Skip to content

[Contracts] Add transfer_admin so protocol ownership can be rotated #459

@ogazboiz

Description

@ogazboiz

Join the discussion on Telegram

Why this matters

The protocol admin is set once in initialize and is then immutable forever. update_fee_config keeps the existing admin (admin: config.admin) and there is no other entry point that can change it. If the admin key is lost, rotated, or compromised, the protocol can never recover control of the treasury/fee configuration — a serious operational risk for anything heading to mainnet. A standard, authenticated two-field (or two-step) admin transfer closes this gap.

Acceptance criteria

  • Add a transfer_admin(env, current_admin, new_admin) function to contracts/stream_contract/src/lib.rs that requires the current admin's auth, verifies the caller matches the stored admin, and updates ProtocolConfig.admin.
  • Emit an AdminTransferredEvent (contracts/stream_contract/src/events.rs).
  • Reject when the contract is not initialized (NotInitialized) and when the caller is not the admin (NotAdmin).
  • Add unit tests in contracts/stream_contract/src/test.rs: successful transfer, non-admin rejected, and the new admin can subsequently call update_fee_config.

Files to touch

  • contracts/stream_contract/src/lib.rs
  • contracts/stream_contract/src/events.rs
  • contracts/stream_contract/src/test.rs

Out of scope

  • A timelock or multisig admin model (can be layered later).

Metadata

Metadata

Assignees

Labels

Stellar WaveIssues in the Stellar wave programcontractsSmart contract related taskssecuritySecurity related taskssmart-contractSoroban smart contract

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions