[eth] Remove ownership entirely in favor of governance (#405)

Author: ali-behjati

ethereum/.env.template

@@ -19,4 +19,5 @@ PYTHNET_CHAIN_ID= # 0x1a
 PYTHNET_EMITTER= # 0xa27839d641b07743c0cb5f68c51f8cd31d2c0762bec00dc6fcd25433ef1ab5b6
 GOVERNANCE_CHAIN_ID= # 0x1
 GOVERNANCE_EMITTER= # 0x63278d271099bfd491951b3e648f08b1c71631e4a53674ad43e8f9f98068c385
+GOVERNANCE_INITIAL_SEQUENCE=0 # This is optional and default is 0
 SINGLE_UPDATE_FEE_IN_WEI=0

ethereum/contracts/pyth/Pyth.sol

@@ -17,6 +17,9 @@ abstract contract Pyth is PythGetters, PythSetters, AbstractPyth {
         address wormhole,
         uint16[] calldata dataSourceEmitterChainIds,
         bytes32[] calldata dataSourceEmitterAddresses,
+        uint16 governanceEmitterChainId,
+        bytes32 governanceEmitterAddress,
+        uint64 governanceInitialSequence,
         uint validTimePeriodSeconds,
         uint singleUpdateFeeInWei
     ) internal {
@@ -41,6 +44,15 @@ abstract contract Pyth is PythGetters, PythSetters, AbstractPyth {
             _state.validDataSources.push(ds);
         }
 
+        {
+            PythInternalStructs.DataSource memory ds = PythInternalStructs
+                .DataSource(governanceEmitterChainId, governanceEmitterAddress);
+            PythSetters.setGovernanceDataSource(ds);
+            PythSetters.setLastExecutedGovernanceSequence(
+                governanceInitialSequence
+            );
+        }
+
         PythSetters.setValidTimePeriodSeconds(validTimePeriodSeconds);
         PythSetters.setSingleUpdateFeeInWei(singleUpdateFeeInWei);
     }

ethereum/contracts/pyth/PythUpgradable.sol

@@ -24,6 +24,9 @@ contract PythUpgradable is
         address wormhole,
         uint16[] calldata dataSourceEmitterChainIds,
         bytes32[] calldata dataSourceEmitterAddresses,
+        uint16 governanceEmitterChainId,
+        bytes32 governanceEmitterAddress,
+        uint64 governanceInitialSequence,
         uint validTimePeriodSeconds,
         uint singleUpdateFeeInWei
     ) public initializer {
@@ -34,85 +37,23 @@ contract PythUpgradable is
             wormhole,
             dataSourceEmitterChainIds,
             dataSourceEmitterAddresses,
+            governanceEmitterChainId,
+            governanceEmitterAddress,
+            governanceInitialSequence,
             validTimePeriodSeconds,
             singleUpdateFeeInWei
         );
-    }
-
-    /// Privileged function to specify additional data sources in the contract
-    function addDataSource(uint16 chainId, bytes32 emitter) public onlyOwner {
-        PythInternalStructs.DataSource memory ds = PythInternalStructs
-            .DataSource(chainId, emitter);
-        require(
-            !PythGetters.isValidDataSource(ds.chainId, ds.emitterAddress),
-            "Data source already added"
-        );
-
-        _state.isValidDataSource[hashDataSource(ds)] = true;
-        _state.validDataSources.push(ds);
-    }
-
-    /// Privileged fucntion to remove the specified data source. Assumes _state.validDataSources has no duplicates.
-    function removeDataSource(
-        uint16 chainId,
-        bytes32 emitter
-    ) public onlyOwner {
-        PythInternalStructs.DataSource memory ds = PythInternalStructs
-            .DataSource(chainId, emitter);
-        require(
-            PythGetters.isValidDataSource(ds.chainId, ds.emitterAddress),
-            "Data source not found, not removing"
-        );
-
-        _state.isValidDataSource[hashDataSource(ds)] = false;
-
-        for (uint i = 0; i < _state.validDataSources.length; ++i) {
-            // Find the source to remove
-            if (
-                _state.validDataSources[i].chainId == ds.chainId ||
-                _state.validDataSources[i].emitterAddress == ds.emitterAddress
-            ) {
-                // Copy last element to overwrite the target data source
-                _state.validDataSources[i] = _state.validDataSources[
-                    _state.validDataSources.length - 1
-                ];
-                // Remove the last element we just preserved
-                _state.validDataSources.pop();
-
-                break;
-            }
-        }
-    }
-
-    /// Privileged function to update the price update fee
-    function updateSingleUpdateFeeInWei(uint newFee) public onlyOwner {
-        PythSetters.setSingleUpdateFeeInWei(newFee);
-    }
-
-    /// Privileged function to update the valid time period for a price.
-    function updateValidTimePeriodSeconds(
-        uint newValidTimePeriodSeconds
-    ) public onlyOwner {
-        PythSetters.setValidTimePeriodSeconds(newValidTimePeriodSeconds);
-    }
 
-    // Privileged function to update the governance emitter
-    function updateGovernanceDataSource(
-        uint16 chainId,
-        bytes32 emitter,
-        uint64 sequence
-    ) public onlyOwner {
-        PythInternalStructs.DataSource memory ds = PythInternalStructs
-            .DataSource(chainId, emitter);
-        PythSetters.setGovernanceDataSource(ds);
-        PythSetters.setLastExecutedGovernanceSequence(sequence);
+        renounceOwnership();
     }
 
     /// Ensures the contract cannot be uninitialized and taken over.
     /// @custom:oz-upgrades-unsafe-allow constructor
     constructor() initializer {}
 
     // Only allow the owner to upgrade the proxy to a new implementation.
+    // The contract has no owner so this function will always revert
+    // but UUPSUpgradeable expects this method to be implemented.
     function _authorizeUpgrade(address) internal override onlyOwner {}
 
     function pythUpgradableMagic() public pure returns (uint32) {

ethereum/forge-test/utils/PythTestUtils.t.sol

@@ -39,14 +39,11 @@ abstract contract PythTestUtils is Test, WormholeTestUtils {
             wormhole,
             emitterChainIds,
             emitterAddresses,
-            60, // Valid time period in seconds
-            1 // single update fee in wei
-        );
-
-        pyth.updateGovernanceDataSource(
             GOVERNANCE_EMITTER_CHAIN_ID,
             GOVERNANCE_EMITTER_ADDRESS,
-            0
+            0, // Initial governance sequence
+            60, // Valid time period in seconds
+            1 // single update fee in wei
         );
 
         return address(pyth);

ethereum/migrations/prod-receiver/10_pyth_enable_governance.js

@@ -15,34 +15,36 @@ const emitterAddresses = [
   process.env.SOLANA_EMITTER,
   process.env.PYTHNET_EMITTER,
 ];
+const governanceChainId = process.env.GOVERNANCE_CHAIN_ID;
+const governanceEmitter = process.env.GOVERNANCE_EMITTER;
+// Default value for this field is 0
+const governanceInitialSequence = Number(
+  process.env.GOVERNANCE_INITIAL_SEQUENCE ?? "0"
+);
+
 const validTimePeriodSeconds = Number(process.env.VALID_TIME_PERIOD_SECONDS);
 const singleUpdateFeeInWei = Number(process.env.SINGLE_UPDATE_FEE_IN_WEI);
 
 console.log("emitterChainIds: " + emitterChainIds);
 console.log("emitterAddresses: " + emitterAddresses);
+console.log("governanceEmitter: " + governanceEmitter);
+console.log("governanceChainId: " + governanceChainId);
+console.log("governanceInitialSequence: " + governanceInitialSequence);
 console.log("validTimePeriodSeconds: " + validTimePeriodSeconds);
 console.log("singleUpdateFeeInWei: " + singleUpdateFeeInWei);
 
 module.exports = async function (deployer, network) {
-  const cluster = process.env.CLUSTER;
-  const chainName = process.env.WORMHOLE_CHAIN_NAME;
-
-  assert(cluster !== undefined && chainName !== undefined);
-
-  const wormholeBridgeAddress =
-    CONTRACTS[cluster.toUpperCase()][chainName].core;
-  assert(wormholeBridgeAddress !== undefined);
-
-  console.log("Wormhole bridge address: " + wormholeBridgeAddress);
-
   // Deploy the proxy. This will return an instance of PythUpgradable,
   // with the address field corresponding to the fronting ERC1967Proxy.
   let proxyInstance = await deployProxy(
     PythUpgradable,
     [
-      wormholeBridgeAddress,
+      (await WormholeReceiver.deployed()).address,
       emitterChainIds,
       emitterAddresses,
+      governanceChainId,
+      governanceEmitter,
+      governanceInitialSequence,
       validTimePeriodSeconds,
       singleUpdateFeeInWei,
     ],

ethereum/migrations/prod-receiver/3_deploy_pyth.js

@@ -15,11 +15,21 @@ const emitterAddresses = [
   process.env.SOLANA_EMITTER,
   process.env.PYTHNET_EMITTER,
 ];
+const governanceChainId = process.env.GOVERNANCE_CHAIN_ID;
+const governanceEmitter = process.env.GOVERNANCE_EMITTER;
+// Default value for this field is 0
+const governanceInitialSequence = Number(
+  process.env.GOVERNANCE_INITIAL_SEQUENCE ?? "0"
+);
+
 const validTimePeriodSeconds = Number(process.env.VALID_TIME_PERIOD_SECONDS);
 const singleUpdateFeeInWei = Number(process.env.SINGLE_UPDATE_FEE_IN_WEI);
 
 console.log("emitterChainIds: " + emitterChainIds);
 console.log("emitterAddresses: " + emitterAddresses);
+console.log("governanceEmitter: " + governanceEmitter);
+console.log("governanceChainId: " + governanceChainId);
+console.log("governanceInitialSequence: " + governanceInitialSequence);
 console.log("validTimePeriodSeconds: " + validTimePeriodSeconds);
 console.log("singleUpdateFeeInWei: " + singleUpdateFeeInWei);
 
@@ -43,6 +53,9 @@ module.exports = async function (deployer, network) {
       wormholeBridgeAddress,
       emitterChainIds,
       emitterAddresses,
+      governanceChainId,
+      governanceEmitter,
+      governanceInitialSequence,
       validTimePeriodSeconds,
       singleUpdateFeeInWei,
     ],