Owner override for manager rotation: reclaim authority from a dark/lost-key manager

[0xdevcollins]

Contract · boundless-events · follow-up to #70 / #88 · P1

Context

#88 fixes #70 by making manager delegation two-step (propose_manager → accept_manager), so a never-authorized address can no longer gain or lock event control. That closes the reported vulnerability.

Remaining gap (out of #70's scope)

Once a manager has accepted, resolve_manager returns that manager, so only the manager — not the owner — can propose_manager or cancel_pending_manager thereafter (both gate on resolve_manager(...).require_auth()). If that accepted manager later loses its key or goes dark, the owner cannot reclaim rotation authority, while the manager still holds select_winners / cancel authority over the escrow.

This is pre-existing behavior — the old set_manager had the same manager-only-rotation property once a manager was set — and it is not a regression introduced by #88. It is a distinct "delegated authority can get stuck" case that the two-step flow does not address.

Proposed change

Let the owner always retain override authority over manager rotation, so the funder can reclaim a delegated event:

• Allow propose_manager and cancel_pending_manager to be authorized by the owner OR the current manager, rather than resolve_manager alone (which resolves to the manager once set).
• accept_manager stays as-is: the proposed target must sign, so this does not weaken the acceptance guarantee.

Design questions (decide before implementing)

• Owner override is a deliberate authority-model choice: it lets an owner unilaterally yank a legitimately delegated manager. Confirm that is desired (it usually is for a funder-owned escrow, but it is a policy call).
• Consider whether owner override should also be able to clear a stuck/active manager back to owner-default (not just re-propose), e.g. an owner-only reset_manager that removes the manager key so resolve_manager falls back to the owner. That is the actual "unstick" primitive; re-propose still needs a new party to accept.
• No new error variants — the enum is at the 50-case cap (see BACKLOG / fix(events): cap per-event hackathon submissions to bound storage growth #86 / fix(events): require acceptance for manager delegation (#70) #88). Reuse existing rotation errors.

Notes

• Not blocking fix(events): require acceptance for manager delegation (#70) #88. File under P1.
• Any change here is a public-surface/authority change: version-bump and coordinate with the backend (see boundlessfi/boundless-nestjs#451).

[coderabbitai]

🔗 Related PRs

#78 - test(admin): assert admin auth is actually required, not just mocked [merged]
#83 - feat(events): replace push-based select_winners with pull-model claim_prize for unlimited winners [open]
#88 - fix(events): require acceptance for manager delegation (#70) [open]
#90 - feat(events): pull-model prize claims for Single-release events [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[Whiznificent]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery

[Okorie2000-code]

Hi Maintainer, I'd love to work on this issue. I understand the requirements and will submit a clean, well-tested PR within 24hrs. Please assign it to me

[spiffamani]

I'm a full-stack Software Engineer
I'd love to take this on — thanks for considering me

[adesuwa-tech]

Hi maintener, i would love to work one this issue, i already reviewed the description and will submit a clean PR, please kindly assign

[Kenisank]

Hi maintainer, I would like to solve this issue

[nurudeenheroic]

Hi! I can handle this issue and ensure it meets the requirements.I'd be happy to contribute and deliver a reliable solution.
@maintainer please assign this to me

[bernardev254]

I’d like to address the gap in #88 by ensuring owners retain override authority for manager rotation in boundless-events. This involves allowing propose_manager and cancel_pending_manager to be authorized by the owner or current manager, while keeping accept_manager unchanged. I’ll also explore adding an owner-only reset_manager to clear stuck managers. Let me know if this aligns with your priorities.