Dedicated validator role for crowdfunding milestone co-authorization (admin quorum is used today)

[0xdevcollins]

Source: docs/threat-model.md v1.0, Spoof.2 (accepted; planned hardening).

Finding

claim_milestone for crowdfunding calls require_auth() on storage::get_admin(env) (grant.rs) — the same DataKey::Admin address that gates pause, fees, the token list, and (with the timelock at zero) upgrades. There is no separate co-signer role in the contract. The mainnet admin is a genuine 2-of-3 (three weight-1 signers, medium/high thresholds 2, master key weight 0 — Horizon, 2026-09-11), so a single backend-held key cannot satisfy the check: every crowdfunding milestone release requires the admin quorum.

Please confirm how crowdfunding milestone claims are actually signed in production. If a server holds two signer keys to make this routine, that is a full admin compromise waiting to happen and contradicts docs/admin-custody-policy.md; if the quorum signs each milestone by hand, the design imposes a ceremony on a routine flow.

Change

• Add a Validator role in instance storage (set by admin, two-step or timelocked rotation), used only by claim_milestone for crowdfunding
• Keep the owner's require_auth(); the validator replaces the admin in that one check
• Backend co-signs with the validator key; the admin quorum is never exercised in a routine flow
• Update the threat model (Spoof.2, EoP.3, EoP.7, Info.3) and the custody policy

[omeruahelisha8-png]

Hi Maintainer,
I'd like to contribute by resolving this issue. I've reviewed the details and am ready to get started.
Kindly assign it to me. Thanks!

[abojeEdwin]

Hi maintainer, I've gone through the issue and I have a clear understanding of the fix for this issue. I'd love to be assigned to this issue. Thank you

[ranjeet150]

Hello maintainers @boundlessfi,

I would like to implement the dedicated validator role for crowdfunding milestone co-authorization (#140) to separate operational co-authorization from general admin quorum.

Execution Plan:

1. Role Segregation:
   • Introduce DataKey::Validator(Address) and configurable validator thresholds in contract storage.
   • Implement set_validator(&env, admin, validator_addr, enabled) guarded by admin auth.
2. Milestone Co-Authorization Gate:
   • Update claim_milestone to require explicit validator signature/auth alongside creator/admin authorization.
3. Testing:
   • Test admin assigning/revoking validator role.
   • Test milestone release with valid validator signature succeeding.
   • Assert unauthorized release attempts without validator co-signature fail closed.

Looking forward to delivering this cleanly with 100% green tests. Please feel free to assign!