Component
Other
Priority
P2
Summary
The mainnet deployment should be run by an external party, so who deploys and who holds each role is decided by whoever runs it. The contracts already allow any choice they make: all ten UUPS proxies are upgradeable, every owner is transferable, roles are grantable and revocable, and the protocol registry can re-point any address. Nothing here blocks governance from upgrading or reconfiguring anything.
What the pipeline does not do is let them arrive at that model in one run. owner = msg.sender is hardcoded in DeployCore, DeployPolicy and WireDeployments, nothing ever calls transferOwnership, and WireDeployments._verifyDeployment asserts that every contract's owner is the deployer. So a deployment ends with the deploying key owning ten proxies, the protocol registry and the store factory, and moving that to governance means roughly a dozen manual transfers with nothing checking that none were missed.
The wire stage calls registry.set and grants roles, both onlyOwner, so the deployer has to own everything during deployment. The intended owner can only be assigned at the end.
Proposal
- Add
DOTNS_OWNER, read the way WHITELIST_OPERATOR already is in WireDeployments, defaulting to the deploying account so current behaviour is unchanged.
- Add a final stage that assigns ownership of every proxy, the protocol registry and the store factory to
DOTNS_OWNER, after wiring. A no-op when the value is the deployer.
- Have
_verifyDeployment assert against the configured owner rather than msg.sender
- Decide single-step versus two-step ownership.
OwnableUpgradeable transfers in one call, so a mistyped DOTNS_OWNER permanently destroys upgrade authority on a contract that can then no longer be upgraded to fix it. Ownable2StepUpgradeable makes the new owner accept, which may or may not be worth having when the target is a governance account, at the cost of an accept transaction.
Acceptance criteria
Component
Other
Priority
P2
Summary
The mainnet deployment should be run by an external party, so who deploys and who holds each role is decided by whoever runs it. The contracts already allow any choice they make: all ten UUPS proxies are upgradeable, every owner is transferable, roles are grantable and revocable, and the protocol registry can re-point any address. Nothing here blocks governance from upgrading or reconfiguring anything.
What the pipeline does not do is let them arrive at that model in one run.
owner = msg.senderis hardcoded inDeployCore,DeployPolicyandWireDeployments, nothing ever callstransferOwnership, andWireDeployments._verifyDeploymentasserts that every contract's owner is the deployer. So a deployment ends with the deploying key owning ten proxies, the protocol registry and the store factory, and moving that to governance means roughly a dozen manual transfers with nothing checking that none were missed.The wire stage calls
registry.setand grants roles, bothonlyOwner, so the deployer has to own everything during deployment. The intended owner can only be assigned at the end.Proposal
DOTNS_OWNER, read the wayWHITELIST_OPERATORalready is inWireDeployments, defaulting to the deploying account so current behaviour is unchanged.DOTNS_OWNER, after wiring. A no-op when the value is the deployer._verifyDeploymentassert against the configured owner rather thanmsg.senderOwnableUpgradeabletransfers in one call, so a mistypedDOTNS_OWNERpermanently destroys upgrade authority on a contract that can then no longer be upgraded to fix it.Ownable2StepUpgradeablemakes the new owner accept, which may or may not be worth having when the target is a governance account, at the cost of an accept transaction.Acceptance criteria
DOTNS_OWNERsets the final owner and defaults to the deploying account._verifyDeploymentchecks the configured owner