Skip to content

Fix: oracle contract has no admin rotation mechanism #286

@yahia008

Description

@yahia008

Priority: High
Estimated Time: 1 hour

Description:
The oracle contract's admin address is set once at initialize and cannot be changed. If the oracle service key is compromised, there is no recovery path short of redeploying the contract.

Tasks:

  • Add update_admin(env: Env, new_admin: Address) -> Result<(), Error> requiring current admin auth
  • Update DataKey::Admin with the new address
  • Add test for admin rotation
  • Add test that old admin cannot call submit_result after rotation

Metadata

Metadata

Assignees

No one assigned

    Labels

    Stellar WaveIssues in the Stellar wave programbugSomething isn't workingsecuritySecurity-related issues

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions