[CRITICAL] `upgrade()` allows arbitrary WASM replacement with no timelock, delay, or multi-sig — single compromised admin key = total loss

[grantfox-oss]

Summary

pulse_token/src/lib.rs upgrade (lines ~89-101) lets the admin replace the entire contract WASM immediately with no timelock, no multi-sig, and no code-hash pinning:

admin.require_auth();
env.deployer().update_current_contract_wasm(new_wasm_hash);

Impact

• Single-key total compromise: anyone who breaches the admin key can replace the WASM with arbitrary code — mint unlimited tokens, drain balances, lock users out.
• No notification window: there is no delay for users to exit or for governance to intervene.
• No hash verification: the new WASM hash is not compared against a known-good allowlist.

Fix

• Require a multi-sig (M-of-N) approval for WASM upgrades.
• Add a minimum timelock (e.g., 7 days) between scheduling an upgrade and it taking effect.
• Restrict new_wasm_hash to a pre-approved set of hashes.
• Emit an UpgradeScheduled event on scheduling and UpgradeApplied on execution.

[Viccodes11]

I am confident that I can implement this having worked on something similar in the past

[grantfox-oss]

🦊 GrantFox — @Viccodes11 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #168)
2. Your PR will be reviewed by the SPulse-Org maintainers

Good luck! Track your progress on GrantFox.