Area
contracts/compliance/src/lib.rs (admin, set_pools, set_disclosure_vk)
Problem
Two gaps in the compliance contract's admin model:
admin is stored once at construction (lib.rs:141-158) and every privileged call does admin.require_auth() against that fixed address — there is no set_admin/transfer_admin anywhere. A lost admin key permanently bricks set_pools, register_kyc, and set_disclosure_vk; a compromised one can never be replaced.set_pools (lib.rs:162-172) and set_disclosure_vk (lib.rs:282-299) mutate state silently — no event is emitted, unlike register_kyc/verify_compliance/verify_disclosure, which all emit events. These are the two admin actions with the highest blast radius (set_pools changes which pools' roots/amounts are trusted for AmountMismatch/ThresholdNotMet checks; set_disclosure_vk changes the entire disclosure verification key), yet produce no monitorable trail.
Proposed change
Add a two-step propose_admin/accept_admin (or at minimum a same-tx set_admin requiring current-admin auth) for admin rotation. Add PoolsUpdatedEvent/DisclosureVkUpdatedEvent alongside the existing bump_instance calls in set_pools/set_disclosure_vk.
Acceptance Criteria
Open your PR against the dev branch, not main. All active development merges into dev.
Discuss this issue / coordinate work: join the DShield contributor Telegram group: https://t.me/+SiGHH24No9U2MDJk
Area
contracts/compliance/src/lib.rs (
admin,set_pools,set_disclosure_vk)Problem
Two gaps in the compliance contract's admin model:
adminis stored once at construction (lib.rs:141-158) and every privileged call doesadmin.require_auth()against that fixed address — there is noset_admin/transfer_adminanywhere. A lost admin key permanently bricksset_pools,register_kyc, andset_disclosure_vk; a compromised one can never be replaced.set_pools(lib.rs:162-172) andset_disclosure_vk(lib.rs:282-299) mutate state silently — no event is emitted, unlikeregister_kyc/verify_compliance/verify_disclosure, which all emit events. These are the two admin actions with the highest blast radius (set_poolschanges which pools' roots/amounts are trusted forAmountMismatch/ThresholdNotMetchecks;set_disclosure_vkchanges the entire disclosure verification key), yet produce no monitorable trail.Proposed change
Add a two-step
propose_admin/accept_admin(or at minimum a same-txset_adminrequiring current-admin auth) for admin rotation. AddPoolsUpdatedEvent/DisclosureVkUpdatedEventalongside the existingbump_instancecalls inset_pools/set_disclosure_vk.Acceptance Criteria
PoolsUpdatedEventandDisclosureVkUpdatedEventemitted and testedjust test,pnpm test,cargo test, ornargo testas applicable) pass locally and in CIcargo testoutput covering admin rotation and the new events) — required before this can be merged.Open your PR against the
devbranch, notmain. All active development merges intodev.Discuss this issue / coordinate work: join the DShield contributor Telegram group: https://t.me/+SiGHH24No9U2MDJk