update grant role to revoke personal deployer admin

[nguyennk92]

Note

Medium Risk
Touches access-control administration by granting/revoking DEFAULT_ADMIN_ROLE/ADMIN_ROLE; a misconfigured MULTISIG or execution on the wrong deployment address could lock out admin control.

Overview
Moves post-deploy role management toward multisig custody by updating GrantRole.s.sol to grant DEFAULT_ADMIN_ROLE/ADMIN_ROLE to MULTISIG and revoke those roles from the deployer address (derived from PRIVATE_KEY), and adds a new V3UtilsGrantRoleScript alongside the existing V3Automation flow.

Updates tooling/config to support this: the Makefile now exposes grant-role-v3automation and grant-role-v3utils targets, sample.env adds MULTISIG, and contracts.json adds additional chain-id entries (130, 999, 43114).

^{Written by Cursor Bugbot for commit 1457ea3. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Script revokes from wrong address, causing failure

High Severity

The scripts try to revoke roles from deployerAddress (derived from PRIVATE_KEY) and assume this address has DEFAULT_ADMIN_ROLE. However, during initialization in Init.s.sol, roles are granted to the WITHDRAWER address (via admin in CommonScript), not the deployer. If these addresses differ, the grantRole calls will revert because deployerAddress lacks admin permissions, and even if they succeed, the revokeRole calls would revoke from the wrong account—failing to remove the actual admin's privileges.

Additional Locations (1)

• script/GrantRole.s.sol#L67-L69

 

[cursor]

Makefile references removed grant-role target

Medium Severity

The deploy-everything target calls make grant-role on line 62, but this target was renamed to grant-role-v3automation in the same diff. Running make deploy-everything will fail at this step. Additionally, the new grant-role-v3utils target is not included, so even if corrected to call only grant-role-v3automation, the V3Utils contract wouldn't have its roles configured.