feat: migrationAdmin 2-step transfer

Author: deluca-mike

script/DeployBase.sol

@@ -43,15 +43,19 @@ contract DeployBase {
         // Wrapped M Token Implementation constructor needs `earnerManagerProxy_`.
         // Wrapped M Token Proxy constructor needs `wrappedMTokenImplementation_`.
 
-        earnerManagerImplementation_ = address(new EarnerManager(registrar_, earnerManagerMigrationAdmin_));
+        earnerManagerImplementation_ = address(new EarnerManager(registrar_));
 
         earnerManagerProxy_ = address(new Proxy(earnerManagerImplementation_));
 
+        EarnerManager(earnerManagerProxy_).initialize(earnerManagerMigrationAdmin_);
+
         wrappedMTokenImplementation_ = address(
-            new WrappedMToken(mToken_, registrar_, earnerManagerProxy_, excessDestination_, wrappedMMigrationAdmin_)
+            new WrappedMToken(mToken_, registrar_, earnerManagerProxy_, excessDestination_)
         );
 
         wrappedMTokenProxy_ = address(new Proxy(wrappedMTokenImplementation_));
+
+        WrappedMToken(wrappedMTokenProxy_).initialize(wrappedMMigrationAdmin_);
     }
 
     /**
@@ -88,15 +92,19 @@ contract DeployBase {
         // Wrapped M Token Implementation constructor needs `earnerManagerProxy_`.
         // Migrator needs `wrappedMTokenImplementation_` addresses.
 
-        earnerManagerImplementation_ = address(new EarnerManager(registrar_, earnerManagerMigrationAdmin_));
+        earnerManagerImplementation_ = address(new EarnerManager(registrar_));
 
         earnerManagerProxy_ = address(new Proxy(earnerManagerImplementation_));
 
+        EarnerManager(earnerManagerProxy_).initialize(earnerManagerMigrationAdmin_);
+
         wrappedMTokenImplementation_ = address(
-            new WrappedMToken(mToken_, registrar_, earnerManagerProxy_, excessDestination_, wrappedMMigrationAdmin_)
+            new WrappedMToken(mToken_, registrar_, earnerManagerProxy_, excessDestination_)
         );
 
-        wrappedMTokenMigrator_ = address(new WrappedMTokenMigratorV1(wrappedMTokenImplementation_, earners_));
+        wrappedMTokenMigrator_ = address(
+            new WrappedMTokenMigratorV1(wrappedMTokenImplementation_, earners_, wrappedMMigrationAdmin_)
+        );
     }
 
     /**

src/EarnerManager.sol

@@ -39,29 +39,49 @@ contract EarnerManager is IEarnerManager, Migratable {
     /// @inheritdoc IEarnerManager
     address public immutable registrar;
 
+    /// @dev Used to check if the contract is the implementation or a proxy.
+    address internal immutable _self = address(this);
+
+    /// @inheritdoc IEarnerManager
+    address public migrationAdmin;
+
     /// @inheritdoc IEarnerManager
-    address public immutable migrationAdmin;
+    address public pendingMigrationAdmin;
 
     /// @dev Mapping of account to earner details.
     mapping(address account => EarnerDetails earnerDetails) internal _earnerDetails;
 
     /* ============ Modifiers ============ */
 
+    modifier onlyMigrationAdmin() {
+        _revertIfNotMigrationAdmin();
+        _;
+    }
+
     modifier onlyAdmin() {
         _revertIfNotAdmin();
         _;
     }
 
-    /* ============ Constructor ============ */
+    /* ============ Constructor and Initializer ============ */
 
     /**
      * @dev   Constructs the contract.
-     * @param registrar_      The address of a Registrar contract.
-     * @param migrationAdmin_ The address of a migration admin.
+     * @param registrar_ The address of a Registrar contract.
      */
-    constructor(address registrar_, address migrationAdmin_) {
+    constructor(address registrar_) {
         if ((registrar = registrar_) == address(0)) revert ZeroRegistrar();
-        if ((migrationAdmin = migrationAdmin_) == address(0)) revert ZeroMigrationAdmin();
+    }
+
+    /**
+     * @dev   Used by a proxy of this implementation to initialize its state.
+     * @param migrationAdmin_ The address of a migration admin.
+     */
+    function initialize(address migrationAdmin_) external {
+        if (address(this) == _self) revert NotProxy();
+        if (migrationAdmin != address(0)) revert AlreadyInitialized();
+
+        _setMigrationAdmin(migrationAdmin_);
     }
 
     /* ============ Interactive Functions ============ */
@@ -95,12 +115,24 @@ contract EarnerManager is IEarnerManager, Migratable {
     /* ============ Temporary Admin Migration ============ */
 
     /// @inheritdoc IEarnerManager
-    function migrate(address migrator_) external {
-        if (msg.sender != migrationAdmin) revert UnauthorizedMigration();
-
+    function migrate(address migrator_) external onlyMigrationAdmin {
         _migrate(migrator_);
     }
 
+    /// @inheritdoc IEarnerManager
+    function setPendingMigrationAdmin(address migrationAdmin_) external onlyMigrationAdmin {
+        emit PendingMigrationAdminSet(pendingMigrationAdmin = migrationAdmin_);
+    }
+
+    /// @inheritdoc IEarnerManager
+    function acceptMigrationAdmin() external {
+        if (msg.sender != pendingMigrationAdmin) revert NotPendingMigrationAdmin();
+
+        _setMigrationAdmin(msg.sender);
+
+        delete pendingMigrationAdmin;
+    }
+
     /* ============ View/Pure Functions ============ */
 
     /// @inheritdoc IEarnerManager
@@ -228,10 +260,13 @@ contract EarnerManager is IEarnerManager, Migratable {
     }
 
     /**
-     * @dev Reverts if the caller is not an admin.
+     * @dev   Sets the migration admin to `migrationAdmin_`.
+     * @param migrationAdmin_ The address of the account to set as the migration admin.
      */
-    function _revertIfNotAdmin() internal view {
-        if (!isAdmin(msg.sender)) revert NotAdmin();
+    function _setMigrationAdmin(address migrationAdmin_) internal {
+        if ((migrationAdmin = migrationAdmin_) == address(0)) revert ZeroMigrationAdmin();
+
+        emit MigrationAdminSet(migrationAdmin_);
     }
 
     /* ============ Internal View/Pure Functions ============ */
@@ -255,4 +290,16 @@ contract EarnerManager is IEarnerManager, Migratable {
     function _isValidAdmin(address admin_) internal view returns (bool isValidAdmin_) {
         return (admin_ != address(0)) && isAdmin(admin_);
     }
+
+    /**
+     * @dev Reverts if the caller is not an admin.
+     */
+    function _revertIfNotAdmin() internal view {
+        if (!isAdmin(msg.sender)) revert NotAdmin();
+    }
+
+    /// @dev Reverts if the caller is not the migration admin.
+    function _revertIfNotMigrationAdmin() internal view {
+        if (msg.sender != migrationAdmin) revert NotMigrationAdmin();
+    }
 }

src/WrappedMToken.sol

@@ -71,9 +71,6 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
     /// @inheritdoc IWrappedMToken
     address public immutable earnerManager;
 
-    /// @inheritdoc IWrappedMToken
-    address public immutable migrationAdmin;
-
     /// @inheritdoc IWrappedMToken
     address public immutable mToken;
 
@@ -83,6 +80,9 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
     /// @inheritdoc IWrappedMToken
     address public immutable excessDestination;
 
+    /// @dev Used to check if the contract is the implementation or a proxy.
+    address internal immutable _self = address(this);
+
     /// @inheritdoc IWrappedMToken
     uint112 public totalEarningPrincipal;
 
@@ -100,29 +100,49 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
 
     mapping(address account => address claimRecipient) internal _claimRecipients;
 
-    /* ============ Constructor ============ */
+    /// @inheritdoc IWrappedMToken
+    address public migrationAdmin;
+
+    /// @inheritdoc IWrappedMToken
+    address public pendingMigrationAdmin;
+
+    /* ============ Modifiers ============ */
+
+    modifier onlyMigrationAdmin() {
+        _revertIfNotMigrationAdmin();
+        _;
+    }
+
+    /* ============ Constructor and Initializer ============ */
 
     /**
      * @dev   Constructs the contract given an M Token address and migration admin.
-     *        Note that a proxy will not need to initialize since there are no mutable storage values affected.
      * @param mToken_            The address of an M Token.
      * @param registrar_         The address of a Registrar.
      * @param earnerManager_     The address of an Earner Manager.
      * @param excessDestination_ The address of an excess destination.
-     * @param migrationAdmin_    The address of a migration admin.
      */
     constructor(
         address mToken_,
         address registrar_,
         address earnerManager_,
-        address excessDestination_,
-        address migrationAdmin_
+        address excessDestination_
     ) ERC20Extended("M (Wrapped) by M^0", "wM", 6) {
         if ((mToken = mToken_) == address(0)) revert ZeroMToken();
         if ((registrar = registrar_) == address(0)) revert ZeroRegistrar();
         if ((earnerManager = earnerManager_) == address(0)) revert ZeroEarnerManager();
         if ((excessDestination = excessDestination_) == address(0)) revert ZeroExcessDestination();
-        if ((migrationAdmin = migrationAdmin_) == address(0)) revert ZeroMigrationAdmin();
+    }
+
+    /**
+     * @dev   Used by a proxy of this implementation to initialize its state.
+     * @param migrationAdmin_ The address of a migration admin.
+     */
+    function initialize(address migrationAdmin_) external {
+        if (address(this) == _self) revert NotProxy();
+        if (migrationAdmin != address(0)) revert AlreadyInitialized();
+
+        _setMigrationAdmin(migrationAdmin_);
     }
 
