What are the attack vectors of leaving out ensured_signed in one of my extrinsic?

It seems that SignedExtensions already checks if the transactions are signed. When I try to submit an unsigned transaction, it automatically fails.

It seems that this is a convention everyone follows when writing extrinsic, but I am not sure why.

2 Answers 2


The problem with allowing unsigned extrinsics is that nobody pays for the consumed weight.
So you are basically doing work for free - normally undesirable.

The only use-case where it is a good idea are cleanup operations which remove storage items.
A smaller state means less PoV of storage READ/REMOVE operations and is therefore desirable.
One could say that storage cleanups have an amortized "negative" weight and should therefore be free.

  • It looks like if we are using a signed extension with the [check_non_zero_sender](github.com/paritytech/substrate/blob/master/frame/system/src/… signed-extension, why do we need to still ensured_signed in an extrinsics?
    – Yatusabes
    Oct 31, 2022 at 16:43
  • check_non_zero_sender just checks that nobody is using the 0x00000… address. That is different from signed/unsigned. You want to use ensured_signed so that someone pays for the extrinsic. Otherwise your chain does work for free by accepting unsigned extrinsics. Oct 31, 2022 at 16:46
  • Can I check ensured_signed in a SignedExtension? Is the following answer correct? substrate.stackexchange.com/questions/5588/…
    – Yatusabes
    Oct 31, 2022 at 16:48

Have you tried submit_unsigned?

I think people could submit unsigned transactions on your chain without paying any fee.

Obviously, this will cause something like DDOS. Use a script to submit the unsigned transactions.

Why do we need unsigned?

  1. Airdrop, like the Polkadot claim module. It's not a good idea to require a user to own some token first and then to claim the airdrop. So they set the claim extrinsic feeless.
  2. For some public-welfare calls, like the sync finality proof in the cross-chain bridge pallet. It's a one-time verification/call, after the first successful call it will reject the others.
  3. Something like @Oliver described.

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .