feat: migrate StakingRewardDistributor to AccessControl and make LockedTokenStaker upgradeable

- Replace Ownable with AccessControl in StakingRewardDistributor
  - Add DEFAULT_ADMIN_ROLE for timelock and REWARD_MANAGER_ROLE for treasury
  - Implement migrateToAccessControl() for safe live contract upgrade
  - Update all access control checks to use role-based permissions

- Make LockedTokenStaker upgradeable
  - Convert to Initializable pattern with proxy support
  - Add unique identifier requirement to prevent salt collisions
  - Support multiple instances (Reown, WalletConnect, Backers)

- Enhance Pauser contract
  - Add isStakingRewardDistributorPaused flag and controls
  - Integrate with StakingRewardDistributor pause checks
  - Maintain role separation (PAUSER_ROLE vs UNPAUSER_ROLE)

- Add comprehensive fork tests
  - Test complete upgrade path with 7-day timelock delays
  - Verify role assignments and permissions
  - Test pause/unpause flow with Manager Timelock
  - Include StakeWeight upgrade for full integration testing

- Update deployment scripts and helpers
  - Fix deployment count from 14 to 15 contracts
  - Add proxy helpers for LockedTokenStaker
  - Support unique identifiers for multiple instances

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: rplusq

evm/script/Base.s.sol

@@ -114,12 +114,12 @@ abstract contract BaseScript is Script, StdCheats {
             });
         }
         // Length per address is 32 bytes => 64 characters
-        // 10 addresses are needed for the Optimism deployments
-        // If the length is not 0 nor 64 * 14, we assume the deployments are missing contracts and we append as much
-        // as needed to make it 64 * 14 bytes
-        if (data.length != 64 * 14) {
+        // 15 addresses are needed for the Optimism deployments
+        // If the length is not 0 nor 64 * 15, we assume the deployments are missing contracts and we append as much
+        // as needed to make it 64 * 15 bytes
+        if (data.length != 64 * 15) {
             console2.log("Appending zeroes to deployments");
-            while (data.length < 64 * 14) {
+            while (data.length < 64 * 15) {
                 data = bytes.concat(data, abi.encode(bytes32(0)));
             }
         }

evm/script/deploy/OptimismDeploy.s.sol

@@ -22,7 +22,8 @@ import {
     newWalletConnectConfig,
     newPauser,
     newStakeWeight,
-    newStakingRewardDistributor
+    newStakingRewardDistributor,
+    newLockedTokenStaker
 } from "script/helpers/Proxy.sol";
 
 struct OptimismDeploymentParams {
@@ -233,19 +234,36 @@ contract OptimismDeploy is BaseScript {
         }
 
         if (address(deps.lockedTokenStakerReown) == address(0)) {
-            deps.lockedTokenStakerReown = new LockedTokenStaker{
-                salt: keccak256(abi.encodePacked("walletconnect.lockedtokenstaker"))
-            }(deps.merkleVesterReown, WalletConnectConfig(address(deps.config)));
+            deps.lockedTokenStakerReown = newLockedTokenStaker({
+                initialOwner: address(deps.adminTimelock),
+                init: LockedTokenStaker.Init({
+                    vesterContract: address(deps.merkleVesterReown),
+                    config: address(deps.config)
+                }),
+                identifier: "reown"
+            });
         }
 
         if (address(deps.lockedTokenStakerWalletConnect) == address(0)) {
-            deps.lockedTokenStakerWalletConnect =
-                new LockedTokenStaker(deps.merkleVesterWalletConnect, WalletConnectConfig(address(deps.config)));
+            deps.lockedTokenStakerWalletConnect = newLockedTokenStaker({
+                initialOwner: address(deps.adminTimelock),
+                init: LockedTokenStaker.Init({
+                    vesterContract: address(deps.merkleVesterWalletConnect),
+                    config: address(deps.config)
+                }),
+                identifier: "walletconnect"
+            });
         }
 
         if (address(deps.lockedTokenStakerBackers) == address(0)) {
-            deps.lockedTokenStakerBackers =
-                new LockedTokenStaker(deps.merkleVesterBackers, WalletConnectConfig(address(deps.config)));
+            deps.lockedTokenStakerBackers = newLockedTokenStaker({
+                initialOwner: address(deps.adminTimelock),
+                init: LockedTokenStaker.Init({
+                    vesterContract: address(deps.merkleVesterBackers),
+                    config: address(deps.config)
+                }),
+                identifier: "backers"
+            });
         }
 
         if (vm.envOr("BROADCAST", false)) {
@@ -356,9 +374,10 @@ contract OptimismDeploy is BaseScript {
             console2.log("L2WCT default admin is Admin MultiSig");
         }
 
-        // StakingRewardDistributor
-        if (deps.stakingRewardDistributor.owner() != address(params.treasury)) {
-            revert("StakingRewardDistributor owner is not Treasury");
+        // StakingRewardDistributor - check REWARD_MANAGER_ROLE instead of owner
+        bytes32 REWARD_MANAGER_ROLE = keccak256("REWARD_MANAGER_ROLE");
+        if (!deps.stakingRewardDistributor.hasRole(REWARD_MANAGER_ROLE, address(params.treasury))) {
+            revert("StakingRewardDistributor: Treasury does not have REWARD_MANAGER_ROLE");
         }
 
         // Config

evm/script/helpers/Proxy.sol

@@ -12,6 +12,7 @@ import { Staking } from "src/Staking.sol";
 import { StakeWeight } from "src/StakeWeight.sol";
 import { StakingRewardDistributor } from "src/StakingRewardDistributor.sol";
 import { MockERC20 } from "test/mocks/MockERC20.sol";
+import { LockedTokenStaker } from "src/LockedTokenStaker.sol";
 
 function newWCT(address initialOwner, WCT.Init memory init) returns (WCT) {
     bytes32 salt = keccak256(abi.encodePacked("walletconnect.wct"));
@@ -127,6 +128,26 @@ function newStakeWeight(address initialOwner, StakeWeight.Init memory init) retu
     return StakeWeight(address(proxy));
 }
 
+function newLockedTokenStaker(
+    address initialOwner,
+    LockedTokenStaker.Init memory init,
+    string memory identifier
+)
+    returns (LockedTokenStaker)
+{
+    require(bytes(identifier).length > 0, "Identifier cannot be empty");
+    bytes32 salt = keccak256(abi.encodePacked("walletconnect.lockedtokenstaker.", identifier));
+
+    LockedTokenStaker impl = new LockedTokenStaker{ salt: salt }();
+    TransparentUpgradeableProxy proxy = new TransparentUpgradeableProxy{ salt: salt }({
+        _logic: address(impl),
+        initialOwner: address(initialOwner),
+        _data: abi.encodeCall(LockedTokenStaker.initialize, init)
+    });
+
+    return LockedTokenStaker(address(proxy));
+}
+
 function newMockERC20(address initialOwner) returns (MockERC20) {
     bytes32 salt = keccak256(abi.encodePacked("walletconnect.mockerc20"));
 

evm/src/LockedTokenStaker.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: MIT
 pragma solidity 0.8.25;
 
+import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
+import { AccessControlUpgradeable } from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
 import { SafeCast } from "@openzeppelin/contracts/utils/math/SafeCast.sol";
 import { StakeWeight } from "src/StakeWeight.sol";
 import { WalletConnectConfig } from "src/WalletConnectConfig.sol";
@@ -22,14 +24,14 @@ import { Pauser } from "./Pauser.sol";
  * @notice This contract handles staking without token transfer, as the tokens are already locked in the vesting
  * contract. Then on postClaim, it prevents claiming with an active lock in the staking contract.
  */
-contract LockedTokenStaker is IPostClaimHandler {
+contract LockedTokenStaker is Initializable, IPostClaimHandler {
     using SafeERC20 for IERC20;
 
