@layerzerolabs/protocol-stellar-v2 0.2.29 → 0.2.30

package/contracts/sac-manager/src/tests/supply_control/update_limit_config.rs

@@ -0,0 +1,257 @@
+//! update_limit_config Integration Tests
+
+use super::test_helper::{
+    mock_oft_mint_auth, mock_set_mint_whitelist_auth, mock_set_supply_controller_auth, mock_update_limit_config_auth,
+};
+use crate::extensions::supply_control::SupplyControlClient;
+use crate::extensions::supply_control::{LimitConfig, LimitConfigUpdated, SupplyControlError, SupplyControllerConfig};
+use crate::tests::test_helper::TestSetup;
+use soroban_sdk::Vec;
+use utils::testing_utils::assert_eq_event;
+
+#[test]
+fn test_update_limit_config() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    let new_limit = LimitConfig { limit_capacity: 5_000, refill_per_second: 50 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &new_limit);
+    sc_client.update_limit_config(&setup.sc_manager, &controller, &new_limit);
+
+    // Verify event
+    let expected = LimitConfigUpdated {
+        supply_controller: controller.clone(),
+        new_limit_config: new_limit.clone(),
+        old_limit_config: config.limit_config,
+    };
+    assert_eq_event(&setup.env, &setup.sac_manager, expected);
+
+    // Verify config was updated
+    let stored = sc_client.get_supply_controller_config(&controller).unwrap();
+    assert_eq!(stored.limit_config.limit_capacity, 5_000);
+    assert_eq!(stored.limit_config.refill_per_second, 50);
+}
+
+#[test]
+fn test_update_limit_config_preserves_rate_limit_state() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_supply_control_enabled().build();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 1 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &setup.oft, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &setup.oft, &Some(config.clone()));
+
+    // Mint some tokens to consume rate limit
+    let recipient = setup.generate_address();
+    mock_oft_mint_auth(&setup, &recipient, 400_i128);
+    setup.sac_manager_client.mint(&recipient, &400);
+    assert_eq!(sc_client.get_remaining_mint_amount(&setup.oft), 600);
+
+    // Update limit config (should NOT reset remaining amount)
+    let new_limit = LimitConfig { limit_capacity: 2_000, refill_per_second: 1 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &setup.oft, &new_limit);
+    sc_client.update_limit_config(&setup.sc_manager, &setup.oft, &new_limit);
+
+    // Remaining amount should still be 600 (not reset to 2000)
+    assert_eq!(sc_client.get_remaining_mint_amount(&setup.oft), 600);
+}
+
+#[test]
+fn test_update_limit_config_fails_with_invalid_config() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    let invalid_limit = LimitConfig { limit_capacity: -100, refill_per_second: 10 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &invalid_limit);
+    let result = sc_client.try_update_limit_config(&setup.sc_manager, &controller, &invalid_limit);
+    assert_eq!(result.err().unwrap().unwrap(), SupplyControlError::InvalidConfig.into());
+
+    // Verify config remains unchanged after failed update.
+    let stored = sc_client.get_supply_controller_config(&controller).unwrap();
+    assert_eq!(stored.limit_config, config.limit_config);
+}
+
+#[test]
+fn test_update_limit_config_fails_with_negative_refill_per_second() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    let invalid_limit = LimitConfig { limit_capacity: 1_000, refill_per_second: -1 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &invalid_limit);
+    let result = sc_client.try_update_limit_config(&setup.sc_manager, &controller, &invalid_limit);
+    assert_eq!(result.err().unwrap().unwrap(), SupplyControlError::InvalidConfig.into());
+
+    // Verify config remains unchanged after failed update.
+    let stored = sc_client.get_supply_controller_config(&controller).unwrap();
+    assert_eq!(stored.limit_config, config.limit_config);
+}
+
+#[test]
+fn test_update_limit_config_preserves_allow_any_and_whitelist() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let whitelisted = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: false,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    // Add whitelisted address before updating limit config
+    mock_set_mint_whitelist_auth(&setup, &setup.sc_manager, &controller, &whitelisted, true);
+    sc_client.set_mint_whitelist(&setup.sc_manager, &controller, &whitelisted, &true);
+
+    let new_limit = LimitConfig { limit_capacity: 3_000, refill_per_second: 30 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &new_limit);
+    sc_client.update_limit_config(&setup.sc_manager, &controller, &new_limit);
+
+    let stored = sc_client.get_supply_controller_config(&controller).unwrap();
+    assert_eq!(stored.limit_config, new_limit);
+    assert_eq!(stored.allow_any_mint_burn, config.allow_any_mint_burn);
+    assert!(sc_client.is_address_whitelisted(&controller, &whitelisted));
+}
+
+#[test]
+fn test_update_limit_config_switch_to_unlimited_and_back() {
+    let setup = TestSetup::new().with_manager_as_sac_admin().with_supply_control_enabled().build();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 1 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &setup.oft, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &setup.oft, &Some(config));
+
+    let recipient = setup.generate_address();
+    mock_oft_mint_auth(&setup, &recipient, 400_i128);
+    setup.sac_manager_client.mint(&recipient, &400);
+    assert_eq!(sc_client.get_remaining_mint_amount(&setup.oft), 600);
+
+    let unlimited = LimitConfig { limit_capacity: 1_000, refill_per_second: 0 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &setup.oft, &unlimited);
+    sc_client.update_limit_config(&setup.sc_manager, &setup.oft, &unlimited);
+    assert_eq!(sc_client.get_remaining_mint_amount(&setup.oft), i128::MAX);
+
+    let limited_again = LimitConfig { limit_capacity: 2_000, refill_per_second: 1 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &setup.oft, &limited_again);
+    sc_client.update_limit_config(&setup.sc_manager, &setup.oft, &limited_again);
+    assert_eq!(sc_client.get_remaining_mint_amount(&setup.oft), 600);
+}
+
+#[test]
+fn test_update_limit_config_event_tracks_previous_value_across_updates() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let initial = LimitConfig { limit_capacity: 1_000, refill_per_second: 10 };
+    let config = SupplyControllerConfig {
+        limit_config: initial.clone(),
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config));
+
+    let first = LimitConfig { limit_capacity: 2_000, refill_per_second: 20 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &first);
+    sc_client.update_limit_config(&setup.sc_manager, &controller, &first);
+
+    let second = LimitConfig { limit_capacity: 3_000, refill_per_second: 30 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &controller, &second);
+    sc_client.update_limit_config(&setup.sc_manager, &controller, &second);
+
+    let expected =
+        LimitConfigUpdated { supply_controller: controller, new_limit_config: second, old_limit_config: first };
+    assert_eq_event(&setup.env, &setup.sac_manager, expected);
+}
+
+#[test]
+fn test_update_limit_config_fails_if_not_supply_controller() {
+    let setup = TestSetup::new().build();
+    let non_controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let limit = LimitConfig { limit_capacity: 1_000, refill_per_second: 10 };
+    mock_update_limit_config_auth(&setup, &setup.sc_manager, &non_controller, &limit);
+    let result = sc_client.try_update_limit_config(&setup.sc_manager, &non_controller, &limit);
+    assert_eq!(result.err().unwrap().unwrap(), SupplyControlError::NotFound.into());
+}
+
+#[test]
+fn test_update_limit_config_by_non_manager_fails() {
+    let setup = TestSetup::new().build();
+    let non_manager = setup.generate_address();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    let new_limit = LimitConfig { limit_capacity: 5_000, refill_per_second: 50 };
+    mock_update_limit_config_auth(&setup, &non_manager, &controller, &new_limit);
+    let result = sc_client.try_update_limit_config(&non_manager, &controller, &new_limit);
+    assert_eq!(result.err().unwrap().unwrap(), SupplyControlError::Unauthorized.into());
+}
+
+#[test]
+#[should_panic(expected = "Error(Auth, InvalidAction)")]
+fn test_update_limit_config_without_auth() {
+    let setup = TestSetup::new().build();
+    let controller = setup.generate_address();
+    let sc_client = SupplyControlClient::new(&setup.env, &setup.sac_manager);
+
+    let config = SupplyControllerConfig {
+        limit_config: LimitConfig { limit_capacity: 1_000, refill_per_second: 10 },
+        allow_any_mint_burn: true,
+        whitelist_addresses: Vec::new(&setup.env),
+    };
+    mock_set_supply_controller_auth(&setup, &setup.sc_manager, &controller, &Some(config.clone()));
+    sc_client.set_supply_controller(&setup.sc_manager, &controller, &Some(config.clone()));
+
+    // sc_manager's auth is not mocked — sender.require_auth() fails
+    let new_limit = LimitConfig { limit_capacity: 5_000, refill_per_second: 50 };
+    sc_client.update_limit_config(&setup.sc_manager, &controller, &new_limit);
+}

package/contracts/sac-manager/src/tests/test_helper.rs

@@ -0,0 +1,190 @@
+//! Test helper utilities for SAC manager tests.
+//!
+//! Provides authentication mocking helpers and common setup utilities.
+
+extern crate std;
+
+use crate::{SacManager, SacManagerClient};
+use soroban_sdk::{
+    testutils::{Address as _, MockAuth, MockAuthInvoke, StellarAssetContract},
+    token::StellarAssetClient,
+    Address, Env, IntoVal, Val,
+};
+
+// =========================================================================
+// TestSetup Builder
+// =========================================================================
+
+/// Builder for creating test setups with chainable configuration.
+///
+/// # Example
+/// ```ignore
+/// let setup = TestSetup::new()
+///     .with_manager_as_sac_admin()
+///     .build();
+/// ```
+pub struct TestSetupBuilder {
+    manager_as_sac_admin: bool,
+    redistribution_enabled: bool,
+    supply_control_enabled: bool,
+    skip_oft_setup: bool,
+}
+
+impl TestSetupBuilder {
+    fn new() -> Self {
+        Self {
+            manager_as_sac_admin: false,
+            redistribution_enabled: false,
+            supply_control_enabled: false,
+            skip_oft_setup: false,
+        }
+    }
+
+    /// Set the SacManager as SAC admin during setup.
+    pub fn with_manager_as_sac_admin(mut self) -> Self {
+        self.manager_as_sac_admin = true;
+        self
+    }
+
+    /// Enable redistribution at construction time.
+    pub fn with_redistribution_enabled(mut self) -> Self {
+        self.redistribution_enabled = true;
+        self
+    }
+
+    /// Enable supply control at construction time.
+    pub fn with_supply_control_enabled(mut self) -> Self {
+        self.supply_control_enabled = true;
+        self
+    }
+
+    /// Skip setting the OFT address during setup.
+    /// Use this to test `set_oft_address` auth or the once-only guard.
+    pub fn without_oft(mut self) -> Self {
+        self.skip_oft_setup = true;
+        self
+    }
+
+    /// Build the TestSetup with the configured options.
+    pub fn build<'a>(self) -> TestSetup<'a> {
+        let env = Env::default();
+
+        let owner = Address::generate(&env);
+        let oft = Address::generate(&env);
+        let sc_manager = Address::generate(&env);
+        let sac_contract = env.register_stellar_asset_contract_v2(owner.clone());
+        let sac = sac_contract.address();
+
+        let sac_manager =
+            env.register(SacManager, (&sac, &owner, self.redistribution_enabled, self.supply_control_enabled));
+        let sac_manager_client = SacManagerClient::new(&env, &sac_manager);
+        let sac_client = StellarAssetClient::new(&env, &sac);
+
+        if !self.skip_oft_setup {
+            env.mock_auths(&[MockAuth {
+                address: &owner,
+                invoke: &MockAuthInvoke {
+                    contract: &sac_manager,
+                    fn_name: "set_oft_address",
+                    args: (&oft,).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }]);
+            sac_manager_client.set_oft_address(&oft);
+        }
+
+        if self.manager_as_sac_admin {
+            env.mock_auths(&[MockAuth {
+                address: &owner,
+                invoke: &MockAuthInvoke {
+                    contract: &sac,
