Splits wpi-token's single admin key

[privexlabs]

Summary

Splits wpi-token's single admin key into four independent, purpose-scoped roles so no one
compromised key can mint, pause, and transfer admin all at once, and documents that any of these
roles can already be a Soroban multisig/policy contract instead of a plain account.

• Minter (new) — gates mint, mint_from_deposit, burn. Rotated only by the current minter
  (set_minter).
• Pauser (new) — gates set_paused. Rotated only by the current pauser (set_pauser).
• Admin (unchanged) — now only gates propose_admin/accept_admin (two-step) and upgrade. No
  longer mints, burns, or pauses directly.
• VolumeLimitAdmin (pre-existing, unchanged) — still gates
  configure_volume_limits/override_volume_limit.

set_minter/set_pauser are self-rotating (like the existing set_volume_limit_admin), not
admin-controlled: if Admin could reassign them at will it would still be a single point of
failure. Existing deployments that predate this change fall back to the live Admin address for
Minter/Pauser until they explicitly rotate (same pattern already used for VolumeLimitAdmin), so
no on-chain migration step is required before upgrading.

Also verified and documented that no contract address handling changes were needed for a
multisig/policy-contract admin — Address/require_auth() already treats accounts and contracts
uniformly, so a Soroban multisig or a Protocol 27 (CAP-0071 / SOROBAN_CREDENTIALS_ADDRESS_V2)
delegated account can already be set as any of these roles. Per the issue's own recommendation,
no new custom multisig contract was added to the repo.

What changed

• Stellar-contracts-v1/wpi-token/src/lib.rs — new Minter/Pauser storage roles,
  minter()/pauser()/set_minter()/set_pauser(), re-gated mint/mint_from_deposit/burn/set_paused.
• Stellar-contracts-v1/wpi-token/src/test.rs — 7 new tests covering role independence, rotation
  self-custody, the pre-existing-deployment migration fallback, and a contract-address-as-admin
  regression test; one pre-existing test updated to reflect that set_paused is no longer
  admin-gated.
• Stellar-contracts-v1/README.md — role table, rotation commands, updated pause/env-var docs.
• docs/design/admin-role-separation.md (new) — design rationale, trust model, and the
  step-by-step migration plan for existing testnet deployments.
• relayer/docs/e2e-testnet-demo.md — clarifies the admin secret key only needs the Minter role.

Testing

• cargo test -p wpi-token: 29/29 passed
• cargo clippy -p wpi-token --all-targets -- -D warnings: clean
• cargo fmt -p wpi-token -- --check: clean
• cargo build -p wpi-token --target wasm32-unknown-unknown --release: succeeds

Resolved / acceptance criteria (Issue #5)

• Admin Address can be a contract address (multisig or delegated account), not just an EOA
• Role separation (minter, pauser, upgrader/admin) documented and enforced on-chain
• Migration plan written for moving existing testnet deployments to the new admin model

Closes #5

[coderabbitai]

Warning

Review limit reached

@privexlabs, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 575ba24f-a6cf-49f0-b65e-10395eaf1fd6

📥 Commits

Reviewing files that changed from the base of the PR and between a4f7a1e and 283d23b.

📒 Files selected for processing (5)

• Stellar-contracts-v1/README.md
• Stellar-contracts-v1/wpi-token/src/lib.rs
• Stellar-contracts-v1/wpi-token/src/test.rs
• docs/design/admin-role-separation.md
• relayer/docs/e2e-testnet-demo.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}