[VPD-29]: Configure Risk Stewards

[GitGuru7]

Description

Resolves VEN

[GitGuru7]

testnet executions:
1/2: https://testnet.bscscan.com/tx/0x2f50d1eec454d6f99e5580c5169e0923b1813c0b64c5d6375dd329d173e0d6da
2/2: https://testnet.bscscan.com/tx/0x7e7f2b42512872baa80a0ac19422a9983c2fb18f2775e64fecc326d3b9e920c0

[fred-venus]

@claude could u follow the review pattern i've added in claude.md to review this vip

If you need the source code, you can check it in the government repo.

[fred-venus]

wrap the ai feedback for now as it's not well configured rn, no access to web

[fred-venus]

PR Review Report

Summary

• Verdict: LGTM (with notes)
• Type: VIP (VIP-600)

Configures the Risk Steward system on BSC mainnet (+ all testnets). Single-phase VIP combining ACM permissions (33 grants), ownership acceptance (5 contracts), RiskOracle config, RiskStewardReceiver config, and safe delta BPS.

Previous review: Testnet-only review completed 2026-01-07 found and fixed update type string mismatch. This PR now includes the mainnet VIP.

Checklist

1. Contract Address Verification

Contract	Address	Status	Evidence
CORE_COMPTROLLER	0xfD36E2c2a6789Db23113685031d7F16329158384	✅ PASS	Known Venus Core Pool Diamond proxy
RISK_ORACLE	0x0E3E51958b0Daa8C57c949675975CBEDd7b5a1a1	✅ PASS	Deployed, verified on BSCScan, pendingOwner = Normal Timelock
RISK_STEWARD_RECEIVER	0x47856bFa74B71d24a5545c7506862B8FddE52baB	✅ PASS	Deployed, verified, pendingOwner = Normal Timelock
MARKETCAP_STEWARD	0x816FfD00A274EDE0091421F77817ca260Db3a3E3	✅ PASS	Deployed, verified, pendingOwner = Normal Timelock
COLLATERALFACTORS_STEWARD	0x1414ADf007E324ec1D0A77b9F1A8759Ad33d2879	✅ PASS	Deployed, verified, pendingOwner = Normal Timelock
IRM_STEWARD	0x8acaBc42Bb98E2e2b091902a7E23f60CcB730aaa	✅ PASS	Deployed, verified, pendingOwner = Normal Timelock

Verification: cast call for pendingOwner() and owner() on all 5 new contracts. All show pendingOwner = Normal Timelock, current owner = deployer EOA 0x14A1c22EF6d2eF6cE33c0b018d8A34D02021e5c8.

1b. Implementation Source Code Verification

All 5 contracts are OptimizedTransparentUpgradeableProxy. Implementation source code fetched from BSCScan API and diffed against local repo (governance-contracts/contracts/RiskSteward/).

Contract	Impl Address	BSCScan Source vs Local Repo	Compiler	Optimizer
RiskOracle	0x3404...de48	✅ MATCH	v0.8.25	10000 runs, paris
RiskStewardReceiver	0xc00e...9e6e	✅ MATCH	v0.8.25	10000 runs, paris
MarketCapsRiskSteward	0x6c45...bb43	✅ MATCH	v0.8.25	10000 runs, paris
CollateralFactorsRiskSteward	0x9235...22d4	✅ MATCH	v0.8.25	10000 runs, paris
IRMRiskSteward	0x0548...9ea5	✅ MATCH	v0.8.25	10000 runs, paris

Verification method: BSCScan API getsourcecode → extract main contract file + BaseRiskSteward.sol → diff against local repo. All compiler settings match hardhat.config.ts.

