feat: add oz foundry upgrades to rev dist upgrade script

[0xCooki]

📄 Description

Briefly describe the purpose of this PR. Include context and what it solves.

This PR adds Openzeppelin's Foundry Upgrades to the repo, and uses it in the Revenue Distributor upgrade script.

🧠 Rationale

Explain the motivation and necessity of the change. Why was this needed? What problem does it solve?

Using the Openzeppelin's Foundry Upgrades library provides a safer means of upgrading proxy contracts by automating safety checks for things such as storage collisions.

🧪 Example / Testing

If applicable, provide test scenarios, CLI commands, or example contract interactions.

The pre-existing test for the Revenue Distributor has been modified to include this deploy script, which validates that it works as expected.

🧬 Changes Summary

Notable changes:

• add each change in a bullet point here
• ...

• Added Openzeppelin's Foundry Upgrades and Upgrades Core
• Modified the Revenue Distributor upgrade script to use these Upgrades
• Modified the foundry.toml and unit-tests.yaml to support using Upgrades (e.g. adding 'forge clean' and build information)
• Added the historical Revenue Distributor contract so that all safety checks can be undertaken in the upgrade script

[hashdit-bot]

Pull Request Review

This PR integrates OpenZeppelin Foundry Upgrades into the repository and refactors the BSC Revenue Distributor upgrade script to use Upgrades.upgradeProxy with storage-layout safety validation instead of a manual ProxyAdmin.call. It also adds a historical ListaRevenueDistributorOld contract and annotates the current contract with @custom:oz-upgrades-from to support upgrade safety checks. CI/build configuration was updated (forge clean, ffi, build_info, storageLayout, and FS permissions), and tests were adapted to execute and validate the new upgrade flow.

Sensitive Content

Blockchain Address:

• 0xe36857af784fB2B8cFA22481b51Fa0c99D13fF20 (proxy address) in scripts/foundry/dao/bsc_upgrade_revenueDistributor.sol — hardcoded upgrade target
• 0x529D1D9eB9D2D664148be1AE15281521c5d498F3 (ProxyAdmin address) in scripts/foundry/dao/bsc_upgrade_revenueDistributor.sol — hardcoded admin contract
• 0x08aE09467ff962aF105c23775B9Bc8EAa175D27F in .env.sample — ADMIN default value
• 0x8d388136d578dCD791D081c6042284CED6d9B0c6 in .env.sample — MANAGER default value
• 0xEEfebb1546d88EA0909435DF6f615084DD3c5Bd8 in .env.sample — PAUSER default value

No sensitive content detected for private keys/seed phrases or social accounts.

Security Issues

🟡 [MEDIUM] Potentially unsafe script-level upgrade authority simplification (confirm intended operational model)

File: scripts/foundry/dao/bsc_upgrade_revenueDistributor.sol
The upgrade flow was changed from a two-key model (separate deployer and ProxyAdmin owner) to a single key (PRIVATE_KEY_PROXY_ADMIN) that both deploys and performs upgrade actions via OZ Upgrades. This is not a direct on-chain contract vulnerability, but it relaxes operational key separation and increases blast radius if that key is compromised.
Recommendation: Confirm this consolidation is intentional. If not, keep distinct deployer/upgrader roles (or use multisig/hardware-backed signer for ProxyAdmin owner), and document the required signer/security assumptions.

No serious security issues detected.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.

[hashdit-bot]

Pull Request Review

This PR integrates OpenZeppelin Foundry Upgrades into the repository and migrates the Revenue Distributor upgrade script to use Upgrades.prepareUpgrade plus ProxyAdmin.upgrade rather than a raw low-level call. It also adds a historical ListaRevenueDistributorOld contract and upgrade metadata annotations to enable storage-layout compatibility validation during upgrades. CI/foundry config was updated to support upgrades validation (forge clean, ffi, build_info, storageLayout outputs), and tests were adjusted to exercise the new upgrade flow.

Sensitive Content

Blockchain Address:

• 0xe36857af784fB2B8cFA22481b51Fa0c99D13fF20 (Ethereum/BSC address) in scripts/foundry/dao/bsc_upgrade_revenueDistributor.sol — hardcoded proxy address
• 0x529D1D9eB9D2D664148be1AE15281521c5d498F3 (Ethereum/BSC address) in scripts/foundry/dao/bsc_upgrade_revenueDistributor.sol — hardcoded ProxyAdmin address
• 0x08aE09467ff962aF105c23775B9Bc8EAa175D27F (Ethereum/BSC address) in .env.sample — ADMIN config example
• 0x8d388136d578dCD791D081c6042284CED6d9B0c6 (Ethereum/BSC address) in .env.sample — MANAGER config example
• 0xEEfebb1546d88EA0909435DF6f615084DD3c5Bd8 (Ethereum/BSC address) in .env.sample — PAUSER config example

Security Issues

No serious security issues detected.

---

Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits.