I am trying to understand how to develop an attack vector for when the pre-dispatch function leaves out the same checks in the validate function.

Can you please help me understand what the attack vector looks like?

  • 1
    To add to this question, in trying to understand what predispatch (by calling validate) is meant to do, we took a signed extension and set pre_dispatch to return always Ok(Default::default()), then submitted a transaction that we knew would fail and there did not seem to be a difference of behavior. Commented Oct 29, 2022 at 0:30

1 Answer 1


The reason why you need the same logic for checking the validity in both is that a node is not required to call validate_transaction. This function (which is called here) is only an optimization for the node to reject transactions early and to clean up the tx pool. The runtime itself needs to ensure that when a transaction is applied to the state, that the transaction is valid. This means that the signature is correct, that the nonce = current_nonce + 1 etc. All these checks are there to ensure that transactions are valid and the runtime can only trust "itself".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.