ECDSA POA - transfer ownership

README.md

@@ -186,4 +186,27 @@ This configuration should be set in the project's **Taskfile** variables:
 USES_MOCK: true
 ```
 
-> Note: Only wavs-drand currently uses mock deployments. Sync services must use real deployments on the source chain, as they rely on EigenLayer core contracts for testing and cannot operate with mocks.
+## Transfer Ownership
+
+After deploying middleware contracts, you may want to transfer ownership of the ECDSA proxy and AVS contracts to different addresses. 
+
+### Configuration
+
+1. **Set owner addresses** in [taskfile/config.yml](taskfile/config.yml):
+   ```yaml
+   AVS_OWNER: "0x1111111111111111111111111111111111111111"
+   PROXY_OWNER: "0x2222222222222222222222222222222222222222"
+   ```
+
+2. **Enable ownership transfer** in your project's **Taskfile**:
+   ```yaml
+   vars:
+     TRANSFER_OWNERSHIP: true
+   ```
+
+When `TRANSFER_OWNERSHIP` is set to `true`, the bootstrap process will automatically transfer ownership after middleware deployment using the addresses configured in config.yml. The system will use the appropriate transfer method based on your deployment mode:
+
+- **Regular deployments**: Uses `middleware:transfer-ownership`
+- **Mock deployments**: Uses `middleware:mock-transfer-ownership` with mock-specific environment variables
+
+If `TRANSFER_OWNERSHIP` is `false` or not set, ownership transfer will be skipped entirely.

projects/multi-chain-operator-sync/Taskfile.yml

@@ -59,6 +59,7 @@ tasks:
         task bootstrap:build-service
         task bootstrap:upload-service
         task bootstrap:set-service-uri
+        task bootstrap:middleware-transfer-ownership
 
   clean:
     desc: "Cleans up the tool"

projects/multi-chain-quorum-sync/Taskfile.yml

@@ -58,6 +58,7 @@ tasks:
         task bootstrap:build-service
         task bootstrap:upload-service
         task bootstrap:set-service-uri
+        task bootstrap:middleware-transfer-ownership
 
   clean:
     desc: "Cleans up the tool"

projects/operator-updater/Taskfile.yml

@@ -33,12 +33,12 @@ vars:
     # project name is same as dir name of current directory
     sh: basename "$(pwd)"
   BLOCK_INTERVAL: 100
-  PAST_BLOCKS: 500
   WAVS_CLI_SERVICE_JSON_PATH: "/wavs-tools/projects/{{.PROJECT}}/.project-output/services/{{.COMPONENT_NAME}}.json"
   PROJECT_OUTPUT_DIR: '{{joinPath .ROOT_DIR ".project-output"}}'
   SERVICE_OUTPUT_DIR: '{{joinPath .PROJECT_OUTPUT_DIR "services"}}'
   SERVICE_JSON_PATH: "{{.SERVICE_OUTPUT_DIR}}/{{.COMPONENT_NAME}}.json"
   TEMP_SERVICE_HASH_JSON_PATH: "{{.SERVICE_OUTPUT_DIR}}/hash.json"
+  TRANSFER_OWNERSHIP: true
 
 tasks:
   bootstrap:
@@ -55,6 +55,7 @@ tasks:
         task bootstrap:register-service
         task bootstrap:deploy-service
         task bootstrap:register-operator
+        task bootstrap:middleware-transfer-ownership
 
   clean:
     desc: "Cleans up the tool"

projects/wavs-drand/Taskfile.yml

@@ -28,7 +28,7 @@ vars:
