Skip to content

[RewardPool] Revoke approved spender access #92

Description

@Kaylahray

Description

The RewardPool can add approved spender contracts, but it also needs an admin-controlled revoke path so compromised or deprecated spenders can be removed immediately.

User Story

As a Protocol Admin,
I want to revoke a spender's authorization,
so that outdated or compromised contracts can no longer distribute rewards.

Requirements and Context

  • Files: contracts/reward-pool/src/lib.rs, contracts/reward-pool/src/types.rs, contracts/reward-pool/src/test.rs
  • Add remove_approved_spender(env: Env, admin: Address, spender: Address)
  • Require admin auth and stored-admin verification
  • Ensure distribute_reward fails immediately for revoked spenders

Suggested Implementation

// IN FUNCTION: remove_approved_spender(env: Env, admin: Address, spender: Address)
// 1. admin.require_auth();
// 2. verify admin matches stored admin;
// 3. env.storage().persistent().set(&DataKey::Spender(spender), &false);
// 4. emit spender-revoked event.

Acceptance Criteria

  • Revoked spenders can no longer call distribute_reward successfully.
  • Other approved spenders remain unaffected.
  • Revocation is idempotent or otherwise documented clearly.

Submission Guidelines

  • Branch: feat/revoke-approved-spender
  • Depends on: RewardPool add_approved_spender function
  • PR: feat(reward-pool): add approved spender revocation

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions