Treasury Audit Fixes

[Peartes]

Enhance contract security with address validation, two-step ownership transfer, and key existence checks

Description

This commit improves the security and robustness of the contract by addressing several issues identified during the audit and implementing recommended changes:

Changes

1. Address Validation for Admin Updates

• Added validation using deps.api.addr_validate() to ensure the new_admin address has the correct format before storing it.
• Prevents invalid or unchecked addresses from being set as the admin.

2. Two-Step Ownership Transfer

• Implemented a two-step process to safely update the admin address:
  • propose_admin: The current admin proposes a new admin.
  • accept_admin: The proposed admin accepts ownership.
  • cancel_proposed_admin: The current admin can cancel a pending transfer.
• Ensures ownership cannot be accidentally transferred to an invalid or unintended address.

3. Key Existence Validation for Removals

• Added has() checks before removing entries:
  • remove_auth_method: Checks the key exists in AUTHENTICATORS before removal.
  • remove_grant_config: Checks the key exists in GRANT_CONFIGS before removal.
• Returns a NotFound error if the key does not exist, preventing misleading operations.