     // The address of the vester contract that will call this handler
-    MerkleVester public immutable vesterContract;
+    MerkleVester public vesterContract;
 
     // The configuration for the WalletConnect system
-    WalletConnectConfig public immutable config;
+    WalletConnectConfig public config;
 
     error InvalidCaller();
     error TerminatedAllocation();
@@ -38,14 +40,27 @@ contract LockedTokenStaker is IPostClaimHandler {
     error CannotClaimLockedTokens(uint256 remainingAllocation, uint256 lockedAmount, uint256 claimAmount);
     error Paused();
 
+    /// @notice Initialization parameters
+    struct Init {
+        address vesterContract;
+        address config;
+    }
+
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     /**
-     * @notice Constructor to set up the ClaimAndStakeHandler
-     * @param vesterContract_ The address of the vester contract
-     * @param config_ The configuration for the WalletConnect system
+     * @notice Initialize the contract
+     * @param init Initialization parameters
      */
-    constructor(MerkleVester vesterContract_, WalletConnectConfig config_) {
-        vesterContract = vesterContract_;
-        config = config_;
+    function initialize(Init memory init) external initializer {
+        if (init.vesterContract == address(0)) revert InvalidCaller();
+        if (init.config == address(0)) revert InvalidCaller();
+
+        vesterContract = MerkleVester(init.vesterContract);
+        config = WalletConnectConfig(init.config);
     }
 
     modifier whenNotPaused() {

evm/src/Pauser.sol

@@ -37,6 +37,9 @@ contract Pauser is Initializable, AccessControlUpgradeable {
     /// @notice Flag indicating if wallet reward manager is paused
     bool public isWalletRewardManagerPaused;
 
+    /// @notice Flag indicating if staking reward distributor is paused
+    bool public isStakingRewardDistributorPaused;
+
     /// @notice Configuration for contract initialization
     struct Init {
         address admin;
@@ -111,6 +114,17 @@ contract Pauser is Initializable, AccessControlUpgradeable {
         _setIsWalletRewardManagerPaused(isPaused);
     }
 
+    /// @notice Pauses or unpauses staking reward distributor
+    /// @param isPaused The new pause state
+    function setIsStakingRewardDistributorPaused(bool isPaused) external {
+        if (isPaused) {
+            _checkRole(PAUSER_ROLE);
+        } else {
+            _checkRole(UNPAUSER_ROLE);
+        }
+        _setIsStakingRewardDistributorPaused(isPaused);
+    }
+
     /// @dev Sets the node reward manager pause state
     /// @param isPaused The new pause state
     function _setIsNodeRewardManagerPaused(bool isPaused) private {
@@ -140,6 +154,7 @@ contract Pauser is Initializable, AccessControlUpgradeable {
         _setIsLockedTokenStakerPaused(true);
         _setIsNodeRewardManagerPaused(true);
         _setIsWalletRewardManagerPaused(true);
+        _setIsStakingRewardDistributorPaused(true);
     }
 
     /// @notice Unpauses all actions
@@ -149,6 +164,7 @@ contract Pauser is Initializable, AccessControlUpgradeable {
         _setIsLockedTokenStakerPaused(false);
         _setIsNodeRewardManagerPaused(false);
         _setIsWalletRewardManagerPaused(false);
+        _setIsStakingRewardDistributorPaused(false);
     }
 
     /// @dev Sets the staking pause state
@@ -183,4 +199,15 @@ contract Pauser is Initializable, AccessControlUpgradeable {
             flagName: "isLockedTokenStakerPaused"
         });
     }
+
+    /// @dev Sets the staking reward distributor pause state
+    /// @param isPaused The new pause state
+    function _setIsStakingRewardDistributorPaused(bool isPaused) private {
+        isStakingRewardDistributorPaused = isPaused;
+        emit FlagUpdated({
+            selector: this.isStakingRewardDistributorPaused.selector,
+            isPaused: isPaused,
+            flagName: "isStakingRewardDistributorPaused"
+        });
+    }
 }