PoaManagerHub V2: Satellite-only admin calls for cross-chain governance

[hudsonhrh]

Problem

adminCallCrossChain(target, data) always executes on the home chain first, then broadcasts to all satellites using the same target address. This breaks when contracts have different proxy addresses on different chains (e.g., PaymasterHub is 0xD665... on Arbitrum, 0xdEf1... on Gnosis).

This prevents governance from managing chain-specific contracts and blocks the Poa Executor from taking over protocol admin duties for cross-chain operations.

Proposed Solution

Deploy Hub V2 with two new functions:

adminCallSatelliteOnly(uint32 domain, address target, bytes data)

Send a MSG_ADMIN_CALL to a specific satellite without executing on the home chain. Targets different contract addresses per chain.

adminCallPerChain(address homeTarget, bytes homeData, uint32 satDomain, address satTarget, bytes satData)

Execute different admin calls on home chain and a specific satellite in one transaction.

Key Challenge: Satellite hubAddress is Immutable

The Satellite validates _sender == hubAddress (set in constructor, immutable). Deploying Hub V2 at a new address means the existing Satellite rejects its messages.

Solution: Deploy Satellite V2 with:

• setHubAddress(address) — owner-callable to update without redeployment
• transferPoaManagerOwnership(address) — enables ownership migration

Migration Path

1. Deploy Hub V2 + Satellite V2
2. Re-register satellites on Hub V2
3. Transfer PoaManager ownership (Arbitrum: Hub V1 → Hub V2, Gnosis: old Satellite → new Satellite)
4. Transfer Hub V2 ownership to Poa Executor for governance control

Governance Flow After Migration

Proposal: "Raise solidarity fee to 5%"
Batch:
  1. Hub.adminCall(ARB_PM, setSolidarityFee(500))
  2. Hub.adminCallSatelliteOnly(100, GNOSIS_PM, setSolidarityFee(500))

Design Doc

Full analysis including ownership transfer challenges, risk assessment, and alternatives: docs/hub-v2-satellite-only-admin-call.md

Interim Workaround

Continue using protocolAdmin on PaymasterHub for Gnosis-specific admin calls. Works for adminBatchAddRules, setSolidarityFee, etc. Governance handoff for Arbitrum-only operations can proceed via Hub V1.