Repository navigation
Narrow bond and broker roles; hand deployer admin to the owner - #303
Merged
Greaker merged 1 commit intoSep 28, 2026
Merged
Conversation
BondToken.addController now only makes an address an ERC-1410 controller (an operator over every holder's units); lifecycle rights come from BOND_CONTROLLER_ROLE, granted separately. A new removeController (BOND_ADMIN_ROLE) takes controller status away again. The bond setup script gives BondManager BOND_CONTROLLER_ROLE only, since it moves units solely through BondDvP, and makes BondDvP both a controller and a BOND_CONTROLLER_ROLE holder for settlement, redemption and buyback. Once wiring is done, the deployer key grants DEFAULT_ADMIN_ROLE on BondManager, BondAuction, BondToken and BondDvP (and BOND_ADMIN_ROLE on BondToken) to the Norges Bank owner key and renounces its own, so no deployment-only key keeps admin on the bond contracts while roles can still be rotated. The BondManager constructor now rejects a zero wNOK, controller, auction, bond token or DvP address, not only a zero reserve, adding BondAuctionAddressZero. OrderBook gains a getOrder view, and Broker lets a client revoke only orders placed for that client's own securities wallet (OrderNotOwnedByClient otherwise). The OrderBook script stops granting SUBMIT_ORDER_ROLE to the broker EOAs; only the Broker contracts hold it. The NB Bond API BondToken and BondManager ABIs are refreshed for the new function and errors. Contract reference, security notes and NatSpec pages describe the role shape. Tests: forge 358 passed (new: controller add without lifecycle role, controller removal and its effect on operator transfers, BondManager constructor zero checks in a separate small suite, and cross-client revoke rejection for buy and sell orders); nb-bond-api jest 254 passed.
Greaker
added a commit
that referenced
this pull request
Sep 28, 2026
BondToken.addController now only makes an address an ERC-1410 controller (an operator over every holder's units); lifecycle rights come from BOND_CONTROLLER_ROLE, granted separately. A new removeController (BOND_ADMIN_ROLE) takes controller status away again. The bond setup script gives BondManager BOND_CONTROLLER_ROLE only, since it moves units solely through BondDvP, and makes BondDvP both a controller and a BOND_CONTROLLER_ROLE holder for settlement, redemption and buyback. Once wiring is done, the deployer key grants DEFAULT_ADMIN_ROLE on BondManager, BondAuction, BondToken and BondDvP (and BOND_ADMIN_ROLE on BondToken) to the Norges Bank owner key and renounces its own, so no deployment-only key keeps admin on the bond contracts while roles can still be rotated. The BondManager constructor now rejects a zero wNOK, controller, auction, bond token or DvP address, not only a zero reserve, adding BondAuctionAddressZero. OrderBook gains a getOrder view, and Broker lets a client revoke only orders placed for that client's own securities wallet (OrderNotOwnedByClient otherwise). The OrderBook script stops granting SUBMIT_ORDER_ROLE to the broker EOAs; only the Broker contracts hold it. The NB Bond API BondToken and BondManager ABIs are refreshed for the new function and errors. Contract reference, security notes and NatSpec pages describe the role shape. Tests: forge 358 passed (new: controller add without lifecycle role, controller removal and its effect on operator transfers, BondManager constructor zero checks in a separate small suite, and cross-client revoke rejection for buy and sell orders); nb-bond-api jest 254 passed.
2 of 3 tasks
Greaker
added a commit
that referenced
this pull request
Sep 28, 2026
* Remove the unused BondOrderBook and its factory BondOrderBook and BondOrderBookFactory were never deployed by the sandbox scripts and have no caller in the API or UI. The broker-level venue in the closed-loop settlement plan is meant to replace them, so keeping and maintaining a second, holder-level bond secondary market in source is unused code rather than a supported feature. Both contracts, their test suites and their NatSpec pages are removed. TbdAddressZero and PartitionZero were only raised by the removed contracts and are dropped from Errors; BondTokenAddressZero moves under the BondManager heading. With this change the bond stack no longer imports anything from the private-bank contracts. The contract reference, the contract topology note, the NB Bond API development guide and the active closed-loop settlement plan now state that no on-chain bond secondary venue exists. Tests: forge 347 passed (the 48 removed tests covered only the deleted contracts). * Narrow bond and broker roles; hand deployer admin to the owner (#303) BondToken.addController now only makes an address an ERC-1410 controller (an operator over every holder's units); lifecycle rights come from BOND_CONTROLLER_ROLE, granted separately. A new removeController (BOND_ADMIN_ROLE) takes controller status away again. The bond setup script gives BondManager BOND_CONTROLLER_ROLE only, since it moves units solely through BondDvP, and makes BondDvP both a controller and a BOND_CONTROLLER_ROLE holder for settlement, redemption and buyback. Once wiring is done, the deployer key grants DEFAULT_ADMIN_ROLE on BondManager, BondAuction, BondToken and BondDvP (and BOND_ADMIN_ROLE on BondToken) to the Norges Bank owner key and renounces its own, so no deployment-only key keeps admin on the bond contracts while roles can still be rotated. The BondManager constructor now rejects a zero wNOK, controller, auction, bond token or DvP address, not only a zero reserve, adding BondAuctionAddressZero. OrderBook gains a getOrder view, and Broker lets a client revoke only orders placed for that client's own securities wallet (OrderNotOwnedByClient otherwise). The OrderBook script stops granting SUBMIT_ORDER_ROLE to the broker EOAs; only the Broker contracts hold it. The NB Bond API BondToken and BondManager ABIs are refreshed for the new function and errors. Contract reference, security notes and NatSpec pages describe the role shape. Tests: forge 358 passed (new: controller add without lifecycle role, controller removal and its effect on operator transfers, BondManager constructor zero checks in a separate small suite, and cross-client revoke rejection for buy and sell orders); nb-bond-api jest 254 passed.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
BondToken.addControllernow only makes an address an ERC-1410 controller; lifecycle rights come fromBOND_CONTROLLER_ROLE, granted separately. NewremoveController(BOND_ADMIN_ROLE).BondManagerBOND_CONTROLLER_ROLEonly and makesBondDvPa controller plus role holder for settlement, redemption and buyback. After wiring, the deployer grantsDEFAULT_ADMIN_ROLEon BondManager, BondAuction, BondToken and BondDvP (andBOND_ADMIN_ROLEon BondToken) to the Norges Bank owner key and renounces its own.BondManagerconstructor rejects zero wNOK, controller, auction, bond token and DvP addresses (newBondAuctionAddressZero).OrderBook.getOrderview;Brokerlets a client revoke only orders for that client's own securities wallet (OrderNotOwnedByClient). The OrderBook script grantsSUBMIT_ORDER_ROLEto the Broker contracts only.Stacked on #302 (base
feature/remove-bond-order-book); merge after it.Test plan
cd contracts && forge fmt --check && forge build --sizes && bash ./check-verify-latest-mapping.sh && forge test -vvv(358 passed)cd services/nb-bond-api && npm run lint && npm run format:check && npm test && npm run build(jest 254)python3 scripts/verification/check-public-repo-hygiene.py && python3 scripts/verification/check-markdown-links.py