Skip to content

fix(contracts): Check caps, roles and permanent values in a production deploy - #591

Open
ebma wants to merge 3 commits into
mainfrom
fix/deploy-parameter-checks
Open

ebma wants to merge 3 commits into
mainfrom
fix/deploy-parameter-checks

Conversation

@ebma

@ebma ebma commented Oct 27, 2026

Copy link
Copy Markdown
Member

What changes

Without TEST_DEPLOY, the deploy scripts check every parameter before anything is broadcast.

  • Caps: 100 PEN (the smallest migration) ≤ PER_RELEASE_CAP ≤ DAILY_CAP ≤ 3,000,000 PEN (2% of the supply).
  • Roles:
    • a guardian that is neither the deployer nor an attestor
    • four distinct attestors, none of them the deployer
  • Permanent values:
    • EARLIEST_SWEEP_TS not before 2027-03-01 00:00 UTC
    • QUORUM_FLOOR between 100,000 and 1,000,000 PEN
    • PROPOSAL_THRESHOLD between 10,000 and 1,000,000 PEN
  • Docs:
    • The example environment and the security overview carry the soft-launch caps of 500,000 PEN per release and 1,000,000 PEN per day.
    • The example sets PROPOSAL_THRESHOLD to 50,000 PEN.
    • The contracts README gains a "Deployment parameters" section describing the checks.

Testing

  • forge test (45 pass).

ebma added 3 commits October 27, 2026 12:06
…ploy

Deploy.s.sol checked only the permanent values. Without TEST_DEPLOY it
now also requires 100 PEN (the smallest migration) <= PER_RELEASE_CAP
<= DAILY_CAP <= 3M PEN (2% of the supply), a guardian that is neither
the deployer nor an attestor, and four distinct attestors none of which
is the deployer, all before anything is broadcast.

The example environment and the security overview now carry the soft
launch caps of 500,000 PEN per release and 1,000,000 PEN per day.
…nges

The checks on EARLIEST_SWEEP_TS, QUORUM_FLOOR and PROPOSAL_THRESHOLD
caught units slips but let a zeros slip or a superseded date through.
Without TEST_DEPLOY the scripts now also refuse a sweep floor before
2027-03-01 00:00 UTC, a quorum floor outside 100,000 to 1,000,000 PEN
and a proposal threshold outside 10,000 to 1,000,000 PEN: the floor is
immutable, and a threshold no holder reaches could only be lowered by a
proposal nobody can make.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant