Auction admin rotation via multisig + timelock

[truthixify]

Tier: M (2-4 days) | Type: security

Context. Wave 7 shipped sealed-bid auctions at stellar/wraith-names/src/auction.rs. The AuctionConfig { admin, treasury, token, reserve_price, launch_time, commit_secs, reveal_secs } sets admin to a single Address at init_auctions, and there is no rotation path. If the auction admin key is lost or compromised there is no on-chain remedy short of the WASM upgrade entrypoint, which is not yet implemented (see wraith-names/tests/upgrade_auth.rs with 4 #[ignore] cases). The rest of wraith-names already has the 7-day multisig rotation flow from Wave 7 #5; auctions should reuse it.

Scope.

• Add rotate_auction_admin(new_admin) gated by the existing wraith-names/src/multisig.rs signer set + 7-day timelock (reuse RotationProposal).
• Emit AuctionAdminRotated(old, new) event.
• Reject rotation while an auction is in the reveal or settle phase (prevents mid-auction admin swap).
• Update stellar/wraith-names/README.md and stellar/MULTISIG.md with the rotation runbook.

Acceptance.

• cargo test -p wraith-names --test auction covers happy-path rotation, timelock enforcement, and rejection during active reveal
• AuctionAdminRotated event emitted with correct topics + data
• stellar/MULTISIG.md runbook rehearsed against futurenet (linked run)
• stellar/wraith-names/README.md documents the rotation surface

Files. stellar/wraith-names/src/auction.rs, stellar/wraith-names/src/multisig.rs, stellar/wraith-names/tests/auction.rs, stellar/wraith-names/README.md, stellar/MULTISIG.md.

[charlesejemai-cyber]

@charlesejemai-cyber has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hi, i want to work on this issue, thanks maintainer

ℹ️ Repo Maintainers: To accept this application, review their application or assign @charlesejemai-cyber to this issue.

[BuddiBisong]

@BuddiBisong has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

I would like to work on this issue because I am a professional developer and i have the skills and technical knowhow to solve this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @BuddiBisong to this issue.

[MrOmale]

@MrOmale has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I’m excited to contribute to this issue. With my experience in this field, I can provide a practical solution while maintaining quality and reliability. Please let me work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @MrOmale to this issue.

[Good-terminal]

@Good-terminal has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer I will like to work on this issue please

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Good-terminal to this issue.

[DSOTec]

@DSOTec has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi maintainer, I love this repository. I enjoy working on this repository. Please kindly assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DSOTec to this issue.

[gbengaeben]

@gbengaeben has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello maintainer,

I would like to contribute to issue #165 ("Auction admin rotation via multisig + timelock") for the wraith-protocol/contracts repository.

To ensure my implementation seamlessly integrates with the existing security architecture and reuses the Wave 7 patterns correctly, could you please clarify a couple of details before I begin?

1. Multisig Integration: Since the existing stellar/wraith-names/src/multisig.rs provides the 7-day timelock and RotationProposal flow, should rotate_auction_admin(new_admin) directly consume or wrap the standard RotationProposal state machine, or should it use a parallel proposal struct specific to auction administration?
2. Phase Validation: For rejecting rotation while an auction is in the reveal or settle phase, should this check look at all ongoing/active auctions globally or only check against a specific auction ID if passed as an argument, or block rotation if any active auction is currently in those phases?

Once aligned on these points, I am ready to implement the rotate_auction_admin function, add the required phase guards and event emissions (AuctionAdminRotated), update the unit/integration tests in stellar/wraith-names/tests/auction.rs, and document the runbooks in README.md and MULTISIG.md.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @gbengaeben to this issue.