Restrict remove_proxies to only default (most permissive) values

frame/proxy/src/lib.rs

@@ -68,6 +68,8 @@ pub trait Trait: frame_system::Trait {
 
 	/// A kind of proxy; specified with the proxy and passed in to the `IsProxyable` fitler.
 	/// The instance filter determines whether a given call may be proxied under this type.
+	///
+	/// IMPORTANT: `Default` must be provided and MUST BE the the *most permissive* value.
 	type ProxyType: Parameter + Member + Ord + PartialOrd + InstanceFilter<<Self as Trait>::Call>
 		+ Default;
 
@@ -174,6 +176,8 @@ decl_module! {
 				match c.is_sub_type() {
 					Some(Call::add_proxy(_, ref pt)) | Some(Call::remove_proxy(_, ref pt))
 						if !proxy_type.is_superset(&pt) => false,
+					Some(Call::remove_proxies(..)) | Some(Call::kill_anonymous(..))
+					    if proxy_type != T::ProxyType::default() => false,
 					_ => proxy_type.filter(c)
 				}
 			});

frame/proxy/src/tests.rs

@@ -154,6 +154,7 @@ type Proxy = Module<Test>;
 use frame_system::Call as SystemCall;
 use pallet_balances::Call as BalancesCall;
 use pallet_balances::Error as BalancesError;
+use pallet_balances::Event as BalancesEvent;
 use pallet_utility::Call as UtilityCall;
 use pallet_utility::Event as UtilityEvent;
 use super::Call as ProxyCall;
@@ -242,6 +243,14 @@ fn filtering_works() {
 			UtilityEvent::BatchInterrupted(0, DispatchError::BadOrigin).into(),
 			RawEvent::ProxyExecuted(Ok(())).into(),
 		]);
+
+		let call = Box::new(Call::Proxy(ProxyCall::remove_proxies()));
+		assert_ok!(Proxy::proxy(Origin::signed(3), 1, None, call.clone()));
+		expect_event(RawEvent::ProxyExecuted(Err(DispatchError::BadOrigin)));
+		assert_ok!(Proxy::proxy(Origin::signed(4), 1, None, call.clone()));
+		expect_event(RawEvent::ProxyExecuted(Err(DispatchError::BadOrigin)));
+		assert_ok!(Proxy::proxy(Origin::signed(2), 1, None, call.clone()));
+		expect_events(vec![BalancesEvent::<Test>::Unreserved(1, 5).into(), RawEvent::ProxyExecuted(Ok(())).into()]);
 	});
 }