Skip to content

Add adversarial test that a new operator fully supersedes the prior operator's authority #77

Description

@Jagadeeshftw

📌 Description

set_operator(operator) appoints a single operator address (admin-only, per the README's table). When the admin appoints a new operator, the previous operator's ability to call pause/unpause must be fully revoked in the same transaction — there should be no window, and no code path, where both the old and new operator addresses remain independently authorized.

🧩 Requirements and context

  • Add a test: appoint operator A, appoint operator B (replacing A), then assert A can no longer call pause/unpause (rejected) while B can.
  • Confirm operator()/is_operator(address) reads reflect only the current operator, never a stale prior one.
  • No functional change expected unless the test uncovers a real gap.

🛠️ Suggested execution

  • Add the adversarial replace-operator test to src/test.rs using mock_auths to attempt the call as the old operator post-replacement.
  • Fix set_operator/is_operator in src/lib.rs if a gap is found.

✅ Acceptance criteria

  • A superseded operator can no longer call pause/unpause.
  • is_operator never reports a stale prior operator as current.
  • Regression test locks in the guarantee.

🔒 Security notes

Directly verifies there's no privilege-retention window when the operator role changes hands.

📋 Guidelines

  • Minimum 95% test coverage
  • Clear documentation
  • Timeframe: 96 hours

Metadata

Metadata

Assignees

No one assigned

    Labels

    GrantFox OSSGrantFox open-source programMaybe RewardedGrantFox: potentially rewarded contributionOfficial Campaign | FWC26GrantFox official campaign issuesecuritySecurity hardening / audittestingTests and coverage

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions