Body:
Problem
One Address (BRIDGE_STELLAR_ADMIN_SECRET_KEY per README) has unilateral mint/burn/pause/admin-transfer power. If this key is compromised, an attacker can mint unlimited wPi.
Proposed fix
Replace the single admin Address with a Soroban multisig/policy contract as the admin (M-of-N signer threshold).
Stellar Protocol 27 ("Zipper," live on mainnet since July 10, 2026) added native authentication delegation (CAP-0071) and SOROBAN_CREDENTIALS_ADDRESS_V2 — evaluate using this directly instead of building a custom multisig contract, since it's now a first-class, audited network primitive.
Separate roles: minter, pauser, upgrader/admin — don't let one key do all four.
Acceptance criteria
Admin Address can be a contract address (multisig or delegated account), not just an EOA
Role separation documented and (at minimum) enforced by convention with a written policy, ideally enforced on-chain
Migration plan written for moving existing testnet deployments to the new admin model
Body:
Problem
One Address (BRIDGE_STELLAR_ADMIN_SECRET_KEY per README) has unilateral mint/burn/pause/admin-transfer power. If this key is compromised, an attacker can mint unlimited wPi.
Proposed fix
Replace the single admin Address with a Soroban multisig/policy contract as the admin (M-of-N signer threshold).
Stellar Protocol 27 ("Zipper," live on mainnet since July 10, 2026) added native authentication delegation (CAP-0071) and SOROBAN_CREDENTIALS_ADDRESS_V2 — evaluate using this directly instead of building a custom multisig contract, since it's now a first-class, audited network primitive.
Separate roles: minter, pauser, upgrader/admin — don't let one key do all four.
Acceptance criteria
Admin Address can be a contract address (multisig or delegated account), not just an EOA
Role separation documented and (at minimum) enforced by convention with a written policy, ideally enforced on-chain
Migration plan written for moving existing testnet deployments to the new admin model