Join the discussion on Telegram
Why this matters
The protocol admin is set once in initialize and is then immutable forever. update_fee_config keeps the existing admin (admin: config.admin) and there is no other entry point that can change it. If the admin key is lost, rotated, or compromised, the protocol can never recover control of the treasury/fee configuration — a serious operational risk for anything heading to mainnet. A standard, authenticated two-field (or two-step) admin transfer closes this gap.
Acceptance criteria
Files to touch
contracts/stream_contract/src/lib.rs
contracts/stream_contract/src/events.rs
contracts/stream_contract/src/test.rs
Out of scope
- A timelock or multisig admin model (can be layered later).
Join the discussion on Telegram
Why this matters
The protocol admin is set once in
initializeand is then immutable forever.update_fee_configkeeps the existing admin (admin: config.admin) and there is no other entry point that can change it. If the admin key is lost, rotated, or compromised, the protocol can never recover control of the treasury/fee configuration — a serious operational risk for anything heading to mainnet. A standard, authenticated two-field (or two-step) admin transfer closes this gap.Acceptance criteria
transfer_admin(env, current_admin, new_admin)function tocontracts/stream_contract/src/lib.rsthat requires the current admin's auth, verifies the caller matches the stored admin, and updatesProtocolConfig.admin.AdminTransferredEvent(contracts/stream_contract/src/events.rs).NotInitialized) and when the caller is not the admin (NotAdmin).contracts/stream_contract/src/test.rs: successful transfer, non-admin rejected, and the new admin can subsequently callupdate_fee_config.Files to touch
contracts/stream_contract/src/lib.rscontracts/stream_contract/src/events.rscontracts/stream_contract/src/test.rsOut of scope