set_controller should check if session keys are set and move refcounts if they are

[lsaether]

I'm investigating an issue related to the Polkadot account 165mqgdi4qRCtob1RHf3QgigoA15JY8XqmDcu5jyrSfKwXJK. This account has an existing refcount and cannot be reaped, however all available methods to remove the refcount are unable to be called.

You can check that this account has a refcount by querying system.account:

However for each of the three ways on Polkadot to remove a refcount, none of them can be called:

• session.purge_keys which fails for this account because it does not have an attached stash account (and there are no keys in state if you query session.nextKeys. This can be checked by querying staking.ledger with the target account:

• staking.withdraw_unbonded which fails for the same reason as above (ledger does not exist).

• A balance lock which does not exist for this account.

After looking through the account's transaction history I believe what happened is the following:

1. Stash bonds to Controller.
2. Controller calls set_keys which sets Controller's refcount to 1.
3. Stash calls set_controller to change the controller.
4. Old Controller still has the refcount with no way to remove it.

What we could do here is call set_controller again to Old Controller and then call purge_keys from Old Controller to remove it, but this seems wrong. Further, this could possibly be exploited to artificially reduce the refcounts on an account by repeating the process of set_controller and purge_keys.

When set_controller is called, it should check if keys are added in Session and dec_ref of the old controller and inc_ref the new controller if they exist.

[kianenigma]

excellent catch. Your description and suggestion both seem broadly correct me, without looking into the code yet. We need to do a sweep and make sure before fixing this, we cover all the accounts that have the same issue.