Repository navigation
[Feat]: Move every dotNS owner power to governance (Root) #238
Description
Component
Other
Priority
P0
Summary
At launch, one owner key (the deployer's) controls the whole protocol and can change any contract or rule without a governance vote. Deployment on mainnet is run by an external third-party. A lost or compromised key means full control of names and of the funds held in escrow.
What the owner key can do:
| Power | Where |
|---|---|
| Replace any contract's code | _authorizeUpgrade on all 13 UUPS proxies |
| Replace the code of every user's store | StoreFactory: upgradeUserStoreImplementation, upgradeLabelStoreImplementation |
| Swap protocol components, and decide which contracts count as dotNS | DotnsProtocolRegistry: set, remove, setProtocolVersion, setExpectedCodehash |
| Allow new contracts to mint names | DotnsRegistrar: addController, removeController |
| Set prices | DotnsCostModelRegistry: register, setCurrentVersion |
| Tune reservation and release timings | DotnsPopController.setReservationDuration, DotnsNameEscrow: updateCooldown, updateRedeemWindow |
| Hand all of this to another key | transferOwnership on every owned contract |
Proposal
Option 1: governance. Every power above accepts only a Root dispatch, and the owner role is removed. The owner's last action is an upgrade of every contract to code that accepts only governance.
- The check is
callerIsRoot(), which is true only in the contract that Root dispatched to. It needs pallet-revive: fix callerIsRoot and callerIsOrigin across delegate calls polkadot-sdk#13413 on Asset Hub.originIsRoot()must not be used here ([Bug]: Root-origin gates are transaction-wide, so any contract a Root call reaches inherits DotNS governance #300). - There is no key to steal, but also no quick fix. A governance track with a short decision period must be chosen before the handover: its origin, decision period and deciding body (merged from [Feat]: Short-run governance track and operator management for reservations #205; runtime side in Asset Hub Polkadot: governance ownership of the dotNS contracts through a runtime account and a dedicated track polkadot-fellows/runtimes#1326). It covers two kinds of decision:
- urgent fixes;
- routine name decisions:
DotnsNameWhitelistaccept,reject,grantNamesandsetReservedare Root-only, and a full referendum per name may be too slow for a claim vetting window.
Option 2: owner key. The owner stays, ideally as a multisig. Changes are one transaction, but the keys remain a target that can change anything.
Recommendation. Option 1: every power moves to governance, and no key keeps any impactful power after the handover. This choice is now set in stone.
Acceptance criteria
- Decision recorded.
- The governance track is chosen before the handover (origin, decision period, deciding body), covering urgent fixes and routine whitelist decisions.
- Every function above accepts a Root dispatch and rejects signed calls and indirect Root calls, with a test for each.
- The handover upgrade is planned for each network.
EDITED by @re-gius on 13th Oct 2026
Activity
feat: whitelist names before mainnet (#239)
[-][Feat]: Decide contract upgrade authority: governance (Root) or a wallet[/-][+][Feat]: Decide who controls dotNS after launch: governance (Root) or an owner key[/+]re-gius commentedon Oct 13, 2026
Update: decided. Every power and privilege listed above moves to governance (Option 1), and no PCF or Parity key keeps any impactful power after the handover. This is now urgent (P0): the mainnet contracts are live, and every proxy is still owned by a single account that can upgrade any of them.
The runtime side is tracked in polkadot-fellows/runtimes#1326. It covers the decision on a dedicated origin and track.
[-][Feat]: Decide who controls dotNS after launch: governance (Root) or an owner key[/-][+][Feat]: Move every dotNS owner power to governance (Root)[/+]