// This file is part of Substrate.

// Copyright (C) Parity Technologies (UK) Ltd.
// SPDX-License-Identifier: Apache-2.0

// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// 	http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//! # Multisig pallet
//! A pallet for doing multisig dispatch.
//!
//! - [`Config`]
//! - [`Call`]
//!
//! ## Overview
//!
//! This pallet contains functionality for multi-signature dispatch, a (potentially) stateful
//! operation, allowing multiple signed
//! origins (accounts) to coordinate and dispatch a call from a well-known origin, derivable
//! deterministically from the set of account IDs and the threshold number of accounts from the
//! set that must approve it. In the case that the threshold is just one then this is a stateless
//! operation. This is useful for multisig wallets where cryptographic threshold signatures are
//! not available or desired.
//!
//! ## Interface
//!
//! ### Dispatchable Functions
//!
//! * `as_multi` - Approve and if possible dispatch a call from a composite origin formed from a
//!   number of signed origins.
//! * `approve_as_multi` - Approve a call from a composite origin.
//! * `cancel_as_multi` - Cancel a call from a composite origin.

// Ensure we're `no_std` when compiling for Wasm.
#![cfg_attr(not(feature = "std"), no_std)]

mod benchmarking;
pub mod migrations;
#[cfg(test)]
mod safe_tests;
mod tests;
pub mod weights;

extern crate alloc;
use alloc::{boxed::Box, vec, vec::Vec};
use frame::{
    prelude::*,
    traits::{Currency, ReservableCurrency},
};
use frame_system::RawOrigin;
pub use weights::WeightInfo;

/// Re-export all pallet items.
pub use pallet::*;

/// The log target of this pallet.
pub const LOG_TARGET: &str = "runtime::multisig";

// syntactic sugar for logging.
#[macro_export]
macro_rules! log {
	($level:tt, $patter:expr $(, $values:expr)* $(,)?) => {
		log::$level!(
			target: $crate::LOG_TARGET,
			concat!("[{:?}] ✍️ ", $patter), <frame_system::Pallet<T>>::block_number() $(, $values)*
		)
	};
}

pub type BalanceOf<T> =
    <<T as Config>::Currency as Currency<<T as frame_system::Config>::AccountId>>::Balance;

pub type BlockNumberFor<T> =
    <<T as Config>::BlockNumberProvider as BlockNumberProvider>::BlockNumber;

/// A global extrinsic index, formed as the extrinsic index within a block, together with that
/// block's height. This allows a transaction in which a multisig operation of a particular
/// composite was created to be uniquely identified.
#[derive(
    Copy,
    Clone,
    Eq,
    PartialEq,
    Encode,
    Decode,
    DecodeWithMemTracking,
    Default,
    RuntimeDebug,
    TypeInfo,
    MaxEncodedLen,
)]
pub struct Timepoint<BlockNumber> {
    /// The height of the chain at the point in time.
    pub height: BlockNumber,
    /// The index of the extrinsic at the point in time.
    pub index: u32,
}

/// An open multisig operation.
#[derive(Clone, Eq, PartialEq, Encode, Decode, Default, RuntimeDebug, TypeInfo, MaxEncodedLen)]
#[scale_info(skip_type_params(MaxApprovals))]
pub struct Multisig<BlockNumber, Balance, AccountId, MaxApprovals>
where
    MaxApprovals: Get<u32>,
{
    /// The extrinsic when the multisig operation was opened.
    pub when: Timepoint<BlockNumber>,
    /// The amount held in reserve of the `depositor`, to be returned once the operation ends.
    pub deposit: Balance,
    /// The account who opened it (i.e. the first to approve it).
    pub depositor: AccountId,
    /// The approvals achieved so far, including the depositor. Always sorted.
    pub approvals: BoundedVec<AccountId, MaxApprovals>,
}

type CallHash = [u8; 32];

enum CallOrHash<T: Config> {
    Call(<T as Config>::RuntimeCall),
    Hash([u8; 32]),
}

// FRAME-generated storage metadata retains upstream expect calls.
#[allow(clippy::expect_used)]
#[frame::pallet]
pub mod pallet {
    use super::*;

    #[pallet::config]
    pub trait Config: frame_system::Config {
        /// The overarching event type.
        #[allow(deprecated)]
        type RuntimeEvent: From<Event<Self>> + IsType<<Self as frame_system::Config>::RuntimeEvent>;

        /// The overarching call type.
        type RuntimeCall: Parameter
            + Dispatchable<RuntimeOrigin = Self::RuntimeOrigin, PostInfo = PostDispatchInfo>
            + GetDispatchInfo
            + From<frame_system::Call<Self>>;

        /// The currency mechanism.
        type Currency: ReservableCurrency<Self::AccountId>;

        /// The base amount of currency needed to reserve for creating a multisig execution or to
        /// store a dispatch call for later.
        ///
        /// This is held for an additional storage item whose value size is
        /// `4 + sizeof((BlockNumber, Balance, AccountId))` bytes and whose key size is
        /// `32 + sizeof(AccountId)` bytes.
        #[pallet::constant]
        type DepositBase: Get<BalanceOf<Self>>;

