We want the ability to filter certain accounts from calling extrinsics in the democracy pallet. There are more details but basically we can't do this by reserving token balance or we would do that.

One idea was to create a signed extension where the call fails if the AccountId is one of the restricted accounts, which is possible but seems heavy-handed.

We thought, maybe we could set Origin to use a custom EnsureOrigin implementation for pallet_democracy. Unfortunately it's just an associated type, so we can't change it in the pallet_democracy Config.

What is the best way to do this?

2 Answers 2


I think the best option you have here is using a SignExtension. There, you can filter by who (checking a whitelisted list in storage), for those signed call that match with pallet_democracy::Call::vote, ...

  • Thanks, that was my hunch. I wrote a signed extension for this that works, and a call filter definitely won't work. Sep 9, 2022 at 16:38

One easy way to do this without needing to change the pallet code too much, as you said, is using signed extensions. Here's one that does a similar thing:


As for custom origin, you can also do that, but it would require some changes to the pallet code:

// in `trait Config`
type CustomSignedOrigin: EnsureOrigin<Self::AccountId>;

Then, in all of the calls that you want to be restricted:

// remove this
let who = ensure_signed(origin)?;
// add this: 
let who = T::CustomSignedOrigin::ensure_origin(origin)?;

Finally, in the top level runtime, you want an implementation of EnsureOrigin that acts similar to EnsureSigned but filters out certain accounts.

The main advantage of the second approach is that the overhead will only be felt if the transaction is related to pallet-democracy, whereas in the former approach, the signed extension is checked against all transaction. Although, if you implement it correctly, the first thing that you will do in the signed extension is to check if the transaction's call is from democracy, and if not, you early exist. In my opinion, this is a very negligible overhead.

  • 1
    Why doesn't doesn't every substrate pallet allow you to set a custom origin?
    – Yatusabes
    Sep 9, 2022 at 16:06
  • > Why doesn't every substrate pallet allow you to set a custom origin? I wondered that too. It sure would have made our work easier. Sep 9, 2022 at 16:39
  • What do you exactly mean by custom origin? There is a pallet::origin macro that allows you to define a new origin, but I am not sure if that is what you want. paritytech.github.io/substrate/master/frame_support/…
    – kianenigma
    Sep 10, 2022 at 20:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.