From 3609ad7a128a1e8fdfe55ed32966a44d2d3067d8 Mon Sep 17 00:00:00 2001
From: John Reed <87283488+JohnReedV@users.noreply.github.com>
Date: Mon, 8 Dec 2025 10:13:35 -0800
Subject: [PATCH 1/2] add transaction extension

---
 pallets/shield/src/lib.rs | 105 +++++++++++++++++++++++++++++++++++---
 1 file changed, 98 insertions(+), 7 deletions(-)

diff --git a/pallets/shield/src/lib.rs b/pallets/shield/src/lib.rs
index 7f6c7ba75e..22cf3240a1 100644
--- a/pallets/shield/src/lib.rs
+++ b/pallets/shield/src/lib.rs
@@ -16,20 +16,22 @@ pub mod pallet {
     use super::*;
     use codec::Encode;
     use frame_support::{
-        dispatch::{GetDispatchInfo, PostDispatchInfo},
+        dispatch::{DispatchInfo, GetDispatchInfo, PostDispatchInfo},
         pallet_prelude::*,
         traits::ConstU32,
+        traits::IsSubType,
         weights::Weight,
     };
     use frame_system::pallet_prelude::*;
     use sp_consensus_aura::sr25519::AuthorityId as AuraAuthorityId;
     use sp_core::ByteArray;
-    use sp_runtime::transaction_validity::{
-        InvalidTransaction, TransactionSource, ValidTransaction,
-    };
     use sp_runtime::{
         AccountId32, DispatchErrorWithPostInfo, RuntimeDebug, Saturating,
-        traits::{BadOrigin, Hash},
+        traits::{
+            BadOrigin, DispatchInfoOf, DispatchOriginOf, Dispatchable, Hash, Implication,
+            TransactionExtension,
+        },
+        transaction_validity::{InvalidTransaction, TransactionSource, ValidTransaction},
     };
     use sp_std::{marker::PhantomData, prelude::*};
     use subtensor_macros::freeze_struct;
@@ -279,8 +281,8 @@ pub mod pallet {
         /// Client‑side:
         ///
         ///   1. Read `NextKey` (ML‑KEM public key bytes) from storage.
-		///   2. Sign your extrinsic so that it can be executed when added to the pool,
-		///        i.e. you may need to increment the nonce if you submit using the same account.
+        ///   2. Sign your extrinsic so that it can be executed when added to the pool,
+        ///        i.e. you may need to increment the nonce if you submit using the same account.
         ///   3. `commitment = Hashing::hash(signed_extrinsic)`.
         ///   4. Encrypt:
         ///
@@ -382,4 +384,93 @@ pub mod pallet {
             }
         }
     }
+
+    #[freeze_struct("51f74eb54f5ab1fe")]
+    #[derive(Default, Encode, Decode, DecodeWithMemTracking, Clone, Eq, PartialEq, TypeInfo)]
+    pub struct MevShieldDecryptionFilter<T: Config + Send + Sync + TypeInfo>(pub PhantomData<T>);
+
+    impl<T: Config + Send + Sync + TypeInfo> sp_std::fmt::Debug for MevShieldDecryptionFilter<T> {
+        fn fmt(&self, f: &mut sp_std::fmt::Formatter) -> sp_std::fmt::Result {
+            write!(f, "MevShieldDecryptionFilter")
+        }
+    }
+
+    impl<T: Config + Send + Sync + TypeInfo> MevShieldDecryptionFilter<T> {
+        pub fn new() -> Self {
+            Self(PhantomData)
+        }
+
+        #[inline]
+        fn mev_failed_priority() -> TransactionPriority {
+            1u64
+        }
+    }
+
+    impl<T: Config + Send + Sync + TypeInfo> TransactionExtension<RuntimeCallFor<T>>
+        for MevShieldDecryptionFilter<T>
+    where
+        <T as frame_system::Config>::RuntimeCall:
+            Dispatchable<Info = DispatchInfo, PostInfo = PostDispatchInfo>,
+        <T as frame_system::Config>::RuntimeCall: IsSubType<Call<T>>,
+    {
+        const IDENTIFIER: &'static str = "MevShieldDecryptionFilter";
+
+        type Implicit = ();
+        type Val = ();
+        type Pre = ();
+
+        fn weight(&self, _call: &RuntimeCallFor<T>) -> Weight {
+            // Only does light pattern matching; treat as free.
+            Weight::zero()
+        }
+
+        fn validate(
+            &self,
+            origin: DispatchOriginOf<RuntimeCallFor<T>>,
+            call: &RuntimeCallFor<T>,
+            _info: &DispatchInfoOf<RuntimeCallFor<T>>,
+            _len: usize,
+            _self_implicit: Self::Implicit,
+            _inherited_implication: &impl Implication,
+            source: TransactionSource,
+        ) -> ValidateResult<Self::Val, RuntimeCallFor<T>> {
+            match call.is_sub_type() {
+                Some(Call::mark_decryption_failed { id, .. }) => {
+                    match source {
+                        TransactionSource::Local | TransactionSource::InBlock => {
+                            let validity_res =
+                                ValidTransaction::with_tag_prefix("mev-shield-failed")
+                                    .priority(Self::mev_failed_priority())
+                                    .longevity(64)
+                                    .and_provides(id)
+                                    .propagate(false)
+                                    .build();
+
+                            match validity_res {
+                                Ok(validity) => Ok((validity, (), origin)),
+                                Err(e) => Err(e),
+                            }
+                        }
+
+                        // Anything coming from the outside world (including *signed*
+                        // transactions) is rejected at the pool boundary.
+                        _ => Err(InvalidTransaction::Call.into()),
+                    }
+                }
+
+                _ => Ok((Default::default(), (), origin)),
+            }
+        }
+
+        fn prepare(
+            self,
+            _val: Self::Val,
+            _origin: &DispatchOriginOf<RuntimeCallFor<T>>,
+            _call: &RuntimeCallFor<T>,
+            _info: &DispatchInfoOf<RuntimeCallFor<T>>,
+            _len: usize,
+        ) -> Result<Self::Pre, TransactionValidityError> {
+            Ok(())
+        }
+    }
 }

From ef01a9352417ad4b164f52c814b9cf868c190544 Mon Sep 17 00:00:00 2001
From: John Reed <87283488+JohnReedV@users.noreply.github.com>
Date: Mon, 8 Dec 2025 11:11:51 -0800
Subject: [PATCH 2/2] bump spec

---
 runtime/src/lib.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/runtime/src/lib.rs b/runtime/src/lib.rs
index 340361cf05..9d502c925d 100644
--- a/runtime/src/lib.rs
+++ b/runtime/src/lib.rs
@@ -237,7 +237,7 @@ pub const VERSION: RuntimeVersion = RuntimeVersion {
     //   `spec_version`, and `authoring_version` are the same between Wasm and native.
     // This value is set to 100 to notify Polkadot-JS App (https://polkadot.js.org/apps) to use
     //   the compatible custom types.
-    spec_version: 359,
+    spec_version: 360,
     impl_version: 1,
     apis: RUNTIME_API_VERSIONS,
     transaction_version: 1,