        /// The amount of currency needed per unit threshold when creating a multisig execution.
        ///
        /// This is held for adding 32 bytes more into a pre-existing storage value.
        #[pallet::constant]
        type DepositFactor: Get<BalanceOf<Self>>;

        /// The maximum amount of signatories allowed in the multisig.
        #[pallet::constant]
        type MaxSignatories: Get<u32>;

        /// Weight information for extrinsics in this pallet.
        type WeightInfo: weights::WeightInfo;

        /// Additional worst-case cost of bounded safe derivation. Use Weight::MAX
        /// until reference measurements establish this bound.
        type SafeDerivationWeight: Get<Weight>;

        /// Query the current block number.
        ///
        /// Must return monotonically increasing values when called from consecutive blocks.
        /// Can be configured to return either:
        /// - the local block number of the runtime via `frame_system::Pallet`
        /// - a remote block number, eg from the relay chain through `RelaychainDataProvider`
        /// - an arbitrary value through a custom implementation of the trait
        ///
        /// There is currently no migration provided to "hot-swap" block number providers and it may
        /// result in undefined behavior when doing so. Parachains are therefore best off setting
        /// this to their local block number provider if they have the pallet already deployed.
        ///
        /// Suggested values:
        /// - Solo- and Relay-chains: `frame_system::Pallet`
        /// - Parachains that may produce blocks sparingly or only when needed (on-demand):
        ///   - already have the pallet deployed: `frame_system::Pallet`
        ///   - are freshly deploying this pallet: `RelaychainDataProvider`
        /// - Parachains with a reliably block production rate (PLO or bulk-coretime):
        ///   - already have the pallet deployed: `frame_system::Pallet`
        ///   - are freshly deploying this pallet: no strong recommendation. Both local and remote
        ///     providers can be used. Relay provider can be a bit better in cases where the
        ///     parachain is lagging its block production to avoid clock skew.
        type BlockNumberProvider: BlockNumberProvider;
    }

    /// The in-code storage version.
    const STORAGE_VERSION: StorageVersion = StorageVersion::new(1);

    #[pallet::pallet]
    #[pallet::storage_version(STORAGE_VERSION)]
    pub struct Pallet<T>(_);

    /// The set of open multisig operations.
    #[pallet::storage]
    pub type Multisigs<T: Config> = StorageDoubleMap<
        _,
        Twox64Concat,
        T::AccountId,
        Blake2_128Concat,
        [u8; 32],
        Multisig<BlockNumberFor<T>, BalanceOf<T>, T::AccountId, T::MaxSignatories>,
    >;

    #[pallet::error]
    pub enum Error<T> {
        /// Threshold must be 2 or greater.
        MinimumThreshold,
        /// Call is already approved by this signatory.
        AlreadyApproved,
        /// Call doesn't need any (more) approvals.
        NoApprovalsNeeded,
        /// There are too few signatories in the list.
        TooFewSignatories,
        /// There are too many signatories in the list.
        TooManySignatories,
        /// The signatories were provided out of order; they should be ordered.
        SignatoriesOutOfOrder,
        /// The sender was contained in the other signatories; it shouldn't be.
        SenderInSignatories,
        /// Multisig operation not found in storage.
        NotFound,
        /// Only the account that originally created the multisig is able to cancel it or update
        /// its deposits.
        NotOwner,
        /// No timepoint was given, yet the multisig operation is already underway.
        NoTimepoint,
        /// A different timepoint was given to the multisig operation that is underway.
        WrongTimepoint,
        /// A timepoint was given, yet no multisig operation is underway.
        UnexpectedTimepoint,
        /// The maximum weight information provided was too low.
        MaxWeightTooLow,
        /// The data to be stored is already stored.
        AlreadyStored,
        /// All bounded address candidates admit a legacy raw public key.
        SafeDerivationFailed,
        /// Safe accounts require an exact, untruncated 32-byte account encoding.
        InvalidSafeAccountId,
        /// The threshold exceeds the number of signatories.
        ThresholdTooHigh,
    }

    #[pallet::event]
    #[pallet::generate_deposit(pub(super) fn deposit_event)]
    pub enum Event<T: Config> {
        /// A new multisig operation has begun.
        NewMultisig {
            approving: T::AccountId,
            multisig: T::AccountId,
            call_hash: CallHash,
        },
        /// A multisig operation has been approved by someone.
        MultisigApproval {
            approving: T::AccountId,
            timepoint: Timepoint<BlockNumberFor<T>>,
            multisig: T::AccountId,
            call_hash: CallHash,
        },
        /// A multisig operation has been executed.
        MultisigExecuted {
            approving: T::AccountId,
            timepoint: Timepoint<BlockNumberFor<T>>,
            multisig: T::AccountId,
            call_hash: CallHash,
            result: DispatchResult,
        },
        /// A multisig operation has been cancelled.
        MultisigCancelled {
            cancelling: T::AccountId,
            timepoint: Timepoint<BlockNumberFor<T>>,
            multisig: T::AccountId,
            call_hash: CallHash,
        },
        /// The deposit for a multisig operation has been updated/poked.
        DepositPoked {
            who: T::AccountId,
            call_hash: CallHash,
            old_deposit: BalanceOf<T>,
            new_deposit: BalanceOf<T>,
        },
    }

