feat: add script to manage super admin - #16
Conversation
| deployOwnerVerifier = vm.envOr("DEPLOY_ADMIN_VERIFIER_OWNER", false); | ||
| deployWhitelistVerifier = vm.envOr("DEPLOY_ADMIN_VERIFIER_WHITELIST", false); | ||
| whitelistAdmin = vm.envOr("ADMIN_VERIFIER_WHITELIST_ADMIN_ADDRESS", address(0)); | ||
| deploySuperAdminVerifier = vm.envOr("DEPLOY_ADMIN_VERIFIER_SUPER_ADMIN", false); |
There was a problem hiding this comment.
The new flag is never included in the count or either deployment branch, so enabling it has no effect on run and the proxy is initialized without this verifier. Can we add the super admin verifier to the array construction and cover the enabled path?
| /// ```bash | ||
| /// STATE_ORACLE_ADDRESS=0xOracle \ | ||
| /// ADMIN_VERIFIER_TO_ADD=0xVerifier \ | ||
| /// forge script script/ManageAdminVerifiers.s.sol --broadcast --rpc-url $RPC_URL |
There was a problem hiding this comment.
The documented command invokes Foundry's default run entrypoint, but this contract has no run function and never reads the listed environment variables. As written, the example cannot add or remove anything. Can we add a configured entrypoint or document the explicit function signature and arguments instead?
| _deployWhitelistAdminVerifier(); | ||
| } | ||
|
|
||
| function deploySuperAdminAdminVerifier() public broadcast { |
There was a problem hiding this comment.
This adds a universal verifier to the normal production script with no testing guard. Anyone holding superAdmin is accepted as the admin for every adopter, so one configuration mistake creates a protocol wide bypass. Please keep this verifier in a test only deployment script instead of the production path.
b88b7fb to
619e6bb
Compare
2 participants
Resolves ENG-4674