Add protection to prevent drain of funds after malicious contract upgrade #43
Description
The test_MaliciousUpgradeDrainsFunds is currently failing - when the contract is upgraded with malicious version, all funds may be drained. This situation could happen when the contract owner for example: went rogue, got bribed or CI script for deployment was altered by a hacker.
Impact
Low occurrence, high impact.
To reproduce
- Please checkout f7a328d
- cd waku-rlnv2-contract
- forge test --match-test test_MaliciousUpgradeDrainsFunds -vvvv
Expected behavior
RLN contract should ideally provide guarantee which lowers the risk of a single event leading to drain of funds. Mitigation could be a time lock, multisig, or layered smart contract design which would allow to decouple upgrade with funds manipulation.