    #[pallet::hooks]
    impl<T: Config> Hooks<frame_system::pallet_prelude::BlockNumberFor<T>> for Pallet<T> {}

    #[pallet::call]
    impl<T: Config> Pallet<T> {
        /// Immediately dispatch a multi-signature call using a single approval from the caller.
        ///
        /// The dispatch origin for this call must be _Signed_.
        ///
        /// - `other_signatories`: The accounts (other than the sender) who are part of the
        /// multi-signature, but do not participate in the approval process.
        /// - `call`: The call to be executed.
        ///
        /// Result is equivalent to the dispatched result.
        ///
        /// ## Complexity
        /// O(Z + C) where Z is the length of the call and C its execution weight.
        #[pallet::call_index(0)]
        #[pallet::weight({
			let dispatch_info = call.get_dispatch_info();
			(
				T::WeightInfo::as_multi_threshold_1(call.using_encoded(|c| c.len() as u32))
					// AccountData for inner call origin accountdata.
					.saturating_add(T::DbWeight::get().reads_writes(1, 1))
					.saturating_add(dispatch_info.call_weight),
				dispatch_info.class,
			)
		})]
        pub fn as_multi_threshold_1(
            origin: OriginFor<T>,
            other_signatories: Vec<T::AccountId>,
            call: Box<<T as Config>::RuntimeCall>,
        ) -> DispatchResultWithPostInfo {
            Self::do_as_multi_threshold_1(origin, other_signatories, call, false)
        }

        /// Register approval for a dispatch to be made from a deterministic composite account if
        /// approved by a total of `threshold - 1` of `other_signatories`.
        ///
        /// If there are enough, then dispatch the call.
        ///
        /// Payment: `DepositBase` will be reserved if this is the first approval, plus
        /// `threshold` times `DepositFactor`. It is returned once this dispatch happens or
        /// is cancelled.
        ///
        /// The dispatch origin for this call must be _Signed_.
        ///
        /// - `threshold`: The total number of approvals for this dispatch before it is executed.
        /// - `other_signatories`: The accounts (other than the sender) who can approve this
        /// dispatch. May not be empty.
        /// - `maybe_timepoint`: If this is the first approval, then this must be `None`. If it is
        /// not the first approval, then it must be `Some`, with the timepoint (block number and
        /// transaction index) of the first approval transaction.
        /// - `call`: The call to be executed.
        ///
        /// NOTE: Unless this is the final approval, you will generally want to use
        /// `approve_as_multi` instead, since it only requires a hash of the call.
        ///
        /// Result is equivalent to the dispatched result if `threshold` is exactly `1`. Otherwise
        /// on success, result is `Ok` and the result from the interior call, if it was executed,
        /// may be found in the deposited `MultisigExecuted` event.
        ///
        /// ## Complexity
        /// - `O(S + Z + Call)`.
        /// - Up to one balance-reserve or unreserve operation.
        /// - One passthrough operation, one insert, both `O(S)` where `S` is the number of
        ///   signatories. `S` is capped by `MaxSignatories`, with weight being proportional.
        /// - One call encode & hash, both of complexity `O(Z)` where `Z` is tx-len.
        /// - One encode & hash, both of complexity `O(S)`.
        /// - Up to one binary search and insert (`O(logS + S)`).
        /// - I/O: 1 read `O(S)`, up to 1 mutate `O(S)`. Up to one remove.
        /// - One event.
        /// - The weight of the `call`.
        /// - Storage: inserts one item, value size bounded by `MaxSignatories`, with a deposit
        ///   taken for its lifetime of `DepositBase + threshold * DepositFactor`.
        #[pallet::call_index(1)]
        #[pallet::weight({
			let s = other_signatories.len() as u32;
			let z = call.using_encoded(|d| d.len()) as u32;

			T::WeightInfo::as_multi_create(s, z)
			.max(T::WeightInfo::as_multi_approve(s, z))
			.max(T::WeightInfo::as_multi_complete(s, z))
			.saturating_add(*max_weight)
		})]
        pub fn as_multi(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            maybe_timepoint: Option<Timepoint<BlockNumberFor<T>>>,
            call: Box<<T as Config>::RuntimeCall>,
            max_weight: Weight,
        ) -> DispatchResultWithPostInfo {
            let who = ensure_signed(origin)?;
            Self::operate(
                who,
                threshold,
                other_signatories,
                maybe_timepoint,
                CallOrHash::Call(*call),
                max_weight,
                false,
            )
        }

