fix(multi-asset-bounties): enforce authorization in unassign_curator when parent bounty is not Active

[dhirajs0]

Description

Fix an authorization bypass in pallet-multi-asset-bounties where any signed account could
forcibly unassign an active child bounty's curator when the parent bounty was not in Active state
(e.g., CuratorUnassigned). This also caused the child curator's native balance hold (deposit) to
be permanently leaked — removed from pallet storage but never released or burned on-chain.

Root cause: In unassign_curator, the BountyStatus::Active branch's catch-all Some(sender)
arm used if let Some(parent_curator) = parent_curator { ... } with no else clause. When
parent_curator was None (parent bounty not Active), the block was silently skipped and execution
fell through to the state transition — no BadOrigin error was returned.

Integration

No integration changes required for downstream projects. This is a fix internal to
pallet-multi-asset-bounties with no public API changes. The extrinsic signature and behavior for
authorized callers remain identical.

Review Notes

The fix restructures the BountyStatus::Active arm in unassign_curator with two changes:

1. Authorization before storage mutation

Previously, CuratorDeposit::take() was called unconditionally at the top of the Active arm
(before verifying the caller). Now it is called inside each match maybe_sender arm, only after the
caller is confirmed to be authorized. This prevents the deposit from being removed from storage on
an unauthorized (and reverted) call path.

 BountyStatus::Active { ref curator, .. } => {
-    let maybe_curator_deposit =
-        CuratorDeposit::<T, I>::take(parent_bounty_id, child_bounty_id);
     match maybe_sender {
         None => {
-            if let Some(curator_deposit) = maybe_curator_deposit {
+            if let Some(curator_deposit) =
+                CuratorDeposit::<T, I>::take(parent_bounty_id, child_bounty_id)
+            {
                 T::Consideration::burn(curator_deposit, curator);
             }
         },

2. Explicit rejection when parent_curator is None

The catch-all Some(sender) arm now uses parent_curator.ok_or(BadOrigin)? followed by an
ensure!. When parent_curator is None, the call is immediately
rejected with BadOrigin.

         Some(sender) => {
-            if let Some(parent_curator) = parent_curator {
-                if sender == parent_curator && *curator != parent_curator {
-                    if let Some(curator_deposit) = maybe_curator_deposit {
-                        T::Consideration::burn(curator_deposit, curator);
-                    }
-                } else {
-                    return Err(BadOrigin.into());
-                }
+            let parent_curator = parent_curator.ok_or(BadOrigin)?;
+            ensure!(
+                sender == parent_curator && *curator != parent_curator,
+                BadOrigin
+            );
+            if let Some(curator_deposit) =
+                CuratorDeposit::<T, I>::take(parent_bounty_id, child_bounty_id)
+            {
+                T::Consideration::burn(curator_deposit, curator);
             }
         },

Regression test

A comprehensive test (unprivileged_caller_cannot_unassign_active_child_curator_when_parent_not_active)
is added that:

1. Creates an active child bounty with a separate child curator.
2. Has the parent curator voluntarily unassign (putting parent into CuratorUnassigned).
3. Asserts that an unprivileged attacker is rejected with BadOrigin.
4. Verifies the child bounty remains Active, the curator deposit stays in storage, and the
   balance hold is intact.
5. Confirms the child curator can still voluntarily unassign themselves and that the deposit is
   properly released.

Checklist

• My PR includes a detailed description as outlined in the "Description" and its two subsections above.
• My PR follows the [labeling requirements]
• I have made corresponding changes to the documentation (if applicable)
• I have added tests that prove my fix is effective or that my feature works (if applicable)

[dhirajs0]

/cmd prdoc

[dhirajs0]

/cmd fmt

[paritytech-release-backport-bot]

Created backport PR for stable2512:

• [stable2512] Backport #11612 #11637 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-11612-to-stable2512
git worktree add --checkout .worktree/backport-11612-to-stable2512 backport-11612-to-stable2512
cd .worktree/backport-11612-to-stable2512
git reset --hard HEAD^
git cherry-pick -x ecada3402a70d906e10c6d33b0f42b6174fea119
git push --force-with-lease

[paritytech-release-backport-bot]

Created backport PR for stable2603:

• [stable2603] Backport #11612 #11638 with remaining conflicts!

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin backport-11612-to-stable2603
git worktree add --checkout .worktree/backport-11612-to-stable2603 backport-11612-to-stable2603
cd .worktree/backport-11612-to-stable2603
git reset --hard HEAD^
git cherry-pick -x ecada3402a70d906e10c6d33b0f42b6174fea119
git push --force-with-lease