Skip to content

Make admin transfer two-step to prevent bricking the registry #27

Description

@priscaenoch

Problem

transfer_admin in explorer/src/lib.rs sets the new admin in a single step: it authorizes the current admin, then immediately writes DataKey::Admin to the provided new_admin. Every privileged operation (pause, set_max_events, register_contract, submit_event, etc.) is gated on that address. If the admin transfers to a mistyped or uncontrolled address, the contract is permanently bricked with no way to recover control, because there is no upgrade path either.

What needs to be done

  • Replace the single-step transfer with a two-step nominate/accept flow:
    • transfer_admin(new_admin) records a pending admin (does not change the active admin).
    • accept_admin() requires require_auth from the pending admin and only then promotes it to active admin.
  • Add a way for the current admin to cancel a pending transfer before it is accepted.
  • Emit events for nomination, acceptance, and cancellation, and extend the instance TTL on each write.
  • Keep the existing typed Error variants and add any needed new ones.

Files

  • explorer/src/lib.rs

Acceptance deliverables

  • Admin rights only move once the nominated address actively accepts.
  • A pending transfer can be cancelled by the current admin.
  • All CI checks pass; the change cannot be merged until CI is green.

Tests to pass

  • Test: after transfer_admin, the current admin still controls the contract until accept_admin.
  • Test: only the pending admin can accept_admin.
  • Test: the current admin can cancel a pending transfer.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardThird CampaignCampaign: Third CampaignenhancementNew feature or request

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions