Add role on L2

scripts/bootstrap/.env.example

@@ -44,9 +44,13 @@ PASSPORT_NONCE_RESERVER_FUND=
 ## The maximum amount of IMX that can be deposited to L2, unit is in IMX or 10^18 Wei.
 IMX_DEPOSIT_LIMIT=
 ## The privileged transaction Multisig address on the root chain.
-PRIVILEGED_ROOT_MULTISIG_ADDR=
-# The pauser address on the root chain.
-ROOT_PAUSER_ADDR=
+ROOT_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the root chain.
+ROOT_BREAKGLASS_ADDR=
+## The privileged transaction Multisig address on the child chain.
+CHILD_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the child chain.
+CHILD_BREAKGLASS_ADDR=
 ## The capacity of the rate limit policy of IMX token, unit is in 10^18.
 RATE_LIMIT_IMX_CAPACITY=
 ## The refill rate of the rate limit policy of IMX token, unit is in 10^18.

scripts/bootstrap/9_test_preparation.ts

@@ -13,7 +13,7 @@ async function run() {
     let rootChainID = requireEnv("ROOT_CHAIN_ID");
     let deployerSecret = requireEnv("DEPLOYER_SECRET");
     let testAccountKey = requireEnv("TEST_ACCOUNT_SECRET");
-    let rootMultisigAddr = requireEnv("PRIVILEGED_ROOT_MULTISIG_ADDR");
+    let rootPrivilegedMultisig = requireEnv("ROOT_PRIVILEGED_MULTISIG_ADDR");
 
     // Get deployer address
     const rootProvider = new ethers.providers.JsonRpcProvider(rootRPCURL, Number(rootChainID));
@@ -79,9 +79,9 @@ async function run() {
     await waitForReceipt(resp.hash, rootProvider);
 
     // Print summary
-    console.log("Does multisig have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootMultisigAddr));
+    console.log("Does multisig have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootPrivilegedMultisig));
     console.log("Does deployer have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), deployerAddr));
-    console.log("Does multisig have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootMultisigAddr));
+    console.log("Does multisig have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootPrivilegedMultisig));
     console.log("Does deployer have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), deployerAddr));
 
     console.log("=======End Test Preparation=======");

scripts/bootstrap/README.md

@@ -68,9 +68,13 @@ PASSPORT_NONCE_RESERVER_FUND=
 ## The maximum amount of IMX that can be deposited to L2, unit is in IMX or 10^18 Wei.
 IMX_DEPOSIT_LIMIT=
 ## The privileged transaction Multisig address on the root chain.
-PRIVILEGED_ROOT_MULTISIG_ADDR=
-# The pauser address on the root chain.
-ROOT_PAUSER_ADDR=
+ROOT_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the root chain.
+ROOT_BREAKGLASS_ADDR=
+## The privileged transaction Multisig address on the child chain.
+CHILD_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the child chain.
+CHILD_BREAKGLASS_ADDR=
 ## The capacity of the rate limit policy of IMX token, unit is in 10^18.
 RATE_LIMIT_IMX_CAPACITY=
 ## The refill rate of the rate limit policy of IMX token, unit is in 10^18.

scripts/deploy/.env.example

@@ -43,9 +43,13 @@ PASSPORT_NONCE_RESERVER_FUND=
 ## The maximum amount of IMX that can be deposited to L2, unit is in IMX or 10^18 Wei.
 IMX_DEPOSIT_LIMIT=
 ## The privileged transaction Multisig address on the root chain.
-PRIVILEGED_ROOT_MULTISIG_ADDR=
-# The pauser address on the root chain.
-ROOT_PAUSER_ADDR=
+ROOT_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the root chain.
+ROOT_BREAKGLASS_ADDR=
+## The privileged transaction Multisig address on the child chain.
+CHILD_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the child chain.
+CHILD_BREAKGLASS_ADDR=
 ## The capacity of the rate limit policy of IMX token, unit is in 10^18.
 RATE_LIMIT_IMX_CAPACITY=
 ## The refill rate of the rate limit policy of IMX token, unit is in 10^18.

scripts/deploy/README.md

@@ -57,9 +57,13 @@ PASSPORT_NONCE_RESERVER_FUND=
 ## The maximum amount of IMX that can be deposited to L2, unit is in IMX or 10^18 Wei.
 IMX_DEPOSIT_LIMIT=
 ## The privileged transaction Multisig address on the root chain.
-PRIVILEGED_ROOT_MULTISIG_ADDR=
-# The pauser address on the root chain.
-ROOT_PAUSER_ADDR=
+ROOT_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the root chain.
+ROOT_BREAKGLASS_ADDR=
+## The privileged transaction Multisig address on the child chain.
+CHILD_PRIVILEGED_MULTISIG_ADDR=
+# The break glass signer address on the child chain.
+CHILD_BREAKGLASS_ADDR=
 ## The capacity of the rate limit policy of IMX token, unit is in 10^18.
 RATE_LIMIT_IMX_CAPACITY=
 ## The refill rate of the rate limit policy of IMX token, unit is in 10^18.

scripts/deploy/child_initialisation.ts

@@ -14,6 +14,8 @@ export async function initialiseChildContracts() {
     let childGasServiceAddr = requireEnv("CHILD_GAS_SERVICE_ADDRESS");
     let multisigAddr = requireEnv("MULTISIG_CONTRACT_ADDRESS");
     let rootIMXAddr = requireEnv("ROOT_IMX_ADDR");
+    let childPrivilegedMultisig = requireEnv("CHILD_PRIVILEGED_MULTISIG_ADDR");
+    let childBreakglass = requireEnv("CHILD_BREAKGLASS_ADDR");
 
     // Read from contract file.
     let childContracts = getChildContracts();
@@ -53,10 +55,10 @@ export async function initialiseChildContracts() {
     let [priorityFee, maxFee] = await getFee(childProvider);
     let resp = await childBridge.connect(childDeployerWallet).initialize(
         {
-            defaultAdmin: deployerAddr,
-            pauser: deployerAddr,
-            unpauser: deployerAddr,
-            adaptorManager: deployerAddr,
+            defaultAdmin: childPrivilegedMultisig,
+            pauser: childBreakglass,
+            unpauser: childPrivilegedMultisig,
+            adaptorManager: childPrivilegedMultisig,
             initialDepositor: deployerAddr,
             treasuryManager: multisigAddr,
         },
@@ -77,10 +79,10 @@ export async function initialiseChildContracts() {
     [priorityFee, maxFee] = await getFee(childProvider);
     resp = await childAdaptor.connect(childDeployerWallet).initialize(
         {
-            defaultAdmin: deployerAddr,
-            bridgeManager: deployerAddr,
-            gasServiceManager: deployerAddr,
-            targetManager: deployerAddr,
+            defaultAdmin: childPrivilegedMultisig,
+            bridgeManager: childPrivilegedMultisig,
+            gasServiceManager: childPrivilegedMultisig,
+            targetManager: childPrivilegedMultisig,
         },
         childBridgeAddr,
         rootChainName,

scripts/deploy/root_initialisation.ts

@@ -15,8 +15,8 @@ export async function initialiseRootContracts() {
     let rootIMXAddr = requireEnv("ROOT_IMX_ADDR");
     let rootWETHAddr = requireEnv("ROOT_WETH_ADDR");
     let imxDepositLimit = requireEnv("IMX_DEPOSIT_LIMIT");
-    let rootMultisigAddr = requireEnv("PRIVILEGED_ROOT_MULTISIG_ADDR");
-    let rootPauser = requireEnv("ROOT_PAUSER_ADDR");
+    let rootPrivilegedMultisig = requireEnv("ROOT_PRIVILEGED_MULTISIG_ADDR");
+    let rootBreakglass = requireEnv("ROOT_BREAKGLASS_ADDR");
     let rateLimitIMXCap = requireEnv("RATE_LIMIT_IMX_CAPACITY");
     let rateLimitIMXRefill = requireEnv("RATE_LIMIT_IMX_REFILL_RATE");
     let rateLimitIMXLargeThreshold = requireEnv("RATE_LIMIT_IMX_LARGE_THRESHOLD");
@@ -72,10 +72,10 @@ export async function initialiseRootContracts() {
     let resp = await rootBridge.connect(rootDeployerWallet)["initialize((address,address,address,address,address),address,address,address,address,address,uint256,address)"](
         {
             defaultAdmin: deployerAddr,
-            pauser: rootPauser,
-            unpauser: rootMultisigAddr,
-            variableManager: rootMultisigAddr,
-            adaptorManager: rootMultisigAddr,
+            pauser: rootBreakglass,
+            unpauser: rootPrivilegedMultisig,
+            variableManager: rootPrivilegedMultisig,
+            adaptorManager: rootPrivilegedMultisig,
         },
         rootAdaptorAddr,
         childBridgeAddr,
@@ -156,30 +156,30 @@ export async function initialiseRootContracts() {
 