+                    fn_name: "set_admin",
+                    args: (&sac_manager,).into_val(&env),
+                    sub_invokes: &[],
+                },
+            }]);
+            sac_client.set_admin(&sac_manager);
+        }
+
+        // Set up supply controller manager (owner grants the role)
+        env.mock_auths(&[MockAuth {
+            address: &owner,
+            invoke: &MockAuthInvoke {
+                contract: &sac_manager,
+                fn_name: "set_supply_controller_manager",
+                args: (&sc_manager, true).into_val(&env),
+                sub_invokes: &[],
+            },
+        }]);
+        sac_manager_client.set_supply_controller_manager(&sc_manager, &true);
+
+        // Clear mock auths so test starts with clean auth state
+        env.mock_auths(&[]);
+
+        TestSetup { env, owner, oft, sc_manager, sac, sac_contract, sac_manager, sac_manager_client, sac_client }
+    }
+}
+
+// =========================================================================
+// TestSetup
+// =========================================================================
+
+/// Common test setup that creates a SAC and SacManager.
+pub struct TestSetup<'a> {
+    pub env: Env,
+    pub owner: Address,
+    pub oft: Address,
+    pub sc_manager: Address,
+    pub sac: Address,
+    pub sac_contract: StellarAssetContract,
+    pub sac_manager: Address,
+    pub sac_manager_client: SacManagerClient<'a>,
+    pub sac_client: StellarAssetClient<'a>,
+}
+
+impl TestSetup<'_> {
+    /// Start building a new test setup.
+    pub fn new() -> TestSetupBuilder {
+        TestSetupBuilder::new()
+    }
+
+    /// Generate a new random address in this test environment.
+    pub fn generate_address(&self) -> Address {
+        Address::generate(&self.env)
+    }
+}
+
+// =========================================================================
+// Auth Helpers
+// =========================================================================
+
+/// Test helper to mock a single contract invocation auth.
+///
+/// This keeps test files from repeating `env.mock_auths(&[MockAuth { ... }])` blocks.
+pub fn mock_auth<A: IntoVal<Env, soroban_sdk::Vec<Val>>>(
+    env: &Env,
+    contract_id: &Address,
+    address: &Address,
+    fn_name: &'static str,
+    args: A,
+) {
+    env.mock_auths(&[MockAuth {
+        address,
+        invoke: &MockAuthInvoke { contract: contract_id, args: args.into_val(env), fn_name, sub_invokes: &[] },
+    }]);
+}
+
+/// Mock auth for `set_supply_controller`.
+pub fn mock_set_supply_controller_auth(
+    setup: &TestSetup,
+    sender: &Address,
+    controller: &Address,
+    config: &Option<crate::extensions::supply_control::SupplyControllerConfig>,
+) {
+    mock_auth(&setup.env, &setup.sac_manager, sender, "set_supply_controller", (sender, controller, config.clone()));
+}
+
+/// Mock auth for OFT-originated `mint`.
+pub fn mock_oft_mint_auth(setup: &TestSetup, recipient: &Address, amount: i128) {
+    mock_auth(&setup.env, &setup.sac_manager, &setup.oft, "mint", (recipient, amount));
+}

package/contracts/upgrader/src/lib.rs

@@ -20,7 +20,7 @@
 //! ```
 
 use soroban_sdk::{contract, contractimpl, xdr::ToXdr, Address, Bytes, BytesN, Env};
-use utils::upgradeable::UpgradeableClient;
+use utils::{auth::AuthClient, upgradeable::UpgradeableClient};
 
