Update access control for proxy manager & pool factory
Summary
The final step required to enable the Sigma program is to grant the Sigma committee limited access over two existing contracts - the pool factory and the proxy manager.
Motivation
In order to build out new pools for the Sigma program, we will need many new smart contracts, most of which will likely be used more than once. We already have a system in place for deploying proxies and handling upgrades, but it only allows the Indexed timelock to add new base implementations or approve new pool controllers. Since the purpose of the Sigma program is to speed up the pace of development, we should allow the Sigma committee to execute certain functions on the existing contracts, rather than complicate our architecture by setting up a myriad of new factories.
Access Control Changes
This proposal will transfer ownership of the pool factory and the proxy manager to separate access control contracts. These new contracts simply define a new administrator role, which is then granted access over specific functions. The Indexed timelock will still be the owner of these access control contracts and will have the sole authority to grant and revoke administrator access.
Below are the new privileges that will exist for the admin and owner roles. All admin privileges are shared by the owner.
Proxy Manager
Admin Privileges
- Deploy new one-to-one proxies
- Deploy new many-to-one proxies
- Add new many-to-one implementation contracts
- Grant many-to-one deployment access to contracts
Owner Privileges
- Modify & lock one-to-one proxy implementations
- Modify & lock many-to-one proxy implementations
- Transfer ownership of the proxy manager
- Revoke many-to-one deployment access from contracts
- Grant admin role
- Revoke admin role
Pool Factory
Admin Privileges
- Grant deployment access to contracts.
Owner Privileges
- Revoke deployment access from contracts.
- Grant admin role
- Revoke admin role
- Transfer ownership of the pool factory
Deployments
Pool Factory Access Control
https://etherscan.io/address/0xb8fdBd8D10b394f85F777969564b6D49D6EbAAA2#code
Proxy Manager Access Control
https://etherscan.io/address/0x3D4860d4b7952A3CAD3Accfada61463F15fc0D54#code
For both of these, I deployed the access control contract, added the Sigma committee’s multisig as an administrator, then transferred ownership to the Indexed timelock.