Summary
Only the current fee recipient for a creator can rotate it to a new address. A call from any other wallet — including the creator's registered wallet — must be rejected with Unauthorized. This access control case needs explicit unit test coverage.
Scope
- Register a creator with a specific fee recipient address
- Attempt to call
update_creator_fee_recipient from the creator's own wallet (not the fee recipient) and assert it reverts with Unauthorized
- Attempt from a random third wallet and assert it also reverts
- Call from the actual current fee recipient and assert it succeeds
Acceptance Criteria
ETA: 12 hours
Coordinate on Telegram
Summary
Only the current fee recipient for a creator can rotate it to a new address. A call from any other wallet — including the creator's registered wallet — must be rejected with
Unauthorized. This access control case needs explicit unit test coverage.Scope
update_creator_fee_recipientfrom the creator's own wallet (not the fee recipient) and assert it reverts withUnauthorizedAcceptance Criteria
UnauthorizedUnauthorizedETA: 12 hours
Coordinate on Telegram