Skip to content

SECURITY_KEYS.md

Latest commit

 

History

History
63 lines (45 loc) · 3.04 KB

SECURITY_KEYS.md

File metadata and controls

63 lines (45 loc) · 3.04 KB
Raw

Key posture & kill switches

Generic ops guide. Fill addresses from your own deploys — never commit real private keys.

Roles

Role Env Purpose
Deployer DEPLOYER_PRIVATE_KEY Broadcasts deploys; temporary initial owner until multisig accept
Agent AGENT_PRIVATE_KEY / AGENT_ADDRESS Hot key that signs swaps / RFQ
Owner multisig OWNER_MULTISIG_ADDRESS On-chain 2-of-3 MultiSigOwner — PolicyExecutor owner
Owner signers OWNER_SIGNER_{1,2,3}_* EOAs that propose/confirm multisig txs

Never put any of these under NEXT_PUBLIC_*. Do not sync signer private keys to a production host.

Addresses (set after you deploy)

  • PolicyExecutor: NEXT_PUBLIC_POLICY_EXECUTOR_ADDRESS / 0xYOUR_POLICY_EXECUTOR
  • Previous PolicyExecutor (optional migrate): NEXT_PUBLIC_OLD_POLICY_EXECUTOR_ADDRESS
  • MultiSigOwner (2-of-3): OWNER_MULTISIG_ADDRESS / 0xYOUR_MULTISIG
  • Signers: OWNER_SIGNER_1/2/3_ADDRESS in local .env only
  • Threshold: typically 2

Hardening notes

  • Immediate setAgent / setAllowedTarget are removed from bytecode. Allowlist bootstrap is constructor-only (bootstrapTargets[]); later admin changes use queue* + execute* after adminDelay.
  • Vault allowlist is separate: allowedVaults / queueSetAllowedVault / executeSetAllowedVault. ERC-4626 vaults must not be in allowedTargets (that path is for call targets and can drain custodied ERC20s).
  • RFQ sell settlement must call consumeRfqTokenLock after Permit2 pull so tokenAccounted realigns.

Multisig admin runbook

  1. Propose (any signer): MultiSigOwner.submitTransaction(policy, 0, abi.encodeCall(...))
  2. Confirm (second signer): confirmTransaction(txId) until threshold
  3. Execute: executeTransaction(txId)
pnpm exec tsx apps/web/scripts/whitelist-ur-targets.ts
# wait adminDelay (default 1 day)
WHITELIST_PHASE=execute pnpm exec tsx apps/web/scripts/whitelist-ur-targets.ts

Yield routing (Phase 4)

PolicyExecutor exposes depositErc4626 / redeemErc4626 for Morpho VaultV2 yield.

  • USDG (Robinhood Chain): 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168
  • Morpho Steakhouse USDG vault (public third-party): 0xBeEff033F34C046626B8D0A041844C5d1A5409dd
  • Bootstrap the vault via bootstrapVaults[] at deploy (not via allowedTargets).
  • Never gate on maxDeposit / maxMint (VaultV2 often returns 0). Size with previewDeposit / previewRedeem and pass minShares / minAssets.
  • Keep ENABLE_YIELD_ROUTING=false until you deploy an upgraded PolicyExecutor and pass a small deposit/redeem smoke test.

Kill switches

  • User: setPaused(true) on their vault
  • Operator: set ENABLE_UNISWAPX_ROUTING=false to disable RFQ
  • Operator: set ENABLE_YIELD_ROUTING=false to stop yield routing
  • Owner (via 2-of-3): queue setAgent or allowlist changes after delay
  • Session: rotate SESSION_SECRET

Signer hygiene

  • Keep at least two signer keys safe and gas-funded.
  • Prefer hardware / offline storage for signers; agent key is the only hot key on the app host.