infra Checker does not check expectedConfig.proxyAdmin.owner

[ltyu]

Problem

Currently, in some of the infra Getters, most notably Renzo's we have a config that specifies the existingProxyAdmins:

hyperlane-monorepo/typescript/infra/config/environments/mainnet3/warp/configGetters/getRenzoPZETHWarpConfig.ts

Lines 23 to 41 in 55db270

	const existingProxyAdmins: ChainMap<{ address: string; owner: string }> = {
	ethereum: {
	address: '0x4f4671Ce69c9af15e33eB7Cf6D1358d1B39Af3bF',
	owner: '0xD1e6626310fD54Eceb5b9a51dA2eC329D6D4B68A',
	},
	zircuit: {
	address: '0x8b789B4A56675240c9f0985B467752b870c75711',
	owner: '0x8410927C286A38883BC23721e640F31D3E3E79F8',
	},
	};
	export const getRenzoPZETHWarpConfig = getRenzoWarpConfigGenerator({
	chainsToDeploy: pzEthChainsToDeploy,
	validators: pzEthValidators,
	safes: pzEthSafes,
	xERC20Addresses: pzEthAddresses,
	xERC20Lockbox: pzEthProductionLockbox,
	tokenPrices: pzEthTokenPrices,
	existingProxyAdmins: existingProxyAdmins,

When we run yarn tsx ./scripts/check/check-deploy.ts, the Checker will detect if expectedConfig.proxyAdmin.address has been set, and compare the expected config with onchain address.

Otherwise, it will read the proxyAdmin.owner from onchain and compare to the top-level expectedConfig.owner or ownerOverrides.proxyAdmin.owner.

In short, infra does not validate expectedConfig.proxyAdmin.owner

hyperlane-monorepo/typescript/sdk/src/deploy/HyperlaneAppChecker.ts

Lines 116 to 155 in 55db270

	if (expectedProxyAdminAddress) {
	// config defines an expected ProxyAdmin address, we therefore check if the actual ProxyAdmin address matches the expected one
	if (
	!eqAddress(actualProxyAdminAddress, expectedProxyAdminAddress)
	) {
	this.addViolation({
	type: ViolationType.ProxyAdmin,
	chain,
	name,
	expected: expectedProxyAdminAddress,
	actual: actualProxyAdminAddress,
	proxyAddress: contract.address,
	} as ProxyAdminViolation);
	}
	} else {
	// config does not define an expected ProxyAdmin address, this means that checkOwnership will not be able to check the ownership of the ProxyAdmin contract
	// as it is not explicitly defined in the config. We therefore check the ownership of the ProxyAdmin contract here.
	const actualProxyAdminContract = ProxyAdmin__factory.connect(
	actualProxyAdminAddress,
	provider,
	);
	const actualProxyAdminOwner =
	await actualProxyAdminContract.owner();
	const expectedOwner = this.getOwner(
	owner,
	'proxyAdmin',
	ownableOverrides,
	);
	if (!eqAddress(actualProxyAdminOwner, expectedOwner)) {
	const violation: OwnerViolation = {
	chain,
	name: 'proxyAdmin',
	type: ViolationType.Owner,
	actual: actualProxyAdminOwner,
	expected: expectedOwner,
	contract: actualProxyAdminContract,
	};
	this.addViolation(violation);
	}
	}

Solution

• Consider adding the check into Infra to also validate expectedConfig.proxyAdmin.owner

Nice to have

• Since we have many such cases of proxyAdmin in the config (config.proxyAdmin and config.ownerOverrides.proxyAdmin) that are used in the infra or CLI exclusively, figure out how to unify these.