        /// Register approval for a dispatch to be made from a deterministic composite account if
        /// approved by a total of `threshold - 1` of `other_signatories`.
        ///
        /// Payment: `DepositBase` will be reserved if this is the first approval, plus
        /// `threshold` times `DepositFactor`. It is returned once this dispatch happens or
        /// is cancelled.
        ///
        /// The dispatch origin for this call must be _Signed_.
        ///
        /// - `threshold`: The total number of approvals for this dispatch before it is executed.
        /// - `other_signatories`: The accounts (other than the sender) who can approve this
        /// dispatch. May not be empty.
        /// - `maybe_timepoint`: If this is the first approval, then this must be `None`. If it is
        /// not the first approval, then it must be `Some`, with the timepoint (block number and
        /// transaction index) of the first approval transaction.
        /// - `call_hash`: The hash of the call to be executed.
        ///
        /// NOTE: If this is the final approval, you will want to use `as_multi` instead.
        ///
        /// ## Complexity
        /// - `O(S)`.
        /// - Up to one balance-reserve or unreserve operation.
        /// - One passthrough operation, one insert, both `O(S)` where `S` is the number of
        ///   signatories. `S` is capped by `MaxSignatories`, with weight being proportional.
        /// - One encode & hash, both of complexity `O(S)`.
        /// - Up to one binary search and insert (`O(logS + S)`).
        /// - I/O: 1 read `O(S)`, up to 1 mutate `O(S)`. Up to one remove.
        /// - One event.
        /// - Storage: inserts one item, value size bounded by `MaxSignatories`, with a deposit
        ///   taken for its lifetime of `DepositBase + threshold * DepositFactor`.
        #[pallet::call_index(2)]
        #[pallet::weight({
			let s = other_signatories.len() as u32;

			T::WeightInfo::approve_as_multi_create(s)
				.max(T::WeightInfo::approve_as_multi_approve(s))
				.saturating_add(*max_weight)
		})]
        pub fn approve_as_multi(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            maybe_timepoint: Option<Timepoint<BlockNumberFor<T>>>,
            call_hash: [u8; 32],
            max_weight: Weight,
        ) -> DispatchResultWithPostInfo {
            let who = ensure_signed(origin)?;
            Self::operate(
                who,
                threshold,
                other_signatories,
                maybe_timepoint,
                CallOrHash::Hash(call_hash),
                max_weight,
                false,
            )
        }

        /// Cancel a pre-existing, on-going multisig transaction. Any deposit reserved previously
        /// for this operation will be unreserved on success.
        ///
        /// The dispatch origin for this call must be _Signed_.
        ///
        /// - `threshold`: The total number of approvals for this dispatch before it is executed.
        /// - `other_signatories`: The accounts (other than the sender) who can approve this
        /// dispatch. May not be empty.
        /// - `timepoint`: The timepoint (block number and transaction index) of the first approval
        /// transaction for this dispatch.
        /// - `call_hash`: The hash of the call to be executed.
        ///
        /// ## Complexity
        /// - `O(S)`.
        /// - Up to one balance-reserve or unreserve operation.
        /// - One passthrough operation, one insert, both `O(S)` where `S` is the number of
        ///   signatories. `S` is capped by `MaxSignatories`, with weight being proportional.
        /// - One encode & hash, both of complexity `O(S)`.
        /// - One event.
        /// - I/O: 1 read `O(S)`, one remove.
        /// - Storage: removes one item.
        #[pallet::call_index(3)]
        #[pallet::weight(T::WeightInfo::cancel_as_multi(other_signatories.len() as u32))]
        pub fn cancel_as_multi(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            timepoint: Timepoint<BlockNumberFor<T>>,
            call_hash: [u8; 32],
        ) -> DispatchResult {
            Self::do_cancel_as_multi(
                origin,
                threshold,
                other_signatories,
                timepoint,
                call_hash,
                false,
            )
        }

        /// Poke the deposit reserved for an existing multisig operation.
        ///
        /// The dispatch origin for this call must be _Signed_ and must be the original depositor of
        /// the multisig operation.
        ///
        /// The transaction fee is waived if the deposit amount has changed.
        ///
        /// - `threshold`: The total number of approvals needed for this multisig.
        /// - `other_signatories`: The accounts (other than the sender) who are part of the
        ///   multisig.
        /// - `call_hash`: The hash of the call this deposit is reserved for.
        ///
        /// Emits `DepositPoked` if successful.
        #[pallet::call_index(4)]
        #[pallet::weight(T::WeightInfo::poke_deposit(other_signatories.len() as u32))]
        pub fn poke_deposit(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            call_hash: [u8; 32],
        ) -> DispatchResultWithPostInfo {
            Self::do_poke_deposit(origin, threshold, other_signatories, call_hash, false)
        }
        /// Dispatch from a full-width off-curve composite. Delegation remains ordinary.
        #[pallet::call_index(5)]
        #[pallet::weight({
            let info = call.get_dispatch_info();
            (T::WeightInfo::as_multi_threshold_1(call.using_encoded(|c| c.len() as u32))
                .saturating_add(T::DbWeight::get().reads_writes(1, 1))
                .saturating_add(T::SafeDerivationWeight::get())
                .saturating_add(info.call_weight), info.class)
        })]
        pub fn as_multi_threshold_1_safe(
            origin: OriginFor<T>,
            other_signatories: Vec<T::AccountId>,
            call: Box<<T as Config>::RuntimeCall>,
        ) -> DispatchResultWithPostInfo {
            Self::with_safe_derivation_weight(Self::do_as_multi_threshold_1(
                origin,
                other_signatories,
                call,
                true,
            ))
        }

        /// Approve or execute a call using the registration-free off-curve derivation.
        #[pallet::call_index(6)]
        #[pallet::weight({
            let s = other_signatories.len() as u32;
            let z = call.using_encoded(|d| d.len()) as u32;
            T::WeightInfo::as_multi_create(s, z)
                .max(T::WeightInfo::as_multi_approve(s, z))
                .max(T::WeightInfo::as_multi_complete(s, z))
                .saturating_add(T::SafeDerivationWeight::get())
                .saturating_add(*max_weight)
        })]
        pub fn as_multi_safe(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            maybe_timepoint: Option<Timepoint<BlockNumberFor<T>>>,
            call: Box<<T as Config>::RuntimeCall>,
            max_weight: Weight,
        ) -> DispatchResultWithPostInfo {
            let who = ensure_signed(origin)?;
            Self::with_safe_derivation_weight(Self::operate(
                who,
                threshold,
                other_signatories,
                maybe_timepoint,
                CallOrHash::Call(*call),
                max_weight,
                true,
            ))
        }

        /// Approve a call hash for the same off-curve composite used by `as_multi_safe`.
        #[pallet::call_index(7)]
        #[pallet::weight({
            let s = other_signatories.len() as u32;
            T::WeightInfo::approve_as_multi_create(s)
                .max(T::WeightInfo::approve_as_multi_approve(s))
                .saturating_add(T::SafeDerivationWeight::get())
                .saturating_add(*max_weight)
        })]
        pub fn approve_as_multi_safe(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            maybe_timepoint: Option<Timepoint<BlockNumberFor<T>>>,
            call_hash: [u8; 32],
            max_weight: Weight,
        ) -> DispatchResultWithPostInfo {
            let who = ensure_signed(origin)?;
            Self::with_safe_derivation_weight(Self::operate(
                who,
                threshold,
                other_signatories,
                maybe_timepoint,
                CallOrHash::Hash(call_hash),
                max_weight,
                true,
            ))
        }

        /// Cancel only an operation created with the off-curve derivation.
        #[pallet::call_index(8)]
        #[pallet::weight(T::WeightInfo::cancel_as_multi(other_signatories.len() as u32)
            .saturating_add(T::SafeDerivationWeight::get()))]
        pub fn cancel_as_multi_safe(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            timepoint: Timepoint<BlockNumberFor<T>>,
            call_hash: [u8; 32],
        ) -> DispatchResult {
            Self::do_cancel_as_multi(
                origin,
                threshold,
                other_signatories,
                timepoint,
                call_hash,
                true,
            )
        }

        /// Adjust an existing off-curve operation's ordinary multisig deposit.
        #[pallet::call_index(9)]
        #[pallet::weight(T::WeightInfo::poke_deposit(other_signatories.len() as u32)
            .saturating_add(T::SafeDerivationWeight::get()))]
        pub fn poke_deposit_safe(
            origin: OriginFor<T>,
            threshold: u16,
            other_signatories: Vec<T::AccountId>,
            call_hash: [u8; 32],
        ) -> DispatchResultWithPostInfo {
            Self::with_safe_derivation_weight(Self::do_poke_deposit(
                origin,
                threshold,
                other_signatories,
                call_hash,
                true,
            ))
        }
    }
}

impl<T: Config> Pallet<T> {
    /// Derive a multi-account ID from the sorted list of accounts and the threshold that are
    /// required.
    ///
    /// NOTE: `who` must be sorted. If it is not, then you'll get the wrong answer.
    #[allow(clippy::expect_used)] // Preserve the pinned legacy derivation exactly.
    pub fn multi_account_id(who: &[T::AccountId], threshold: u16) -> T::AccountId {
        let entropy = (b"modlpy/utilisuba", who, threshold).using_encoded(blake2_256);
        Decode::decode(&mut TrailingZeroInput::new(entropy.as_ref()))
            .expect("infinite length input; no invalid inputs for type; qed")
    }

