feat: Add transfer admin role workflow and scripts for multi-chain su…

.github/workflows/transfer-admin.yml

@@ -0,0 +1,41 @@
+name: Transfer Admin Role
+
+on:
+  workflow_dispatch:
+    inputs:
+      network:
+        description: 'Network to transfer admin role on'
+        required: true
+        type: choice
+        options:
+          - ethereum
+          - arbitrum
+          - sepolia
+          - arbitrum_sepolia
+        default: sepolia
+
+jobs:
+  transfer-admin:
+    needs: build-and-test
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.network }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: stable
+          cache: true
+
+      - name: Transfer admin role
+        env:
+          ADMIN_PRIVATE_KEY: ${{ secrets.ADMIN_PRIVATE_KEY }}
+          CHAIN: ${{ inputs.network }}
+          RPC_URL: ${{ secrets.RPC_URL }}
+          NEW_ADMIN: ${{ vars.NEW_ADMIN_ADDRESS }}
+        run: |
+          make transfer-admin-single-chain

Makefile

@@ -193,3 +193,26 @@ send-tokens-to-ethereum-mainnet:
 		--account $(ACCOUNT) \
 		--broadcast \
 		-vvv
+
+#
+# Admin role transfer operations
+#
+
+# Transfer admin role for a single chain
+transfer-admin-single-chain: # CHAIN, RPC_URL, NEW_ADMIN
+	@echo "Transferring admin role on $(CHAIN) to: $(NEW_ADMIN)"
+	CHAIN=$(CHAIN) forge script script/TransferAdminRole.s.sol:TransferAdminRole \
+		--rpc-url $(RPC_URL) \
+		$$(if [ "$(CI)" = "true" ]; then echo "--private-key $(ADMIN_PRIVATE_KEY)"; else echo "--account $(ACCOUNT)"; fi) \
+		--broadcast \
+		--sig "run(address)" $(NEW_ADMIN) \
+		-vvv
+
+# Accept admin role for a single chain (run by new admin)
+accept-admin-single-chain: # CHAIN, RPC_URL
+	@echo "Accepting admin role on $(CHAIN)"
+	CHAIN=$(CHAIN) forge script script/TransferAdminRole.s.sol:AcceptAdminRole \
+		--rpc-url $(RPC_URL) \
+		$$(if [ "$(CI)" = "true" ]; then echo "--private-key $(NEW_ADMIN_PRIVATE_KEY)"; else echo "--account $(ACCOUNT)"; fi) \
+		--broadcast \
+		-vvv