     // Grant roles
     console.log("Grant RATE_CONTROL_ROLE to multisig...")
-    resp = await rootBridge.connect(rootDeployerWallet).grantRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootMultisigAddr);
+    resp = await rootBridge.connect(rootDeployerWallet).grantRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootPrivilegedMultisig);
     console.log("Transaction submitted: ", JSON.stringify(resp, null, 2));
     await waitForReceipt(resp.hash, rootProvider);
 
     console.log("Grant DEFAULT_ADMIN to multisig...")
-    resp = await rootBridge.connect(rootDeployerWallet).grantRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootMultisigAddr);
+    resp = await rootBridge.connect(rootDeployerWallet).grantRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootPrivilegedMultisig);
     console.log("Transaction submitted: ", JSON.stringify(resp, null, 2));
     await waitForReceipt(resp.hash, rootProvider);
 
     // Print summary
-    console.log("Does multisig have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootMultisigAddr));
+    console.log("Does multisig have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), rootPrivilegedMultisig));
     console.log("Does deployer have DEFAULT_ADMIN: ", await rootBridge.hasRole(await rootBridge.DEFAULT_ADMIN_ROLE(), deployerAddr));
-    console.log("Does multisig have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootMultisigAddr));
+    console.log("Does multisig have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), rootPrivilegedMultisig));
     console.log("Does deployer have RATE_ADMIN: ", await rootBridge.hasRole(utils.keccak256(utils.toUtf8Bytes("RATE")), deployerAddr));
 
     // Initialise root adaptor
     console.log("Initialise root adaptor...");
     let rootAdaptor = getContract("RootAxelarBridgeAdaptor", rootAdaptorAddr, rootProvider);
     resp = await rootAdaptor.connect(rootDeployerWallet).initialize(
         {
-            defaultAdmin: rootMultisigAddr,
-            bridgeManager: rootMultisigAddr,
-            gasServiceManager: rootMultisigAddr,
-            targetManager: rootMultisigAddr,
+            defaultAdmin: rootPrivilegedMultisig,
+            bridgeManager: rootPrivilegedMultisig,
+            gasServiceManager: rootPrivilegedMultisig,
+            targetManager: rootPrivilegedMultisig,
         },
         rootBridgeAddr, 
         childChainName,

scripts/localdev/.env.local

@@ -44,9 +44,13 @@ PASSPORT_NONCE_RESERVER_FUND=100
 ## The maximum amount of IMX that can be deposited to L2, unit is in IMX or 10^18 Wei.
 IMX_DEPOSIT_LIMIT=100000000
 ## The privileged transaction multisig address on the root chain.
-PRIVILEGED_ROOT_MULTISIG_ADDR=0x14dC79964da2C08b23698B3D3cc7Ca32193d9955
-# The pauser address on the root chain.
-ROOT_PAUSER_ADDR=0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f
+ROOT_PRIVILEGED_MULTISIG_ADDR=0x14dC79964da2C08b23698B3D3cc7Ca32193d9955
+# The break glass signer address on the root chain.
+ROOT_BREAKGLASS_ADDR=0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f
+## The privileged transaction Multisig address on the child chain.
+CHILD_PRIVILEGED_MULTISIG_ADDR=0x14dC79964da2C08b23698B3D3cc7Ca32193d9955
+# The break glass signer address on the child chain.
+CHILD_BREAKGLASS_ADDR=0x23618e81E3f5cdF7f54C3d65f7FBc0aBf5B21E8f
 ## The capacity of the rate limit policy of IMX token, unit is in 10^18.
 RATE_LIMIT_IMX_CAPACITY=15516
 ## The refill rate of the rate limit policy of IMX token, unit is in 10^18.