    /// Derive the new account after validating its complete sorted authority manifest.
    /// Unsupported AccountId encodings fail rather than truncating the 256-bit result.
    pub fn safe_multi_account_id(
        who: &[T::AccountId],
        threshold: u16,
    ) -> Result<T::AccountId, DispatchError> {
        ensure!(who.len() >= 2, Error::<T>::TooFewSignatories);
        ensure!(
            who.len() <= T::MaxSignatories::get() as usize,
            Error::<T>::TooManySignatories
        );
        ensure!(threshold > 0, Error::<T>::MinimumThreshold);
        ensure!(
            usize::from(threshold) <= who.len(),
            Error::<T>::ThresholdTooHigh
        );
        ensure!(
            who.windows(2).all(|pair| matches!(pair, [a, b] if a < b)),
            Error::<T>::SignatoriesOutOfOrder
        );
        let hash = subtensor_hashed::safe::safe_derived_account(
            subtensor_hashed::safe::MULTISIG_DOMAIN,
            &(who, threshold),
        )
        .ok_or(Error::<T>::SafeDerivationFailed)?;
        let mut encoded = hash.as_slice();
        let account =
            T::AccountId::decode(&mut encoded).map_err(|_| Error::<T>::InvalidSafeAccountId)?;
        ensure!(
            encoded.is_empty() && account.encode() == hash,
            Error::<T>::InvalidSafeAccountId
        );
        Ok(account)
    }

    fn account_id_for(
        who: &[T::AccountId],
        threshold: u16,
        safe: bool,
    ) -> Result<T::AccountId, DispatchError> {
        if safe {
            Self::safe_multi_account_id(who, threshold)
        } else {
            Ok(Self::multi_account_id(who, threshold))
        }
    }

    // Safe calls must retain their derivation charge when the shared operation
    // returns an actual weight and refunds the unused inner-call allowance.
    fn with_safe_derivation_weight(
        result: DispatchResultWithPostInfo,
    ) -> DispatchResultWithPostInfo {
        match result {
            Ok(mut info) => {
                info.actual_weight = info
                    .actual_weight
                    .map(|weight| weight.saturating_add(T::SafeDerivationWeight::get()));
                Ok(info)
            }
            Err(mut error) => {
                error.post_info.actual_weight = error
                    .post_info
                    .actual_weight
                    .map(|weight| weight.saturating_add(T::SafeDerivationWeight::get()));
                Err(error)
            }
        }
    }

    fn do_as_multi_threshold_1(
        origin: OriginFor<T>,
        other_signatories: Vec<T::AccountId>,
        call: Box<<T as Config>::RuntimeCall>,
        safe: bool,
    ) -> DispatchResultWithPostInfo {
        let who = ensure_signed(origin)?;
        let max_sigs = T::MaxSignatories::get() as usize;
        ensure!(!other_signatories.is_empty(), Error::<T>::TooFewSignatories);
        let other_signatories_len = other_signatories.len();
        ensure!(
            other_signatories_len < max_sigs,
            Error::<T>::TooManySignatories
        );
        let signatories = Self::ensure_sorted_and_insert(other_signatories, who.clone())?;

        let id = Self::account_id_for(&signatories, 1, safe)?;

        let (call_len, call_hash) = call.using_encoded(|c| (c.len(), blake2_256(c)));
        let result = call.dispatch(RawOrigin::Signed(id.clone()).into());

        Self::deposit_event(Event::MultisigExecuted {
            approving: who,
            timepoint: Self::timepoint(),
            multisig: id,
            call_hash,
            result: result.map(|_| ()).map_err(|e| e.error),
        });

        result
            .map(|post_dispatch_info| {
                post_dispatch_info
                    .actual_weight
                    .map(|actual_weight| {
                        T::WeightInfo::as_multi_threshold_1(call_len as u32)
                            .saturating_add(actual_weight)
                    })
                    .into()
            })
            .map_err(|err| match err.post_info.actual_weight {
                Some(actual_weight) => {
                    let weight_used = T::WeightInfo::as_multi_threshold_1(call_len as u32)
                        .saturating_add(actual_weight);
                    let post_info = Some(weight_used).into();
                    DispatchErrorWithPostInfo {
                        post_info,
                        error: err.error,
                    }
                }
                None => err,
            })
    }

    fn do_cancel_as_multi(
        origin: OriginFor<T>,
        threshold: u16,
        other_signatories: Vec<T::AccountId>,
        timepoint: Timepoint<BlockNumberFor<T>>,
        call_hash: [u8; 32],
        safe: bool,
    ) -> DispatchResult {
        let who = ensure_signed(origin)?;
        ensure!(threshold >= 2, Error::<T>::MinimumThreshold);
        let max_sigs = T::MaxSignatories::get() as usize;
        ensure!(!other_signatories.is_empty(), Error::<T>::TooFewSignatories);
        ensure!(
            other_signatories.len() < max_sigs,
            Error::<T>::TooManySignatories
        );
        let signatories = Self::ensure_sorted_and_insert(other_signatories, who.clone())?;

        let id = Self::account_id_for(&signatories, threshold, safe)?;

        let m = <Multisigs<T>>::get(&id, call_hash).ok_or(Error::<T>::NotFound)?;
        ensure!(m.when == timepoint, Error::<T>::WrongTimepoint);
        ensure!(m.depositor == who, Error::<T>::NotOwner);

        let err_amount = T::Currency::unreserve(&m.depositor, m.deposit);
        debug_assert!(err_amount.is_zero());
        <Multisigs<T>>::remove(&id, call_hash);

        Self::deposit_event(Event::MultisigCancelled {
            cancelling: who,
            timepoint,
            multisig: id,
            call_hash,
        });
        Ok(())
    }

    fn do_poke_deposit(
        origin: OriginFor<T>,
        threshold: u16,
        other_signatories: Vec<T::AccountId>,
        call_hash: [u8; 32],
        safe: bool,
    ) -> DispatchResultWithPostInfo {
        let who = ensure_signed(origin)?;
        ensure!(threshold >= 2, Error::<T>::MinimumThreshold);
        let max_sigs = T::MaxSignatories::get() as usize;
        ensure!(!other_signatories.is_empty(), Error::<T>::TooFewSignatories);
        ensure!(
            other_signatories.len() < max_sigs,
            Error::<T>::TooManySignatories
        );
        // Get the multisig account ID
        let signatories = Self::ensure_sorted_and_insert(other_signatories, who.clone())?;
        let id = Self::account_id_for(&signatories, threshold, safe)?;

        Multisigs::<T>::try_mutate(
            &id,
            call_hash,
            |maybe_multisig| -> DispatchResultWithPostInfo {
                let mut multisig = maybe_multisig.take().ok_or(Error::<T>::NotFound)?;
                ensure!(multisig.depositor == who, Error::<T>::NotOwner);

                // Calculate the new deposit
                let new_deposit = Self::deposit(threshold);
                let old_deposit = multisig.deposit;

                if new_deposit == old_deposit {
                    *maybe_multisig = Some(multisig);
                    return Ok(Pays::Yes.into());
                }

                // Update the reserved amount
                if new_deposit > old_deposit {
                    let extra = new_deposit.saturating_sub(old_deposit);
                    T::Currency::reserve(&who, extra)?;
                } else {
                    let excess = old_deposit.saturating_sub(new_deposit);
                    let remaining_unreserved = T::Currency::unreserve(&who, excess);
                    if !remaining_unreserved.is_zero() {
                        defensive!(
								"Failed to unreserve for full amount for multisig. (Call Hash, Requested, Actual): ",
								(call_hash, excess, excess.saturating_sub(remaining_unreserved))
							);
                    }
                }

                // Update storage
                multisig.deposit = new_deposit;
                *maybe_multisig = Some(multisig);

                // Emit event
                Self::deposit_event(Event::DepositPoked {
                    who: who.clone(),
                    call_hash,
                    old_deposit,
                    new_deposit,
                });

                Ok(Pays::No.into())
            },
        )
    }
    #[allow(clippy::arithmetic_side_effects)] // Pinned legacy arithmetic; inputs are bounded.
    fn operate(
        who: T::AccountId,
        threshold: u16,
        other_signatories: Vec<T::AccountId>,
        maybe_timepoint: Option<Timepoint<BlockNumberFor<T>>>,
        call_or_hash: CallOrHash<T>,
        max_weight: Weight,
        safe: bool,
    ) -> DispatchResultWithPostInfo {
        ensure!(threshold >= 2, Error::<T>::MinimumThreshold);
        let max_sigs = T::MaxSignatories::get() as usize;
        ensure!(!other_signatories.is_empty(), Error::<T>::TooFewSignatories);
        let other_signatories_len = other_signatories.len();
        ensure!(
            other_signatories_len < max_sigs,
            Error::<T>::TooManySignatories
        );
        let signatories = Self::ensure_sorted_and_insert(other_signatories, who.clone())?;

        let id = Self::account_id_for(&signatories, threshold, safe)?;

        // Threshold > 1; this means it's a multi-step operation. We extract the `call_hash`.
        let (call_hash, call_len, maybe_call) = match call_or_hash {
            CallOrHash::Call(call) => {
                let (call_hash, call_len) = call.using_encoded(|d| (blake2_256(d), d.len()));
                (call_hash, call_len, Some(call))
            }
            CallOrHash::Hash(h) => (h, 0, None),
        };

        // Branch on whether the operation has already started or not.
        if let Some(mut m) = <Multisigs<T>>::get(&id, call_hash) {
            // Yes; ensure that the timepoint exists and agrees.
            let timepoint = maybe_timepoint.ok_or(Error::<T>::NoTimepoint)?;
            ensure!(m.when == timepoint, Error::<T>::WrongTimepoint);

            // Ensure that either we have not yet signed or that it is at threshold.
            let mut approvals = m.approvals.len() as u16;
            // We only bother with the approval if we're below threshold.
            let maybe_pos = m
                .approvals
                .binary_search(&who)
                .err()
                .filter(|_| approvals < threshold);
            // Bump approvals if not yet voted and the vote is needed.
            if maybe_pos.is_some() {
                approvals += 1;
            }

