePropose = 3,
 }
 impl Default for ProxyType {
     fn default() -> Self {
-        Self::Any
+        Self::AlmostAny
     }
 }
 impl frame_support::traits::InstanceFilter<Call> for ProxyType {
     fn filter(&self, c: &Call) -> bool {
         match self {
-            ProxyType::Any => true,
+            ProxyType::AlmostAny => {
+                // Some calls are never authorized from a proxied account
+                !matches!(
+                    c,
+                    Call::Cert(..) | Call::Identity(..) | Call::SmithsCert(..)
+                )
+            }
             ProxyType::TransferOnly => {
                 matches!(c, Call::Balances(..) | Call::UniversalDividend(..))
             }

runtime/gdev/tests/integration_tests.rs

@@ -71,7 +71,7 @@ fn verify_pallet_indices() {
 
 #[test]
 fn verify_proxy_type_indices() {
-    assert_eq!(ProxyType::Any as u8, 0);
+    assert_eq!(ProxyType::AlmostAny as u8, 0);
 }
 
 #[test]

runtime/gtest/src/lib.rs

@@ -160,19 +160,25 @@ impl Contains<Call> for BaseCallFilter {
 )]
 #[allow(clippy::unnecessary_cast)]
 pub enum ProxyType {
-    Any = 0,
+    AlmostAny = 0,
     TransferOnly = 1,
     CancelProxy = 2,
 }
 impl Default for ProxyType {
     fn default() -> Self {
-        Self::Any
+        Self::AlmostAny
     }
 }
 impl frame_support::traits::InstanceFilter<Call> for ProxyType {
     fn filter(&self, c: &Call) -> bool {
         match self {
-            ProxyType::Any => true,
+            ProxyType::AlmostAny => {
+                // Some calls are never authorized from a proxied account
+                !matches!(
+                    c,
+                    Call::Cert(..) | Call::Identity(..) | Call::SmithsCert(..)
+                )
+            }
             ProxyType::TransferOnly => {
                 matches!(c, Call::Balances(..) | Call::UniversalDividend(..))
             }