feat(script): grant new issuer DEPOSIT+WITHDRAW on shared authoriser

[alastairong1]

What

Adds an operational script that authors Safe Tx Builder bundles granting the new issuer EOA 0x3d0CD66EFA66c05d86c3d4316B03eAE87ab9E8aE the DEPOSIT (mint) and WITHDRAW (burn) roles on the live shared authoriser STOX_PROD_AUTHORISER (0x35f9…7456).

Every production receipt vault shares this one authoriser and its role checks are not vault-scoped, so the two grants enable the issuer to mint/burn across every ST0x SFT at once. The pre-flight proves that uniformity against live chain before any bundle is emitted.

Files

• script/20260630-grant-issuer-mint-burn.s.sol — GrantIssuerMintBurn, four entrypoints (grantDeposit()/grantWithdraw() author, verifyDeposit(string)/verifyWithdraw(string) re-derive).
• test/script/20260630-grant-issuer-mint-burn.t.sol — 11 fork tests.
• .github/workflows/grant-issuer-mint-burn-artifact.yaml — CI dry-run + bundle upload.

Approach

Follows the operational-scripts runbook / MigrateMultisigThreshold template: orchestrator pre-flight (LibInvariants.assertAll → Safe config, uniform vault ownership + authoriser, pinned authoriser grants) → idempotency guard → single-tx bundle → canonical SafeTxHash → simulate + post-state assert → artifact emit → n+1 reversibility (revoke).

Three deviations from the runbook (called out for review)

1. Two single-tx bundles, not one batch. LibSafeOps hashes a single SafeTx; the Tx Builder UI MultiSends a multi-tx bundle and signs that, so a 2-tx bundle's per-tx hash would not match what signers verify. The grants are independent (a half-applied state is benign and revocable), so two bundles is the faithful shape. Each grant must be authored in its own forge process — the n+1 check advances the Safe nonce.
2. Dedicated CI workflow, not run-script.yaml. The generalized dispatcher described in the runbook isn't on main (it lives on an unmerged branch). This mirrors main's actual multisig-artifact.yaml pattern.
3. No CHANGELOG entry. The existing operational scripts (MigrateMultisigThreshold, MigrateBeaconOwners) have none, and the runbook's add-a-script checklist doesn't include it. Happy to add one if preferred.

Testing

All 11 fork tests pass against live Base (grantDeposit/grantWithdraw happy path, verify round-trips, inverted pre-flight invariants — already-granted, authoriser grant drift, vault ownership drift, vault authoriser drift — and inverted verify rejections — wrong chainId, wrong role data, wrong target). The live pre-flight passing confirms all 20 vaults share the authoriser, the Safe holds DEPOSIT_ADMIN/WITHDRAW_ADMIN, and grant+revoke both execute.

Operating

Run each --sig separately (CI or locally with RPC_URL_BASE_FORK), grab the SafeTxHash from the ==== TX BUILDER JSON ==== log block, upload each out/grant-issuer-*.json to Safe Tx Builder, cross-check the hash byte-for-byte, then sign. The two grants are independent and can be signed in either order.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9b1d2d4e-0d45-4cd5-a627-4b4b801d4382

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/20260630-grant-issuer-mint-burn

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}