2. Function Signature Verification

Function	Target	Status
giveCallPermission(address,string,address)	ACM	✅ PASS
acceptOwnership()	All 5 contracts	✅ PASS
addAuthorizedSender(address)	RiskOracle	✅ PASS
addUpdateType(string)	RiskOracle	✅ PASS
setRiskParameterConfig(string,address,uint256,uint256)	RSR	✅ PASS
setWhitelistedExecutor(address,bool)	RSR	✅ PASS
setSafeDeltaBps(uint256)	Stewards	✅ PASS
_setMarketBorrowCaps(address[],uint256[])	Core Comptroller	✅ PASS
_setMarketSupplyCaps(address[],uint256[])	Core Comptroller	✅ PASS
setCollateralFactor(uint96,address,uint256,uint256)	Core Comptroller	✅ PASS
_setInterestRateModel(address)	AddressZero (wildcard)	✅ PASS

3. ACM Permission Count — 33 Total ✅

Category	Count
RISK_ORACLE permissions	11
RISK_STEWARD_RECEIVER permissions	14
Steward setSafeDeltaBps	4
Market operation permissions	4

4. Permission Tiering ✅

Function	NORMAL	FAST_TRACK	CRITICAL	GUARDIAN	Assessment
addAuthorizedSender	✅	-	-	-	Most restrictive — correct
removeAuthorizedSender	✅	✅	✅	✅	Emergency revocation — correct
addUpdateType	✅	✅	-	-	Expanding scope — correct
setUpdateTypeActive	✅	✅	✅	✅	Kill switch — correct
setRiskParameterConfig	✅	✅	-	-	Config change — correct
setConfigActive	✅	✅	✅	✅	Kill switch — correct
setWhitelistedExecutor	✅	✅	✅	✅	Emergency revocation — correct
setPaused	✅	✅	✅	✅	Emergency pause — correct
setSafeDeltaBps (MC/CF)	✅	✅	-	-	Bounds change — correct

5. Numeric Values ✅

Param	Value	Expected	Status
DEBOUNCE	259200	3 days (3×86400)	✅ PASS
TIMELOCK	21600	6 hours (6×3600)	✅ PASS
MC_STEWARD_SAFE_DELTA	5000	50% of 10000 BPS	✅ PASS
CF_STEWARD_SAFE_DELTA	1000	10% of 10000 BPS	✅ PASS

6. Update Type Strings ✅

All match contract constants: "supplyCap", "borrowCap", "collateralFactors", "interestRateModel".

7. Ownership, Events, Test Coverage, ProposalType — All ✅

• All 5 contracts owned by NORMAL_TIMELOCK after VIP. renounceOwnership() disabled.
• Event counts verified: 33 RoleGranted, 1 sender, 4 update types, 4 configs, 1 executor, 2 deltas.
• Simulation tests comprehensive (ACM, market ops, ownership, oracle config, RSR config, deltas).
• ProposalType.REGULAR appropriate.

Notes

#	Severity	Location	Description
1	⚠️ NOTE	bscmainnet.ts:14-15	1-of-1 Safe as both sender AND executor: 0x83f426... is a Gnosis Safe with 1-of-1 threshold. Same address for both RISK_PARAMETER_SENDER and WHITELISTED_EXECUTORS. If compromised, attacker can publish AND execute updates (within safe delta / debounce bounds). Consider 2-of-N or separating sender/executor roles.
2	⚠️ NOTE	IRM architecture	IRM steward accepts arbitrary contract addresses with no whitelist. Mitigated by: IRM changes ALWAYS require 6-hour timelock (isSafeForDirectExecution returns false), and Guardian can pause.
3	💡 NIT	simulations bscmainnet.ts:214	32-byte zero in test: Uses 32-byte zero hex instead of ethers.constants.AddressZero (20 bytes) for IRM role hash. Works due to ethers truncation but inconsistent with VIP code (line 159).
4	💡 NIT	bsctestnet.ts:39,67	Typo: OPTIMISUM_SEPOLIA and OPTEMISUMSEPOLIA_ACM_AGGREGATOR — misspellings of "OPTIMISM". Non-functional.
5	💡 NIT	simulations bscmainnet.ts:234,240	Test calls non-underscore functions: setMarketSupplyCaps/setMarketBorrowCaps while ACM grants _setMarketSupplyCaps/_setMarketBorrowCaps. Works via Diamond routing, but could confuse reviewers.

Emergency Safety

Multiple independent kill switches, all accessible to Guardian:

1. setPaused(true) on RSR
2. setConfigActive(updateType, false)
3. removeAuthorizedSender(address)
4. setUpdateTypeActive(string, false)
5. setWhitelistedExecutor(address, false)

[Debugger022]

nit: Use ethers.constants.AddressZero instead of the 32-byte zero literal

[Debugger022]

file name typo