Skip to content

[RewardPool] Revoke approved spender access #92

Description

@Kaylahray

Description

The RewardPool can add approved spender contracts, but it also needs an admin-controlled revoke path so compromised or deprecated spenders can be removed immediately.

User Story

As a Protocol Admin,
I want to revoke a spender's authorization,
so that outdated or compromised contracts can no longer distribute rewards.

Requirements and Context

  • Files: contracts/reward-pool/src/lib.rs, contracts/reward-pool/src/types.rs, contracts/reward-pool/src/test.rs
  • Add remove_approved_spender(env: Env, admin: Address, spender: Address)
  • Require admin auth and stored-admin verification
  • Ensure distribute_reward fails immediately for revoked spenders

Suggested Implementation

// IN FUNCTION: remove_approved_spender(env: Env, admin: Address, spender: Address)
// 1. admin.require_auth();
// 2. verify admin matches stored admin;
// 3. env.storage().persistent().set(&DataKey::Spender(spender), &false);
// 4. emit spender-revoked event.

Acceptance Criteria

  • Revoked spenders can no longer call distribute_reward successfully.
  • Other approved spenders remain unaffected.
  • Revocation is idempotent or otherwise documented clearly.

Submission Guidelines

  • Branch: feat/revoke-approved-spender
  • Depends on: RewardPool add_approved_spender function
  • PR: feat(reward-pool): add approved spender revocation

Metadata

Metadata

Assignees

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions