Skip to content

Contract Admin Transfer with Two-Step Handover #528

Description

@Kingsman-99

Description

Directly setting a new admin address risks permanently locking the contract if the wrong address is provided. A two-step handover process — where the incoming admin must accept before the transfer completes — prevents accidental lockout.

Technical Context

Add pending_admin: Option<Address> to storage::instance in contracts/split/src/lib.rs. Add propose_admin_transfer(new_admin: Address) (current admin only) and accept_admin_transfer() (must be called by new_admin with require_auth). Only accept_admin_transfer writes the new admin as the active one. Emit AdminTransferProposed and AdminTransferCompleted from events.rs.

Acceptance Criteria

  • propose_admin_transfer stores the pending admin and emits AdminTransferProposed
  • Only the proposed address can call accept_admin_transfer
  • The current admin remains active until accept_admin_transfer is called
  • A pending transfer can be cancelled by the current admin calling cancel_admin_transfer
  • AdminTransferCompleted(old_admin, new_admin) event is emitted on acceptance
  • All CI checks (cargo build --target wasm32-unknown-unknown, cargo test, cargo clippy) pass and the branch has no merge conflicts

Metadata

Metadata

Assignees

No one assigned

    Labels

    Stellar WaveIssues in the Stellar wave programcomplexity: highComplex feature requiring deep knowledge - 200 ptssecuritySecurity hardening and access control

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions