correct replay check logic and secure unsigned thread validation

Signed-off-by: Uncle Stinky <uncle.stinky@ghostchain.io>

pallets/weaver/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ghost-weaver"
-version = "0.0.15"
+version = "0.0.16"
 description = "Weaving a secure cryptographic tapestry across different external chains."
 license.workspace = true
 authors.workspace = true

pallets/weaver/src/lib.rs

@@ -616,6 +616,21 @@ pub mod pallet {
                         .propagate(true)
                         .build()
                 }
+                Call::pull_thread {
+                    network_id,
+                    session,
+                    thread_proof,
+                } => {
+                    let thread_context =
+                        Self::validate_thread(network_id, session, thread_proof)?;
+
+                    ValidTransaction::with_tag_prefix("WeaverThread")
+                        .priority(T::UnsignedPriority::get())
+                        .and_provides(thread_context.encode())
+                        .longevity(LOCK_BLOCK_EXPIRATION)
+                        .propagate(true)
+                        .build()
+                }
                 _ => InvalidTransaction::Call.into(),
             }
         }
@@ -623,6 +638,31 @@ pub mod pallet {
 }
 
 impl<T: Config> Pallet<T> {
+    fn validate_thread(
+        network_id: &NetworkIdOf<T>,
+        session: &WeavingSession,
+        thread_proof: &ThreadProof<BalanceOf<T>>,
+    ) -> Result<H256, InvalidTransaction> {
+        let network_data = T::NetworkDataHandler::get(&network_id)
+            .ok_or(InvalidTransaction::BadProof)?;
+
+        let root_hash = LoomStates::<T>::get(&network_id, &session);
+        if root_hash == Default::default() {
+            return Err(InvalidTransaction::BadProof);
+        }
+
+        thread_proof
+            .verify_thread_proof(root_hash, *network_id, &network_data.gatekeeper)
+            .ok_or(InvalidTransaction::BadProof)?;
+
+        let pulled_thread_key = thread_proof.get_unique_key(*session, *network_id);
+        if PulledThreads::<T>::contains_key(&pulled_thread_key) {
+            return Err(InvalidTransaction::Stale);
+        }
+
+        Ok(pulled_thread_key)
+    }
+
     fn validate_attestation_signature<A>(
         attestation: &A,
         signature: &<T::AuthorityId as RuntimeAppPublic>::Signature,