   # These are all locally defined here, do not depend on config.yml being loaded first
   # For this reason, we sometimes need to redefined vars like .project-output here
   # see: https://github.com/go-task/task/issues/2303
-  # wavs-drand uses MOCK mode
+  # wavs-drand uses MOCK mode since it doesn't rely on any eigenlayer core contractrs
   USES_MOCK: true
   COMPONENT_NAME: "wavs_drand"
   PROJECT:
@@ -41,6 +41,7 @@ vars:
   SERVICE_JSON_PATH: "{{.SERVICE_OUTPUT_DIR}}/{{.COMPONENT_NAME}}.json"
   TEMP_SERVICE_HASH_JSON_PATH: "{{.SERVICE_OUTPUT_DIR}}/hash.json"
   SOURCE_CHAIN_NUMBER: 1
+  TRANSFER_OWNERSHIP: true
 
 tasks:
   bootstrap:
@@ -59,6 +60,7 @@ tasks:
         task bootstrap:deploy-service
         task bootstrap:wavs-all
         task bootstrap:register-operator
+        task bootstrap:middleware-transfer-ownership
 
   clean:
     desc: "Cleans up the tool"

taskfile/common/bootstrap.yml

@@ -48,6 +48,24 @@ tasks:
           cd "{{.REPO_ROOT}}" && task middleware:deploy PROJECT="{{.PROJECT}}" SERVICE_NAME="{{.PROJECT}}" {{.CHAIN_ARG}}
         fi
 
+  middleware-transfer-ownership:
+    desc: "Transfer ownership of ECDSA proxy and AVS contracts (conditional on TRANSFER_OWNERSHIP)"
+    vars:
+      TRANSFER_OWNERSHIP: '{{.TRANSFER_OWNERSHIP | default "false"}}'
+      USES_MOCK: '{{.USES_MOCK | default "false"}}'
+      CHAIN_ARG: "{{if .SOURCE_CHAIN_NUMBER}}CHAIN_NUMBER={{.SOURCE_CHAIN_NUMBER}}{{end}}"
+    requires:
+      vars: [PROJECT, REPO_ROOT, PROXY_OWNER, AVS_OWNER]
+    status:
+      - '[ "{{.TRANSFER_OWNERSHIP}}" != "true" ]'
+    cmds:
+      - |
+        if [ "{{.USES_MOCK}}" = "true" ]; then
+          cd "{{.REPO_ROOT}}" && task middleware:mock-transfer-ownership PROJECT="{{.PROJECT}}" SERVICE_NAME="{{.PROJECT}}" PROXY_OWNER="{{.PROXY_OWNER}}" AVS_OWNER="{{.AVS_OWNER}}" {{.CHAIN_ARG}}
+        else
+          cd "{{.REPO_ROOT}}" && task middleware:transfer-ownership PROJECT="{{.PROJECT}}" SERVICE_NAME="{{.PROJECT}}" PROXY_OWNER="{{.PROXY_OWNER}}" AVS_OWNER="{{.AVS_OWNER}}" {{.CHAIN_ARG}}
+        fi
+
   build-mock-config:
     desc: "Build mock configuration JSON with all active operators"
     vars:

taskfile/config.yml

@@ -46,3 +46,6 @@ vars:
     sh: |
       docker ps --format '{{"{{"}}.Names{{"}}"}}' | grep 'wavs-' | grep -v 'wavs-aggregator' | wc -l | xargs
   SUBMIT_DELAY: '{{ternary 1 5 (eq .DEPLOY_ENV "LOCAL")}}'
+  # Transfer Ownership Config
+  AVS_OWNER: "0x1111111111111111111111111111111111111111"
+  PROXY_OWNER: "0x2222222222222222222222222222222222222222"

taskfile/docker.yml

@@ -2,7 +2,7 @@ version: "3"
 
 vars:
   WAVS_DOCKER_IMAGE: "ghcr.io/lay3rlabs/wavs:94f641f"
-  MIDDLEWARE_DOCKER_IMAGE: "ghcr.io/lay3rlabs/wavs-middleware:0548d44"
+  MIDDLEWARE_DOCKER_IMAGE: "ghcr.io/lay3rlabs/wavs-middleware:d8c1320"
   FOUNDRY_DOCKER_IMAGE: "ghcr.io/foundry-rs/foundry:latest"
   JAEGER_DOCKER_IMAGE: "jaegertracing/jaeger:2.5.0"
   PROMETHEUS_DOCKER_IMAGE: "prom/prometheus:v3.3.0"

taskfile/middleware.yml

@@ -450,3 +450,69 @@ tasks:
       CHAIN_ID: "{{.CHAIN_ID | default .MIDDLEWARE_CHAIN_ID}}"
     cmds:
       - sh -c 'jq -r ".addresses.strategyManager" "node_modules/@wavs/solidity/contracts/deployments/eigenlayer-core/{{.CHAIN_ID}}.json" 2>/dev/null || true'
+
+  transfer-ownership:
+    desc: "Transfer ownership of ECDSA proxy and AVS contracts"
+    vars:
+      CHAIN_NUMBER: '{{.CHAIN_NUMBER | default "1"}}'
+      NODES_DIR:
+        sh: task middleware:get-output-dir CHAIN_NUMBER={{.CHAIN_NUMBER}} PROJECT={{.PROJECT}} SERVICE_NAME={{.SERVICE_NAME}}
+    requires:
+      vars: [PROJECT, SERVICE_NAME, PROXY_OWNER, AVS_OWNER]
+    env:
+      RPC_URL:
+        sh: task backend:get-evm-rpc-url-{{.CHAIN_NUMBER}}
+      WAVS_SERVICE_MANAGER_ADDRESS:
+        sh: task middleware:get-service-manager-address CHAIN_NUMBER={{.CHAIN_NUMBER}} PROJECT={{.PROJECT}} SERVICE_NAME={{.SERVICE_NAME}}
+      PROXY_OWNER: "{{.PROXY_OWNER}}"
+      AVS_OWNER: "{{.AVS_OWNER}}"
+      FUNDED_KEY: "{{.DEPLOYER_PRIVATE_KEY}}"
+    preconditions:
+      - sh: cast to-checksum {{.AVS_OWNER}}
+        msg: AVS_OWNER is not a valid address
+      - sh: cast to-checksum {{.PROXY_OWNER}}
+        msg: PROXY_OWNER is not a valid address
+    cmds:
+      - >
+        {{.DOCKER_SUDO}} docker run --rm --network host
+        -e DEPLOY_ENV
+        -e RPC_URL
+        -e WAVS_SERVICE_MANAGER_ADDRESS
+        -e PROXY_OWNER
+        -e AVS_OWNER
+        -e FUNDED_KEY
+        -v {{.NODES_DIR}}:/root/.nodes
+        {{.MIDDLEWARE_DOCKER_IMAGE}} transfer_ownership
+
+  mock-transfer-ownership:
+    desc: "Transfer ownership of mock ECDSA proxy and AVS contracts"
+    vars:
+      CHAIN_NUMBER: '{{.CHAIN_NUMBER | default "1"}}'
+      NODES_DIR:
+        sh: task middleware:get-output-dir CHAIN_NUMBER={{.CHAIN_NUMBER}} PROJECT={{.PROJECT}} SERVICE_NAME={{.SERVICE_NAME}}
+    requires:
+      vars: [PROJECT, SERVICE_NAME, PROXY_OWNER, AVS_OWNER]
+    env:
+      MOCK_RPC_URL:
+        sh: task backend:get-evm-rpc-url-{{.CHAIN_NUMBER}}
+      WAVS_SERVICE_MANAGER_ADDRESS:
+        sh: task middleware:get-service-manager-address CHAIN_NUMBER={{.CHAIN_NUMBER}} PROJECT={{.PROJECT}} SERVICE_NAME={{.SERVICE_NAME}}
+      PROXY_OWNER: "{{.PROXY_OWNER}}"
+      AVS_OWNER: "{{.AVS_OWNER}}"
+      MOCK_DEPLOYER_KEY: "{{.DEPLOYER_PRIVATE_KEY}}"
+    preconditions:
+      - sh: cast to-checksum {{.AVS_OWNER}}
+        msg: AVS_OWNER is not a valid address
+      - sh: cast to-checksum {{.PROXY_OWNER}}
+        msg: PROXY_OWNER is not a valid address
+    cmds:
+      - >
+        {{.DOCKER_SUDO}} docker run --rm --network host
+        -e DEPLOY_ENV
+        -e MOCK_RPC_URL
+        -e WAVS_SERVICE_MANAGER_ADDRESS
+        -e PROXY_OWNER
+        -e AVS_OWNER
+        -e MOCK_DEPLOYER_KEY
+        -v {{.NODES_DIR}}:/root/.nodes
+        {{.MIDDLEWARE_DOCKER_IMAGE}} -m mock transfer_ownership