script/TransferAdminRole.s.sol

@@ -0,0 +1,155 @@
+// SPDX-FileCopyrightText: 2025 IEXEC BLOCKCHAIN TECH <contact@iex.ec>
+// SPDX-License-Identifier: Apache-2.0
+
+pragma solidity ^0.8.22;
+
+import {Script} from "forge-std/Script.sol";
+import {console} from "forge-std/console.sol";
+import {AccessControlDefaultAdminRulesUpgradeable} from
+    "@openzeppelin/contracts-upgradeable/access/extensions/AccessControlDefaultAdminRulesUpgradeable.sol";
+import {ConfigLib} from "./lib/ConfigLib.sol";
+import {RLCLiquidityUnifier} from "../src/RLCLiquidityUnifier.sol";
+import {RLCCrosschainToken} from "../src/RLCCrosschainToken.sol";
+import {IexecLayerZeroBridge} from "../src/bridges/layerZero/IexecLayerZeroBridge.sol";
+
+/**
+ * @title TransferAdminRole
+ * @dev Script to transfer the default admin role to a new admin address
+ * for all deployed smart contracts on the current chain.
+ */
+contract TransferAdminRole is Script {
+    /**
+     * @notice Transfers the default admin role to a new admin for all contracts on the current chain
+     * @param newAdmin The address that will become the new default admin
+     * @dev This function automatically detects which contracts are deployed on the current chain
+     * based on the configuration and transfers admin roles accordingly
+     */
+    function run(address newAdmin) external {
+        require(newAdmin != address(0), "TransferAdminRole: New admin cannot be zero address");
+
+        string memory chain = vm.envString("CHAIN");
+        console.log("Starting admin role transfer on chain:", chain);
+        console.log("New admin address:", newAdmin);
+
+        ConfigLib.CommonConfigParams memory params = ConfigLib.readCommonConfig(chain);
+
+        vm.startBroadcast();
+        if (params.approvalRequired) {
+            transferRLCLiquidityUnifierAdmin(params.rlcLiquidityUnifierAddress, newAdmin);
+        } else {
+            transferRLCCrosschainTokenAdmin(params.rlcCrosschainTokenAddress, newAdmin);
+        }
+        transferIexecLayerZeroBridgeAdmin(params.iexecLayerZeroBridgeAddress, newAdmin);
+        vm.stopBroadcast();
+    }
+
+    /**
+     * @notice Transfers admin role for RLCLiquidityUnifier contract
+     * @param contractAddress The address of the RLCLiquidityUnifier contract
+     * @param newAdmin The new admin address
+     */
+    function transferRLCLiquidityUnifierAdmin(address contractAddress, address newAdmin) internal {
+        RLCLiquidityUnifier liquidityUnifier = RLCLiquidityUnifier(contractAddress);
+
+        address currentAdmin = liquidityUnifier.owner();
+        console.log("Current admin:", currentAdmin);
+
+        liquidityUnifier.beginDefaultAdminTransfer(newAdmin);
+        console.log("Admin transfer initiated for RLCLiquidityUnifier at:", contractAddress);
+    }
+
+    /**
+     * @notice Transfers admin role for RLCCrosschainToken contract
+     * @param contractAddress The address of the RLCCrosschainToken contract
+     * @param newAdmin The new admin address
+     */
+    function transferRLCCrosschainTokenAdmin(address contractAddress, address newAdmin) internal {
+        RLCCrosschainToken crosschainToken = RLCCrosschainToken(contractAddress);
+
+        address currentAdmin = crosschainToken.owner();
+        console.log("Current admin:", currentAdmin);
+
+        crosschainToken.beginDefaultAdminTransfer(newAdmin);
+        console.log("Admin transfer initiated for RLCCrosschainToken at:", contractAddress);
+    }
+
+    /**
+     * @notice Transfers admin role for IexecLayerZeroBridge contract
+     * @param contractAddress The address of the IexecLayerZeroBridge contract
+     * @param newAdmin The new admin address
+     */
+    function transferIexecLayerZeroBridgeAdmin(address contractAddress, address newAdmin) internal {
+        IexecLayerZeroBridge bridge = IexecLayerZeroBridge(contractAddress);
+
+        address currentAdmin = bridge.owner();
+        console.log("Current admin:", currentAdmin);
+
+        bridge.beginDefaultAdminTransfer(newAdmin);
+        console.log("Admin transfer initiated for IexecLayerZeroBridge at:", contractAddress);
+    }
+}
+
+/**
+ * @title AcceptAdminRole
+ * @dev Script to accept the default admin role transfer for all contracts on the current chain.
+ * This script should be run by the new admin after the TransferAdminRole script has been executed.
+ */
+contract AcceptAdminRole is Script {
+    /**
+     * @notice Accepts the default admin role transfer for all contracts on the current chain
+     * @dev This function should be called by the new admin to complete the transfer process
+     */
+    function run() external {
+        string memory chain = vm.envString("CHAIN");
+        console.log("Accepting admin role transfer on chain:", chain);
+        ConfigLib.CommonConfigParams memory params = ConfigLib.readCommonConfig(chain);
+
+        vm.startBroadcast();
+        if (params.approvalRequired) {
+            acceptRLCLiquidityUnifierAdmin(params.rlcLiquidityUnifierAddress);
+        } else {
+            acceptRLCCrosschainTokenAdmin(params.rlcCrosschainTokenAddress);
+        }
+        acceptIexecLayerZeroBridgeAdmin(params.iexecLayerZeroBridgeAddress);
+        vm.stopBroadcast();
+    }
+
+    /**
+     * @notice Accepts admin role for RLCLiquidityUnifier contract
+     * @param contractAddress The address of the RLCLiquidityUnifier contract
+     */
+    function acceptRLCLiquidityUnifierAdmin(address contractAddress) internal {
+        console.log("Accepting admin role for RLCLiquidityUnifier at:", contractAddress);
+
+        RLCLiquidityUnifier liquidityUnifier = RLCLiquidityUnifier(contractAddress);
+
+        liquidityUnifier.acceptDefaultAdminTransfer();
+        console.log("New admin:", liquidityUnifier.owner());
+    }
+
+    /**
+     * @notice Accepts admin role for RLCCrosschainToken contract
+     * @param contractAddress The address of the RLCCrosschainToken contract
+     */
+    function acceptRLCCrosschainTokenAdmin(address contractAddress) internal {
+        console.log("Accepting admin role for RLCCrosschainToken at:", contractAddress);
+
+        RLCCrosschainToken crosschainToken = RLCCrosschainToken(contractAddress);
+
+        crosschainToken.acceptDefaultAdminTransfer();
+        console.log("New admin:", crosschainToken.owner());
+    }
+
+    /**
+     * @notice Accepts admin role for IexecLayerZeroBridge contract
+     * @param contractAddress The address of the IexecLayerZeroBridge contract
+     */
+    function acceptIexecLayerZeroBridgeAdmin(address contractAddress) internal {
+        console.log("Accepting admin role for IexecLayerZeroBridge at:", contractAddress);
+
+        IexecLayerZeroBridge bridge = IexecLayerZeroBridge(contractAddress);
+
+        bridge.acceptDefaultAdminTransfer();
+        console.log("New admin:", bridge.owner());
+    }
+}