From c9d8d592dc6a77f11b5c70562423cba94837c574 Mon Sep 17 00:00:00 2001
From: Loris Moulin <contact@lorismoulin.com>
Date: Thu, 16 Oct 2025 10:23:15 -0300
Subject: [PATCH 1/3] only allow refund for crowdloan creator

---
 pallets/crowdloan/src/lib.rs   |  5 +++-
 pallets/crowdloan/src/tests.rs | 51 ++++++++++++++++++++++++++--------
 2 files changed, 43 insertions(+), 13 deletions(-)

diff --git a/pallets/crowdloan/src/lib.rs b/pallets/crowdloan/src/lib.rs
index 52ea3bd166..e186766d01 100644
--- a/pallets/crowdloan/src/lib.rs
+++ b/pallets/crowdloan/src/lib.rs
@@ -638,13 +638,16 @@ pub mod pallet {
             origin: OriginFor<T>,
             #[pallet::compact] crowdloan_id: CrowdloanId,
         ) -> DispatchResultWithPostInfo {
-            ensure_signed(origin)?;
+            let who = ensure_signed(origin)?;
 
             let mut crowdloan = Self::ensure_crowdloan_exists(crowdloan_id)?;
 
             // Ensure the crowdloan is not finalized
             ensure!(!crowdloan.finalized, Error::<T>::AlreadyFinalized);
 
+            // Only the creator can dissolve the crowdloan
+            ensure!(who == crowdloan.creator, Error::<T>::InvalidOrigin);
+
             let mut refunded_contributors: Vec<T::AccountId> = vec![];
             let mut refund_count = 0;
 
diff --git a/pallets/crowdloan/src/tests.rs b/pallets/crowdloan/src/tests.rs
index bbc2c64795..67d097e1e1 100644
--- a/pallets/crowdloan/src/tests.rs
+++ b/pallets/crowdloan/src/tests.rs
@@ -1618,20 +1618,47 @@ fn test_refund_succeeds() {
 }
 
 #[test]
-fn test_refund_fails_if_bad_origin() {
-    TestState::default().build_and_execute(|| {
-        let crowdloan_id: CrowdloanId = 0;
+fn test_refund_fails_if_bad_or_invalid_origin() {
+    TestState::default()
+        .with_balance(U256::from(1), 100)
+        .build_and_execute(|| {
+            // create a crowdloan
+            let crowdloan_id: CrowdloanId = 0;
+            let creator: AccountOf<Test> = U256::from(1);
+            let initial_deposit: BalanceOf<Test> = 50;
+            let min_contribution: BalanceOf<Test> = 10;
+            let cap: BalanceOf<Test> = 300;
+            let end: BlockNumberFor<Test> = 50;
+            assert_ok!(Crowdloan::create(
+                RuntimeOrigin::signed(creator),
+                initial_deposit,
+                min_contribution,
+                cap,
+                end,
+                Some(noop_call()),
+                None,
+            ));
 
-        assert_err!(
-            Crowdloan::refund(RuntimeOrigin::none(), crowdloan_id),
-            DispatchError::BadOrigin
-        );
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::none(), crowdloan_id),
+                DispatchError::BadOrigin
+            );
 
-        assert_err!(
-            Crowdloan::refund(RuntimeOrigin::root(), crowdloan_id),
-            DispatchError::BadOrigin
-        );
-    });
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::root(), crowdloan_id),
+                DispatchError::BadOrigin
+            );
+
+            // run some blocks
+            run_to_block(60);
+
+            // try to refund
+            let unknown_contributor: AccountOf<Test> = U256::from(2);
+            assert_err!(
+                Crowdloan::refund(RuntimeOrigin::signed(unknown_contributor), crowdloan_id),
+                pallet_crowdloan::Error::<Test>::InvalidOrigin,
+            );
+        });
 }
 
 #[test]

From 2652464a86832ab4c59292e56d02055647444f52 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 16:10:04 +0000
Subject: [PATCH 2/3] auto-update benchmark weights

---
 pallets/admin-utils/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pallets/admin-utils/src/lib.rs b/pallets/admin-utils/src/lib.rs
index 66e7eab318..905735a223 100644
--- a/pallets/admin-utils/src/lib.rs
+++ b/pallets/admin-utils/src/lib.rs
@@ -1252,7 +1252,7 @@ pub mod pallet {
         /// The extrinsic will call the Subtensor pallet to set the minimum delegate take.
         #[pallet::call_index(46)]
         #[pallet::weight((
-            Weight::from_parts(5_000_000, 0).saturating_add(T::DbWeight::get().writes(1_u64)),
+            Weight::from_parts(7_885_000, 0).saturating_add(T::DbWeight::get().writes(1_u64)),
             DispatchClass::Operational,
             Pays::Yes
         ))]
@@ -1999,7 +1999,7 @@ pub mod pallet {
         /// Only callable by root.
         #[pallet::call_index(74)]
         #[pallet::weight((
-			Weight::from_parts(5_771_000, 0)
+			Weight::from_parts(9_418_000, 0)
 				.saturating_add(<T as frame_system::Config>::DbWeight::get().reads(0_u64))
 				.saturating_add(<T as frame_system::Config>::DbWeight::get().writes(1_u64)),
 			DispatchClass::Operational

From 919121b5f3c448b0d4df9417dc14256d5f076cc0 Mon Sep 17 00:00:00 2001
From: Loris Moulin <contact@lorismoulin.com>
Date: Thu, 16 Oct 2025 14:01:06 -0300
Subject: [PATCH 3/3] fix comment

---
 pallets/crowdloan/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pallets/crowdloan/src/lib.rs b/pallets/crowdloan/src/lib.rs
index e186766d01..82b1402bc6 100644
--- a/pallets/crowdloan/src/lib.rs
+++ b/pallets/crowdloan/src/lib.rs
@@ -645,7 +645,7 @@ pub mod pallet {
             // Ensure the crowdloan is not finalized
             ensure!(!crowdloan.finalized, Error::<T>::AlreadyFinalized);
 
-            // Only the creator can dissolve the crowdloan
+            // Only the creator can refund the crowdloan
             ensure!(who == crowdloan.creator, Error::<T>::InvalidOrigin);
 
             let mut refunded_contributors: Vec<T::AccountId> = vec![];