Security hardening with 85 target

[boris]

This pull request introduces significant security hardening and standardization to the administrative and meta-transaction (forwarder) controls in both the CLPc token and ClaimCLPc contracts. The main improvements are the introduction of on-chain timelocks for sensitive operations (notably, updating the trusted forwarder), migration to standardized OpenZeppelin primitives for admin and pause controls, and comprehensive documentation and operational checklists for secure redeployment and post-release validation.

⚠️ Focused only in CLPc and Claim contracts

Key changes include:

Security Hardening: Timelock for Trusted Forwarder Updates

• Updating the trustedForwarder in both CLPc and ClaimCLPc now requires a two-step process with a mandatory 2-day on-chain delay. The process involves scheduling the update, waiting for the timelock, and then executing it, with the ability to cancel before execution. This mitigates the risk of instant privilege escalation if an admin key is compromised. [1] [2] [3] [4] [5] [6] [7] [8] [9]

Standardization of Administrative Controls

• ClaimCLPc now uses OpenZeppelin's Ownable2Step, Pausable, and ReentrancyGuard for admin, pause, and reentrancy protection, replacing custom logic. This introduces a two-step ownership transfer and standard pause mechanisms, improving auditability and operational safety. [1] [2] [3]

Token Contract Admin Improvements

• The CLPc contract now uses AccessControlDefaultAdminRules with a built-in delay for transferring the default admin role, further reducing the risk of immediate privilege transfers. Documentation reflects these changes, including the new admin transfer flow and updated function names for pausing minting. [1] [2] [3] [4] [5] [6]

Documentation and Operational Guidance

• Extensive updates to deployment and security documentation, including new runbooks and checklists for secure redeployment, wiring, admin transfer, and post-release smoke tests. These guide teams through the new two-step admin and forwarder update processes and ensure all integrations and permissions are updated safely. [1] [2]

Improved Makefile and CLI Support

• The Makefile and deployment runbooks are updated to support the new timelocked forwarder update process, including commands for scheduling, executing, canceling, and checking pending changes for both contracts. [1] [2] [3]

These changes collectively improve the security posture and maintainability of the contracts by enforcing observable delays for sensitive operations and aligning with widely-accepted standards for administrative controls.

[boris]

Previous vs new score

Contract	Previous	New
CLPc	61.54	72.52
MockZK	89.97	Not changed
Identity	86.25	Not changed
Forwarder	96.77	Not changed
Claim	60.22	60.24
Transport	59.94	Not changed

[boris]

Merging after updating the ENS subnames