Skip to content

[Contracts] Add transfer_admin so protocol ownership can be rotated #459

Description

@ogazboiz

Join the discussion on Telegram

Why this matters

The protocol admin is set once in initialize and is then immutable forever. update_fee_config keeps the existing admin (admin: config.admin) and there is no other entry point that can change it. If the admin key is lost, rotated, or compromised, the protocol can never recover control of the treasury/fee configuration — a serious operational risk for anything heading to mainnet. A standard, authenticated two-field (or two-step) admin transfer closes this gap.

Acceptance criteria

  • Add a transfer_admin(env, current_admin, new_admin) function to contracts/stream_contract/src/lib.rs that requires the current admin's auth, verifies the caller matches the stored admin, and updates ProtocolConfig.admin.
  • Emit an AdminTransferredEvent (contracts/stream_contract/src/events.rs).
  • Reject when the contract is not initialized (NotInitialized) and when the caller is not the admin (NotAdmin).
  • Add unit tests in contracts/stream_contract/src/test.rs: successful transfer, non-admin rejected, and the new admin can subsequently call update_fee_config.

Files to touch

  • contracts/stream_contract/src/lib.rs
  • contracts/stream_contract/src/events.rs
  • contracts/stream_contract/src/test.rs

Out of scope

  • A timelock or multisig admin model (can be layered later).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programcontractsSmart contract related taskssecuritySecurity related taskssmart-contractSoroban smart contract

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions