Repository navigation
feat: add multi-sig confirm_upgrade step for contract upgrades (#1808) - #1855
Merged
yahia008 merged 1 commit intoOct 21, 2026
Conversation
…arCheckMate#1808) A single compromised admin key could previously deploy arbitrary WASM by scheduling and executing an upgrade unilaterally. This change requires a second authorized address to call confirm_upgrade before execute_upgrade can proceed. - Add UpgradeKey::ConfirmedBy storage key (new enum, DataKey is at limit) - Add confirm_upgrade function: records upgrader address, emits event - execute_upgrade now returns UpgradeNotConfirmed (StellarCheckMate#58) if no confirmation - cancel_upgrade now clears any recorded confirmation - Add Error::UpgradeNotConfirmed = 58 - Add 5 new tests and fix test_execute_upgrade_succeeds_after_review_period - Update docs/upgrade-safety.md, docs/security.md, docs/error-codes.md - Update contract-spec.json ABI snapshot and CHANGELOG.md
|
@JONA-DEV-CODE Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #1806
Closes #1808
Closes #1809
Closes #1810
Fixes #1808. A single compromised admin key could previously deploy arbitrary WASM by scheduling and executing an upgrade unilaterally. This PR enforces a two-step multi-sig confirmation requirement for contract upgrades.
Changes
Contract (escrow)
confirm_upgrade(upgrader: Address)— a second authorized address must call this afterschedule_upgradeand beforeexecute_upgrade. The upgrader address is stored under the newUpgradeKey::ConfirmedBystorage key and an(upgrade, confirm)event is emitted.execute_upgrade— now returnsError::UpgradeNotConfirmed(## Add Test: paused contract rejects submit_result #58) if no confirmation is on record.cancel_upgrade— now also clears any recorded confirmation so it cannot carry over to a subsequent upgrade cycle.UpgradeKeyenum — separate#[contracttype]enum (DataKey is at the 50-variant XDR cap) with a singleConfirmedByvariant.Error::UpgradeNotConfirmed = 58— returned byexecute_upgradewhen the multi-sig step has not been completed.Tests
contracts/escrow/src/tests/upgrade.rscovering the confirm_upgrade happy path, rejection when no upgrade is scheduled, event emission, execute_upgrade rejection without confirmation, and cancel_upgrade clearing the confirmation.test_execute_upgrade_succeeds_after_review_periodto callconfirm_upgradebeforeexecute_upgrade.Documentation
docs/upgrade-safety.md— updated lifecycle diagram and procedure to include theconfirm_upgradestep; added "Multi-Sig Confirmation Requirement" section.docs/security.md— added "Contract Upgrade Multi-Sig" section with threat model and recommendations.docs/error-codes.md— added entry for#58 UpgradeNotConfirmedand v0.2.0 changelog entry.contracts/escrow/contract-spec.json— addedconfirm_upgradeto ABI snapshot.CHANGELOG.md,README.md— updated events table and unreleased changelog.Testing
New tests are in
contracts/escrow/src/tests/upgrade.rs.Unrelated issues noticed (not touched)
player_freeze_permissions.rsis referenced inmod.rsbut the file does not exist — pre-existing issue, out of scope.