feat(cosmwasm): script that gives coordinator instantiation permissions

cosmwasm/migrate/coordinator.ts

@@ -1,8 +1,9 @@
 import { CosmWasmClient } from '@cosmjs/cosmwasm-stargate';
 import { StdFee } from '@cosmjs/stargate';
+import { AccessType } from 'cosmjs-types/cosmwasm/wasm/v1/types';
 
 import { printError, printInfo } from '../../common';
-import { encodeMigrateContractProposal, submitProposal } from '../utils';
+import { encodeMigrateContractProposal, encodeUpdateInstantiateConfigProposal, submitProposal } from '../utils';
 import { MigrationOptions, ProtocolContracts } from './types';
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -334,3 +335,48 @@ export async function checkMigration(
         printError(`no migration check script found for coordinator ${version}`);
     }
 }
+
+export async function instantiatePermissions(
+    client: typeof SigningCosmWasmClient,
+    options: MigrationOptions,
+    config,
+    senderAddress: string,
+    coordinatorAddress: string,
+    permittedAddresses: string[],
+    codeId: number,
+    fee: string | StdFee,
+) {
+    permittedAddresses.push(coordinatorAddress);
+
+    const updateMsg: string = JSON.stringify([
+        {
+            codeId: codeId,
+            instantiatePermission: {
+                permission: AccessType.ACCESS_TYPE_ANY_OF_ADDRESSES,
+                addresses: permittedAddresses,
+            },
+        },
+    ]);
+
+    printInfo(`Update Msg: ${JSON.stringify(updateMsg)}`);
+
+    const updateOptions = {
+        msg: updateMsg,
+        title: options.title,
+        description: options.description,
+        runAs: senderAddress,
+        deposit: options.deposit,
+    };
+
+    const proposal = encodeUpdateInstantiateConfigProposal(updateOptions);
+
+    if (!options.dry) {
+        try {
+            printInfo(`Executing migration...\n${JSON.stringify(updateOptions)}`);
+            await submitProposal(client, config, updateOptions, proposal, fee);
+            printInfo('Migration proposal successfully submitted');
+        } catch (e) {
+            printError(`Error: ${e}`);
+        }
+    }
+}

cosmwasm/migrate/migrate.ts

@@ -9,9 +9,9 @@ import { FullConfig } from '../../common/config';
 import { addAmplifierOptions, addAmplifierQueryContractOptions } from '../cli-utils';
 import { ClientManager, mainProcessor, mainQueryProcessor } from '../processor';
 import { getContractInfo } from '../query';
-import { checkMigration as checkMigrationCoordinator, migrate as migrateCoordinator } from './coordinator';
+import { checkMigration as checkMigrationCoordinator, instantiatePermissions, migrate as migrateCoordinator } from './coordinator';
 import { migrate as migrateMultisig } from './multisig';
-import { MigrationCheckOptions, MigrationOptions } from './types';
+import { InstantiatePermission, MigrationCheckOptions, MigrationOptions } from './types';
 
 async function migrate(
     client: ClientManager,
@@ -45,7 +45,7 @@ async function checkMigration(
     client: CosmWasmClient,
     config: FullConfig,
     options: MigrationCheckOptions,
-    args: string[],
+    _args: string[],
     _fee: string | StdFee,
 ): Promise<void> {
     const contract_address = options.address ?? config.axelar.contracts[options.contractName]?.address;
@@ -58,10 +58,40 @@ async function checkMigration(
     }
 }
 
+async function coordinatorInstantiatePermissions(
+    client: ClientManager,
+    config: FullConfig,
+    options: MigrationOptions,
+    args: string[],
+    fee: string | StdFee,
+): Promise<void> {
+    const senderAddress = client.accounts[0].address;
+    const contractAddress = options.address ?? config.axelar.contracts['Coordinator']?.address;
+    if (args.length < 2 || args[0] === undefined || args[1] === undefined) {
+        throw new Error('code_id and current_permissions arguments are required');
+    }
+    const codeId = Number(args[0]);
+    if (isNaN(codeId)) {
+        throw new Error('code_id must be a valid number');
+    }
+
+    const permissions: InstantiatePermission = JSON.parse(args[1]);
+    if (permissions.permission && permissions.permission === 'Everybody') {
+        throw new Error(`coordinator is already allowed to instantiate code id ${codeId}`);
+    }
+
+    const permitted_addresses = permissions.addresses ?? [];
+    if (permitted_addresses.includes(contractAddress)) {
+        throw new Error(`coordinator is already allowed to instantiate code id ${codeId}`);
+    }
+
+    return instantiatePermissions(client, options, config, senderAddress, contractAddress, permitted_addresses, codeId, fee);
+}
+
 const programHandler = () => {
     const program = new Command();
 
-    program.name('migrate').version('1.0.0').description('Automation for migrating Amplifier contracts');
+    program.name('migrate').version('1.1.0').description('Automation for migrating Amplifier contracts');
 
     addAmplifierOptions(
         program
@@ -85,12 +115,28 @@ const programHandler = () => {
             .addOption(new Option('--address <address>', 'address of contract to check'))
             .addOption(new Option('--coordinator <coordinator address>', 'coordinator address'))
             .addOption(new Option('--multisig <multisig address>', 'multisig address'))
-            .description('check migration succeeded')
+            .description('Check migration succeeded')
             .action((options: MigrationCheckOptions) => {
                 mainQueryProcessor(checkMigration, options, []);
             }),
     );
 
+    addAmplifierOptions(
+        program
+            .command('coordinator-instantiate-permissions')
+            .argument('<code_id>', 'coordinator will have instantiate permissions for this code id')
+            .argument('<current_permissions>', 'current instantiate permissions for given contract')
+            .addOption(new Option('--address <address>', 'contract address (overrides config)'))
+            .option('--dry', 'only generate migration msg')
+            .description('Give coordinator instantiate permissions for the given code id')
+            .action((codeId: string, currentPermissions: string, options: MigrationOptions) => {
+                mainProcessor(coordinatorInstantiatePermissions, options, [codeId, currentPermissions]);
+            }),
+        {
+            proposalOptions: true,
+        },
+    );
+
     program.parse();
 };
 

cosmwasm/migrate/multisig.ts

@@ -95,6 +95,6 @@ export async function migrate(
         case '2.1.0':
             return multisigToVersion2_3_1(client, options, config, senderAddress, multisigAddress, codeId, fee);
         default:
-            printError(`no migration script found for coordinator ${version}`);
+            printError(`no migration script found for multisig ${version}`);
     }
 }

cosmwasm/migrate/types.ts

@@ -7,6 +7,8 @@ export interface MigrationOptions extends Options {
     dry?: boolean;
     direct?: boolean;
     ignoreChains?: string;
+    title?: string;
+    description?: string;
 }
 
 export interface MigrationCheckOptions extends Options {
@@ -20,3 +22,9 @@ export interface ProtocolContracts {
     router: string;
     multisig: string;
 }
+
+export interface InstantiatePermission {
+    permission?: string;
+    address?: string;
+    addresses?: string[];
+}

cosmwasm/utils.js

@@ -13,6 +13,7 @@ const {
     InstantiateContract2Proposal,
     ExecuteContractProposal,
     MigrateContractProposal,
+    UpdateInstantiateConfigProposal,
 } = require('cosmjs-types/cosmwasm/wasm/v1/proposal');
 const { ParameterChangeProposal } = require('cosmjs-types/cosmos/params/v1beta1/params');
 const { AccessType } = require('cosmjs-types/cosmwasm/wasm/v1/types');
@@ -968,6 +969,15 @@ const getParameterChangeParams = ({ title, description, changes }) => ({
     })),
 });
 
+const getUpdateInstantiateParams = (options) => {
+    const { msg } = options;
+
+    return {
+        ...getSubmitProposalParams(options),
+        accessConfigUpdates: JSON.parse(msg),
+    };
+};
+
 const getMigrateContractParams = (config, options) => {
     const { msg, chainName } = options;
 
@@ -1048,6 +1058,15 @@ const encodeParameterChangeProposal = (options) => {
     };
 };
 
+const encodeUpdateInstantiateConfigProposal = (options) => {
+    const proposal = UpdateInstantiateConfigProposal.fromPartial(getUpdateInstantiateParams(options));
+
+    return {
+        typeUrl: '/cosmwasm.wasm.v1.UpdateInstantiateConfigProposal',
+        value: Uint8Array.from(UpdateInstantiateConfigProposal.encode(proposal).finish()),
+    };
+};
+
 const encodeMigrateContractProposal = (config, options) => {
     const proposal = MigrateContractProposal.fromPartial(getMigrateContractParams(config, options));
 
@@ -1448,6 +1467,7 @@ module.exports = {
     encodeInstantiate2Proposal,
     encodeExecuteContractProposal,
     encodeParameterChangeProposal,
+    encodeUpdateInstantiateConfigProposal,
     encodeMigrateContractProposal,
     submitProposal,
     isValidCosmosAddress,

releases/cosmwasm/2025-09-Coordinator-v2.1.1.md

@@ -31,6 +31,7 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
 
 1. The coordinator now stores both the router and multisig contract addresses in its state. This information will be given to the coordinator after it is instantiated using the *RegisterProtocol* message. The service registry address will also be registered using *RegisterProtocol*, where it was previously in the coordinator's instantiate message.
 1. Previously, registering a chain with the coordinator involved specifying only the multisig prover's address. Now, registration must also include the corresponding gateway and voting verifier addresses.
+1. The coordinator's migration script will default to using the provided prover/chain pairs instead of the prover/chain pairs registered in its state.
 
 ### Multisig v2.3.1
 
@@ -47,6 +48,11 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
 - This rollout upgrades the amplifier coordinator contract from `v1.1.0` to `v2.1.1`, the multisig contract from `v2.1.0` to `v2.3.1`, and the router from `v1.2.0` to `v1.3.0`.
 - State migration is required for all three contracts.
 
+   | Component        | Versions Tested                                                                                                                           
+   | ---------------- | ---------------- |
+   | Cosmos SDK | 0.47.x |
+   | Wasm         | 0.34.x |
+
 1. Retrieve coordinator address from the appropriate config file for the environment. (ENV: devnet, testnet, stagenet or mainnet)
 
    ```bash
@@ -109,7 +115,7 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
      --deposit $DEPOSIT_VALUE
    ```
 
-   Provide coordinator address to the multisig.
+   Provide coordinator address to the multisig, and migrate using the contract deployment scripts.
 
    ```bash
    ts-node cosmwasm/migrate/migrate.ts migrate <multisig_code_id> \
@@ -118,8 +124,6 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
       -d $DEPOSIT_VALUE \
    ```
 
-   The `default_authorized_provers` object should correspond to the chain/prover pairs located at `axelar.contracts.MultisigProver` in `$ENV.json`.
-
 1. Migrate to Coordinator v2.1.1 using the contract deployment scripts
 
    ```bash
@@ -133,6 +137,19 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
 
    **Warning:** Using the `--ignoreChains [chains to ignore...]` flag might introduce protocol breaking behaviour, so it should be used only in a test environment. Coordinator v2 requires the gateways, verifiers and provers for each chain to be unique. You may ignore chains in the event that there are multiple chains that use the same verifier. This is possible because the protocol allows different gateways to be instantiated with the same verifier.
 
+1. (Optional) Give the Coordinator Permission to Instantiate Gateway, Verifier and Prover
+
+   The coordinator needs to have permission from the wasm module to instantiate gateways, verifiers and provers. You may retrieve these code ids by checking `.axelar.contracts.Gateway.$CHAIN.codeId`, `.axelar.contracts.VotingVerifier.$CHAIN.codeId` and `.axelar.contracts.MultisigProver.$CHAIN.codeId` respectively. To get the current instantiate permissions for a particular code id, run the following command:
+
+   ```bash
+   axelard q wasm code-info <code id> --node <node rpc>
+   ```
+
+   We have provided a script that submits a proposal to append the coordinator's address to the list of allowed addresses for a given code id. A proposal will not be created if the coordinator is already allowed to instantiate that contract. To execute that script, run:
+
+   ```bash
+   ts-node cosmwasm/migrate/migrate.ts coordinator-instantiate-permissions <code id> "'$(axelard q wasm code-info <code id> --node <node rpc> --output json | jq -c .instantiate_permission)'" --deposit 100000000 -e devnet-amplifier -t $TITLE -d $DESCRIPTION -m $MNEMONIC
+   ```
 ## Checklist
 
 1. Verify router contract version
@@ -172,7 +189,7 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
    Expected output
 
    ```bash
-   {contract: 'multisig', version: '2.3.0'}
+   {contract: 'multisig', version: '2.3.1'}
    ```
 
 1. Verify the coordinator address is stored on the multisig
@@ -210,4 +227,9 @@ The coordinator can now deploy a gateway, voting verifier, and multisig prover c
    ts-node cosmwasm/migrate/migrate.ts check -e $ENV -c Coordinator 
    ```
 
-   You may manually specify the address of the coordinator and multisig by using the `--coordinator` and `--multisig` flags respectively.
+   You may optionally specify the address of the coordinator and multisig by using the `--coordinator` and `--multisig` flags respectively.
+
+   Expected Output
+   ```bash
+   ✅ Migration succeeded!
+   ```