Problem Statement
The contract's admin can change FeeRecipient to any address. If an
attacker compromises the admin key, they can route every future tip's
fee to themselves. The current test suite asserts happy-path
set_fee_recipient but does not model the post-compromise runbook.
Why it matters
A compromised admin key is the highest-impact attack on a tip jar of
this shape. Without an explicit test that exercises the recovery
sequence, the runbook documented in #115 cannot be validated.
Technical Context
set_fee_recipient(caller, fee_recipient) is admin-gated.- Recovery: pause \u2192 rotate admin \u2192 change fee recipient \u2192 unpause.
Expected Outcome
A test test_fee_recipient_compromise_response_runbook that:
- Sets up a normal-creator scenario with active tips.
- Asserts unauthorized
set_fee_recipient panics with #71.
- Verifies the recovery sequence: pause by current admin, change
fee_recipient back to a safe address, verify future tips route
correctly.
Acceptance Criteria
Files/Modules Likely Affected
src/test.rsdocs/ADMIN_RUNBOOK.md \u2014 add reference
Difficulty Medium. Estimated Effort S.
Labels
area:security, area:testing,
area:admin, priority:high
E. Testing — Unit / Integration
Imported from docs/open-issues-draft.md as draft issue #27 (commit 7becd4b). Original draft-order cross-references in this body have been remapped to current GitHub issue numbers at import time.
Problem Statement
The contract's admin can change
FeeRecipientto any address. If anattacker compromises the admin key, they can route every future tip's
fee to themselves. The current test suite asserts happy-path
set_fee_recipientbut does not model the post-compromise runbook.Why it matters
A compromised admin key is the highest-impact attack on a tip jar of
this shape. Without an explicit test that exercises the recovery
sequence, the runbook documented in #115 cannot be validated.
Technical Context
set_fee_recipient(caller, fee_recipient)is admin-gated.Expected Outcome
A test
test_fee_recipient_compromise_response_runbookthat:set_fee_recipientpanics with#71.fee_recipient back to a safe address, verify future tips route
correctly.
Acceptance Criteria
set_fee_recipientpanics with#71.routes the fee correctly.
docs/ADMIN_RUNBOOK.md.Files/Modules Likely Affected
src/test.rsdocs/ADMIN_RUNBOOK.md\u2014 add referenceDifficulty Medium. Estimated Effort S.
Labels
area:security,area:testing,area:admin,priority:highE. Testing — Unit / Integration
Imported from
docs/open-issues-draft.mdas draft issue #27 (commit7becd4b). Original draft-order cross-references in this body have been remapped to current GitHub issue numbers at import time.