feat: re-gate config & treasury functions to GOVERNANCE_ROLE#172
feat: re-gate config & treasury functions to GOVERNANCE_ROLE#1720xpanicError wants to merge 8 commits into
Conversation
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
0xpanicError
changed the title
![certora-run[bot]](https://avatars.githubusercontent.com/in/1083145?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verification Results
- Group ID: 1968a09d-353c-4d89-992e-3e1e9e21c47c
- Commit: c31b233
| Job | Result | VERIFIED |
|---|---|---|
| EtherFiSafe.… | ⌛ | 0 |
| CashModuleCo… | ✅ | 2 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8bf4d36. Configure here.
There was a problem hiding this comment.
Verification Results
- Group ID: f53abd2f-ba74-4f1d-9872-a7004db21201
- Commit: 8bf4d36
| Job | Result | ERROR |
|---|---|---|
| EtherFiSafe.… | ⌛ | 0 |
| CashModuleCo… | ❌ | 1 |
There was a problem hiding this comment.
Verification Results
- Group ID: c94c3ab8-6d4f-4129-9dea-8e2f5ff21710
- Commit: 081836e
| Job | Result | ERROR | VERIFIED |
|---|---|---|---|
| EtherFiSafe.… | ✅ | 0 | 14 |
| CashModuleCo… | ❌ | 1 | 0 |
There was a problem hiding this comment.
Verification Results
- Group ID: ecfb6cd0-b5f6-4638-a1ec-97bceb803c97
- Commit: 784e182
| Job | Result | VERIFIED |
|---|---|---|
| EtherFiSafe.… | ✅ | 14 |
| CashModuleCo… | ✅ | 2 |
There was a problem hiding this comment.
Verification Results
- Group ID: 1e49c16b-6dab-44d8-8d66-c9bebbbc26a6
- Commit: ec4c2a0
| Job | Result | VERIFIED |
|---|---|---|
| EtherFiSafe.… | ✅ | 14 |
| CashModuleCo… | ✅ | 2 |
There was a problem hiding this comment.
Verification Results
- Group ID: de379059-0d62-414c-80bc-9f014d3b1e15
- Commit: 58274ab
| Job | Result | VERIFIED |
|---|---|---|
| EtherFiSafe.… | ✅ | 14 |
| CashModuleCo… | ✅ | 2 |
There was a problem hiding this comment.
Verification Results
- Group ID: 1edc4f64-bade-4dc3-8c1a-38dd0156599d
- Commit: 530fa82
| Job | Result | VERIFIED |
|---|---|---|
| EtherFiSafe.… | ✅ | 14 |
| CashModuleCo… | ✅ | 2 |
1 participant
Summary
Implements STAKE-1673: the 14 config & treasury functions were gated by
onlyRoleRegistryOwner, so once RoleRegistry ownership moves to the 2-day timelock (STAKE-1676) they would freeze behind the delay. This PR re-gates them to a consolidatedGOVERNANCE_ROLEso they stay fast at the governance multisig, and adds the timelock contract that will take RoleRegistry ownership.Core gate
GOVERNANCE_ROLEpublic constant,OnlyGovernanceMultisig()error, andonlyGovernanceMultisigmodifier (hasRole(GOVERNANCE_ROLE, msg.sender)) inUpgradeableProxy.Re-gated: config (9)
SettlementDispatcherV2:setDestinationData,setLiquidAssetWithdrawQueue,setRefundWallet,setFraxConfig,setMidasRedemptionVault,setCCTPConfig,setSettlementRecipientsTopUpFactory:setTokenConfig,setRecoveryWalletRe-gated: treasury (5)
SettlementDispatcherV2.withdrawFunds,TopUpFactory.recoverFunds,TopUpDest.withdraw,CashbackDispatcher.withdrawFunds,LiquidUSDLiquifierOPModule.withdrawFundsLeft on owner (upgrade vectors, per ticket)
DebtManagerCore.setAdminImpl,BeaconFactory.upgradeBeaconImplementation— verified these are the only remainingonlyRoleRegistryOwnercall sites.Timelock
EtherFiTimelock(thin wrapper over OZ 5.2TimelockController) +scripts/DeployTimelock.s.sol: 2-day delay, current governance multisig (read asRoleRegistry.owner()) as sole proposer & executor, no admin (the timelock administers its own roles behind the delay).roleRegistry.transferOwnership(timelock)handoff happen in STAKE-1676 — the transfer must be sent by the multisig viascripts/gnosis-txs/, and only afterGOVERNANCE_ROLE(keccak256("GOVERNANCE_ROLE")) is granted to it.Certora
GOVERNANCE_ROLEto thecontract_extensionsexclude list inCashModuleCore.conf: the public constant now exists on bothCashModuleCoreHarnessandCashModuleSetters, and shared inherited functions must be excluded from the merge (same handling as the other inherited role constants).Tests
GOVERNANCE_ROLEto the test owner in the five setups that deploy a RoleRegistry; updated the seven existing unauthorized-caller tests to expectOnlyGovernanceMultisig.EtherFiTimelocksuite: role wiring, min-delay enforcement, schedule→execute of RoleRegistry owner actions after the 2-day delay, premature/unauthorized schedule & execute reverts, no multisig bypass once ownership is transferred, delay changes only via the timelock itself.Expected CI status
The
upgrade-bytecode-verificationtests fail on this branch by design (21 tests): the publicGOVERNANCE_ROLEgetter compiles into every contract inheritingUpgradeableProxy, so local bytecode diverges from all currently-deployed impls until the STAKE-1676 redeploy. All other tests pass (1018 passed locally).🤖 Generated with Claude Code
Note
High Risk
Changes who can run treasury withdrawals and bridge/settlement configuration, and adds operational scripts that upgrade proxies and transfer RoleRegistry ownership to a timelock—mistakes could lock ops or move critical admin control.
Overview
Introduces
GOVERNANCE_ROLEonUpgradeableProxy(onlyGovernanceMultisig) so config and treasury calls stay with the governance multisig afterRoleRegistryownership moves to a timelock. 14 functions that usedonlyRoleRegistryOwnernow useonlyGovernanceMultisigacrossSettlementDispatcherV2,TopUpFactory,TopUpDest,CashbackDispatcher, andLiquidUSDLiquifierOPModule; upgrade paths (DebtManagerCore.setAdminImpl,BeaconFactory.upgradeBeaconImplementation) stay owner-gated.Adds
EtherFiTimelock(OZTimelockControllerwrapper),DeployTimelock.s.sol(CREATE3 via Nick’s factory, 2-day delay),Create3Deployer, and per-chain STAKE-1676 migration scripts that deploy new impls, emit two-step Gnosis bundles (upgrade + grant role + schedule handover; later execute handover), and fork-simulate the end state. CertoraCashModuleCore.confexcludes inheritedGOVERNANCE_ROLE; tests grant the role in setups and assert owner-without-role is rejected.Reviewed by Cursor Bugbot for commit 530fa82. Bugbot is set up for automated code reviews on this repo. Configure here.