            // We only bother fetching/decoding call if we know that we're ready to execute.
            if let Some(call) = maybe_call.filter(|_| approvals >= threshold) {
                // verify weight
                ensure!(
                    call.get_dispatch_info().call_weight.all_lte(max_weight),
                    Error::<T>::MaxWeightTooLow
                );

                // Clean up storage before executing call to avoid an possibility of reentrancy
                // attack.
                <Multisigs<T>>::remove(&id, call_hash);
                T::Currency::unreserve(&m.depositor, m.deposit);

                let result = call.dispatch(RawOrigin::Signed(id.clone()).into());
                Self::deposit_event(Event::MultisigExecuted {
                    approving: who,
                    timepoint,
                    multisig: id,
                    call_hash,
                    result: result.map(|_| ()).map_err(|e| e.error),
                });
                Ok(get_result_weight(result)
                    .map(|actual_weight| {
                        T::WeightInfo::as_multi_complete(
                            other_signatories_len as u32,
                            call_len as u32,
                        )
                        .saturating_add(actual_weight)
                    })
                    .into())
            } else {
                // We cannot dispatch the call now; either it isn't available, or it is, but we
                // don't have threshold approvals even with our signature.

                if let Some(pos) = maybe_pos {
                    // Record approval.
                    m.approvals
                        .try_insert(pos, who.clone())
                        .map_err(|_| Error::<T>::TooManySignatories)?;
                    <Multisigs<T>>::insert(&id, call_hash, m);
                    Self::deposit_event(Event::MultisigApproval {
                        approving: who,
                        timepoint,
                        multisig: id,
                        call_hash,
                    });
                } else {
                    // If we already approved and didn't store the Call, then this was useless and
                    // we report an error.
                    Err(Error::<T>::AlreadyApproved)?
                }

                let final_weight =
                    T::WeightInfo::as_multi_approve(other_signatories_len as u32, call_len as u32);
                // Call is not made, so the actual weight does not include call
                Ok(Some(final_weight).into())
            }
        } else {
            // Not yet started; there should be no timepoint given.
            ensure!(maybe_timepoint.is_none(), Error::<T>::UnexpectedTimepoint);

            // Just start the operation by recording it in storage.
            let deposit = Self::deposit(threshold);

            T::Currency::reserve(&who, deposit)?;

            let initial_approvals = vec![who.clone()]
                .try_into()
                .map_err(|_| Error::<T>::TooManySignatories)?;

            <Multisigs<T>>::insert(
                &id,
                call_hash,
                Multisig {
                    when: Self::timepoint(),
                    deposit,
                    depositor: who.clone(),
                    approvals: initial_approvals,
                },
            );
            Self::deposit_event(Event::NewMultisig {
                approving: who,
                multisig: id,
                call_hash,
            });

            let final_weight =
                T::WeightInfo::as_multi_create(other_signatories_len as u32, call_len as u32);
            // Call is not made, so the actual weight does not include call
            Ok(Some(final_weight).into())
        }
    }

    /// The current `Timepoint`.
    pub fn timepoint() -> Timepoint<BlockNumberFor<T>> {
        Timepoint {
            height: T::BlockNumberProvider::current_block_number(),
            index: <frame_system::Pallet<T>>::extrinsic_index().unwrap_or_default(),
        }
    }

    /// Check that signatories is sorted and doesn't contain sender, then insert sender.
    #[allow(clippy::arithmetic_side_effects)] // Pinned legacy arithmetic; inputs are bounded.
    fn ensure_sorted_and_insert(
        other_signatories: Vec<T::AccountId>,
        who: T::AccountId,
    ) -> Result<Vec<T::AccountId>, DispatchError> {
        let mut signatories = other_signatories;
        let mut maybe_last = None;
        let mut index = 0;
        for item in signatories.iter() {
            if let Some(last) = maybe_last {
                ensure!(last < item, Error::<T>::SignatoriesOutOfOrder);
            }
            if item <= &who {
                ensure!(item != &who, Error::<T>::SenderInSignatories);
                index += 1;
            }
            maybe_last = Some(item);
        }
        signatories.insert(index, who);
        Ok(signatories)
    }

    /// Calculate the deposit for a multisig operation.
    ///
    /// The deposit is calculated as `DepositBase + DepositFactor * threshold`.
    #[allow(clippy::arithmetic_side_effects)] // Pinned legacy arithmetic; inputs are bounded.
    pub fn deposit(threshold: u16) -> BalanceOf<T> {
        T::DepositBase::get() + T::DepositFactor::get() * threshold.into()
    }
}

/// Return the weight of a dispatch call result as an `Option`.
///
/// Will return the weight regardless of what the state of the result is.
fn get_result_weight(result: DispatchResultWithPostInfo) -> Option<Weight> {
    match result {
        Ok(post_info) => post_info.actual_weight,
        Err(err) => err.post_info.actual_weight,
    }
}