 /// Upgrader contract for managing upgrades of other contracts.
 ///
@@ -59,6 +59,7 @@ impl Upgrader {
     /// upgrader.upgrade_and_migrate(&contract_addr, &wasm_hash, &migration_data);
     /// ```
     pub fn upgrade_and_migrate(env: &Env, contract_address: &Address, wasm_hash: &BytesN<32>, migration_data: &Bytes) {
+        AuthClient::new(env, contract_address).authorizer().require_auth();
         let client = UpgradeableClient::new(env, contract_address);
         client.upgrade(wasm_hash);
         client.migrate(migration_data);

package/contracts/utils/src/errors.rs

@@ -47,7 +47,6 @@ pub enum BytesExtError {
 pub enum UpgradeableError {
     InvalidMigrationData = 1050,
     MigrationNotAllowed,
-    UpgradesFrozen,
 }
 
 /// MultiSigError: 1060-1069

package/contracts/utils/src/tests/upgradeable.rs

@@ -528,69 +528,3 @@ fn test_cannot_migrate_twice_without_upgrade() {
     assert_eq!(result.err().unwrap().ok().unwrap(), UpgradeableError::MigrationNotAllowed.into());
 }
 
-// ============================================
-// Freeze Feature Tests
-// ============================================
-
-#[test]
-fn test_freeze_success() {
-    let env = Env::default();
-    env.mock_all_auths();
-    let contract_id = env.register(DummyContract, ());
-    let client = DummyContractClient::new(&env, &contract_id);
-
-    // Initially, contract should not be frozen
-    assert_eq!(client.is_frozen(), false);
-
-    // Freeze the contract
-    client.freeze();
-
-    // Verify the contract is now frozen
-    assert_eq!(client.is_frozen(), true);
-}
-
-#[test]
-#[should_panic(expected = "Error(Contract, #1052)")] // UpgradesFrozen
-fn test_upgrade_fails_when_frozen() {
-    let env = Env::default();
-    env.mock_all_auths();
-    let contract_id = env.register(DummyContract, ());
-    let client = DummyContractClient::new(&env, &contract_id);
-
-    // Upload valid contract WASM
-    let wasm_hash = env.deployer().upload_contract_wasm(Bytes::from_slice(&env, TEST_WASM));
-
-    // Freeze the contract first
-    client.freeze();
-
-    // Try to upgrade - should panic with UpgradesFrozen
-    client.upgrade(&wasm_hash);
-}
-
-#[test]
-#[should_panic(expected = "Error(Contract, #1052)")] // UpgradesFrozen
-fn test_freeze_multiple_times() {
-    let env = Env::default();
-    env.mock_all_auths();
-    let contract_id = env.register(DummyContract, ());
-    let client = DummyContractClient::new(&env, &contract_id);
-
-    // First freeze should succeed
-    client.freeze();
-    assert_eq!(client.is_frozen(), true);
-
-    // Second freeze should panic with UpgradesFrozen
-    client.freeze();
-}
-
-#[test]
-#[should_panic(expected = "HostError: Error(Auth, InvalidAction)")]
-fn test_freeze_requires_auth() {
-    let env = Env::default();
-    // Note: NOT calling mock_all_auths() - auth will fail
-    let contract_id = env.register(DummyContract, ());
-    let client = DummyContractClient::new(&env, &contract_id);
-
-    // Try to freeze without auth - should panic
-    client.freeze();
-}

