Multitoken vp ensures debited accounts' vps are triggered

crates/trans_token/src/vp.rs

@@ -113,8 +113,7 @@ where
                     // Internal addresses need to always verify the transaction
                     // (credit and debit)
                     return Err(Error::new_alloc(format!(
-                        "The vp of debited internal address {} has not been \
-                         triggered",
+                        "The vp of internal address {} has not been triggered",
                         owner
                     )));
                 }
@@ -147,6 +146,14 @@ where
                                 "Native token deposit isn't allowed",
                             ));
                         }
+                        if !verifiers.contains(owner) {
+                            // Debit must be verified by the controlling vp
+                            return Err(Error::new_alloc(format!(
+                                "The vp of debited address {} has not been \
+                                 triggered",
+                                owner
+                            )));
+                        }
                         let diff = pre
                             .checked_sub(post)
                             .expect("Underflow shouldn't happen here");