Admin key rotation function

[Just-Bamford]

Summary

The contract has no mechanism for admins to rotate their key. If an admin key is compromised or suspected to be compromised, it cannot be changed. A key rotation function is essential for production security. Admins must be able to authorize a new key and deauthorize the old one.

This is a Milestone 2 security hardening issue. Key rotation is required before mainnet deployment.

Background

The contract has a single hardcoded admin key in the contract state. There is no function to rotate it. If an admin key is leaked, the entire system is at risk.

Scope

Contract

• Add a contract function rotate_admin_key(new_admin_key: PublicKey): Result<(), Error>
• Function validates:
  • The caller is the current admin (use msg.sender())
  • The new key is a valid Stellar public key format
  • The new key is not the same as the current key
• On success, update the admin key in contract storage
• On failure, return an error code: UNAUTHORIZED or INVALID_KEY
• Emit an event indicating the key was rotated (with old and new key hashes)

Backend Integration

• Add a route POST /api/admin/rotate-key (admin-only)
• Accept new admin public key in request body
• Call contract function rotate_admin_key
• Log the rotation event
• Return success or error

Tests

• Admin can rotate their own key
• Non-admin cannot rotate key (rejected by contract)
• Invalid key format rejected
• Same key twice rejected
• Event emitted on successful rotation
• Old key no longer works for admin operations

Relevant Files

• contracts/anonvote/src/lib.rs
• backend/src/routes/admin.ts
• backend/src/middleware/auth.ts

Acceptance Criteria

• Contract function implemented and callable
• Backend endpoint implemented
• Non-admin calls rejected
• Invalid keys rejected
• Event emitted and logged
• Tests pass

Out of Scope

• Multi-sig admin control — single admin only for now
• Key escrow — direct key change only
• Automatic key expiration — manual rotation only

Note for Contributors

Store the new admin key securely. Do not log full key material. Consider adding a delay or confirmation step in Milestone 2 to prevent accidental rotations. Always emit events for audit trail.

[jotel-dev]

Kindly assign me

[grantfox-oss]

🦊 GrantFox — @jotel-dev has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #69)
2. Your PR will be reviewed by the AnonVote maintainers

Good luck! Track your progress on GrantFox.