package/contracts/utils/src/upgradeable.rs

@@ -15,7 +15,6 @@ pub trait Upgradeable: UpgradeableInternal + Auth {
     /// Sets a migration flag that must be cleared by calling `migrate`.
     #[only_auth]
     fn upgrade(env: &soroban_sdk::Env, new_wasm_hash: &soroban_sdk::BytesN<32>) {
-        assert_with_error!(env, !Self::is_frozen(env), UpgradeableError::UpgradesFrozen);
         UpgradeableStorage::set_migrating(env, &true);
         env.deployer().update_current_contract_wasm(new_wasm_hash.clone());
     }
@@ -35,18 +34,6 @@ pub trait Upgradeable: UpgradeableInternal + Auth {
         // Clear the migration flag after migration is successful
         UpgradeableStorage::set_migrating(env, &false);
     }
-
-    /// Permanently freezes the contract, preventing any future upgrades. Irreversible.
-    #[only_auth]
-    fn freeze(env: &soroban_sdk::Env) {
-        assert_with_error!(env, !Self::is_frozen(env), UpgradeableError::UpgradesFrozen);
-        UpgradeableStorage::set_frozen(env, &true);
-    }
-
-    /// Returns whether the contract is frozen (upgrades disabled).
-    fn is_frozen(env: &soroban_sdk::Env) -> bool {
-        UpgradeableStorage::frozen(env)
-    }
 }
 
 /// Trait for defining contract-specific migration logic.
@@ -66,11 +53,6 @@ pub trait UpgradeableInternal {
 /// Storage for upgrade state.
 #[storage]
 pub enum UpgradeableStorage {
-    /// Whether upgrades are permanently disabled.
-    #[instance(bool)]
-    #[default(false)]
-    Frozen,
-
     /// Whether a migration is pending.
     #[instance(bool)]
     #[default(false)]

package/contracts/workers/dvn/src/dvn.rs

@@ -13,8 +13,8 @@ use message_lib_common::interfaces::ILayerZeroDVN;
 use soroban_sdk::{xdr::ToXdr, Address, Bytes, BytesN, Env, Vec};
 use utils::{buffer_writer::BufferWriter, multisig, option_ext::OptionExt};
 use worker::{
-    assert_acl, assert_not_paused, assert_supported_message_lib, errors::WorkerError, init_worker, require_admin_auth,
-    set_admin_by_admin, Worker,
+    assert_acl, assert_not_paused, assert_supported_message_lib, init_worker, require_admin_auth, set_admin_by_admin,
+    Worker, WorkerError,
 };
 
 /// LayerZero DVN contract.

package/contracts/workers/dvn/src/interfaces/dvn.rs

@@ -1,5 +1,5 @@
 use message_lib_common::interfaces::ILayerZeroDVN;
-use soroban_sdk::{contractclient, contracttype, Address, BytesN, Env, Symbol, Val, Vec};
+use soroban_sdk::{auth::CustomAccountInterface, contractclient, contracttype, Address, BytesN, Env, Symbol, Val, Vec};
 use utils::multisig::MultiSig;
 use worker::Worker;
 
@@ -82,7 +82,7 @@ pub struct Call {
 /// Extends the LayerZero DVN interface with destination configuration management
 /// and multisig capabilities for secure cross-chain message verification.
 #[contractclient(name = "DVNClient")]
-pub trait IDVN: ILayerZeroDVN + Worker + MultiSig {
+pub trait IDVN: ILayerZeroDVN + Worker + MultiSig + CustomAccountInterface {
     /// Sets the configuration for one or more destination chains.
     ///
     /// # Arguments

package/contracts/workers/dvn/src/lib.rs

@@ -1,7 +1,8 @@
 #![no_std]
 
-mod errors;
 pub mod events;
+
+mod errors;
 mod interfaces;
 
 pub use errors::*;

package/contracts/workers/dvn-fee-lib/src/lib.rs

@@ -1,6 +1,8 @@
 #![no_std]
 
-pub mod errors;
+mod errors;
+
+pub use errors::*;
 
 cfg_if::cfg_if! {
     // Include implementation when NOT in library mode, OR when testutils is enabled (for tests)