     /* ============ Interactive Functions ============ */
@@ -266,12 +286,24 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
     /* ============ Temporary Admin Migration ============ */
 
     /// @inheritdoc IWrappedMToken
-    function migrate(address migrator_) external {
-        if (msg.sender != migrationAdmin) revert UnauthorizedMigration();
-
+    function migrate(address migrator_) external onlyMigrationAdmin {
         _migrate(migrator_);
     }
 
+    /// @inheritdoc IWrappedMToken
+    function setPendingMigrationAdmin(address migrationAdmin_) external onlyMigrationAdmin {
+        emit PendingMigrationAdminSet(pendingMigrationAdmin = migrationAdmin_);
+    }
+
+    /// @inheritdoc IWrappedMToken
+    function acceptMigrationAdmin() external {
+        if (msg.sender != pendingMigrationAdmin) revert NotPendingMigrationAdmin();
+
+        _setMigrationAdmin(msg.sender);
+
+        delete pendingMigrationAdmin;
+    }
+
     /* ============ View/Pure Functions ============ */
 
     /// @inheritdoc IWrappedMToken
@@ -781,6 +813,16 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
         emit StoppedEarning(account_);
     }
 
+    /**
+     * @dev   Sets the migration admin to `migrationAdmin_`.
+     * @param migrationAdmin_ The address of the account to set as the migration admin.
+     */
+    function _setMigrationAdmin(address migrationAdmin_) internal {
+        if ((migrationAdmin = migrationAdmin_) == address(0)) revert ZeroMigrationAdmin();
+
+        emit MigrationAdminSet(migrationAdmin_);
+    }
+
     /* ============ Internal View/Pure Functions ============ */
 
     /// @dev Returns the current index of the M Token.
@@ -878,6 +920,11 @@ contract WrappedMToken is IWrappedMToken, Migratable, ERC20Extended {
         if (account_ == address(0)) revert InvalidRecipient(account_);
     }
 
+    /// @dev Reverts if the caller is not the migration admin.
+    function _revertIfNotMigrationAdmin() internal view {
+        if (msg.sender != migrationAdmin) revert NotMigrationAdmin();
+    }
+
     /**
      * @dev   Reads the uint128 value at some index of an array of uint128 values whose storage pointer is given,
      *        assuming the index is valid, without wasting gas checking for out-of-bounds errors.

src/WrappedMTokenMigratorV1.sol

@@ -48,15 +48,21 @@ contract WrappedMTokenMigratorV1 {
 
     address public immutable listOfEarnerToMigrate;
 
-    constructor(address newImplementation_, address[] memory earners_) {
-        newImplementation = newImplementation_;
+    address public immutable migrationAdmin;
+
+    constructor(address newImplementation_, address[] memory earners_, address migrationAdmin_) {
+        if ((newImplementation = newImplementation_) == address(0)) revert();
 
         listOfEarnerToMigrate = address(new ListOfEarnersToMigrate(earners_));
+
+        if ((migrationAdmin = migrationAdmin_) == address(0)) revert();
     }
 
     fallback() external virtual {
         _migrateEarners();
 
+        _setMigrationAdmin(migrationAdmin);
+
         address newImplementation_ = newImplementation;
 
         assembly {
@@ -98,4 +104,14 @@ contract WrappedMTokenMigratorV1 {
             accounts_.slot := 6 // `_accounts` is slot 6 in v1.
         }
     }
+
+    /**
+     * @dev   Sets the `migrationAdmin` slot to `migrationAdmin_`.
+     * @param migrationAdmin_ The address of the account to set the `migrationAdmin_` to.
+     */
+    function _setMigrationAdmin(address migrationAdmin_) internal {
+        assembly {
+            sstore(9, migrationAdmin_) // `migrationAdmin` is slot 9 in v2.
+        }
+    }
 }