[Architecture] Admin address has no upgrade path — a compromised admin key permanently compromises all three contracts

[fati-Onchain]

Contract: contracts/payment/src/lib.rs, contracts/escrow/src/lib.rs, contracts/refund/src/lib.rs

Description

Each contract stores a single DataKey::Admin → Address with no rotation mechanism and no multisig support. If the admin private key is compromised, an attacker gains permanent control over all contracts with no on-chain remedy.

Fix

Implement a two-step admin rotation: propose_admin(new_admin) (current admin only) sets DataKey::PendingAdmin, then accept_admin() (new admin only) finalizes the transition. Optionally add an admin_multisig_threshold for M-of-N admin keys.

[Keengfk]

@Keengfk has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I will love to work on this issue,pls 🙏 give me

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Keengfk to this issue.

[Ikechukwu-Patrick]

@Ikechukwu-Patrick has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello Maintainer, I want to work on this task please because i can do it.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ikechukwu-Patrick to this issue.