Deploy call proxy instead of using deployer executor keys

deployment/ccip/changeset/cs_add_chain_test.go

@@ -52,11 +52,10 @@ func TestAddChainInbound(t *testing.T) {
 	require.NoError(t, e.Env.ExistingAddresses.Merge(newAddresses))
 
 	cfg := commontypes.MCMSWithTimelockConfig{
-		Canceller:         commonchangeset.SingleGroupMCMS(t),
-		Bypasser:          commonchangeset.SingleGroupMCMS(t),
-		Proposer:          commonchangeset.SingleGroupMCMS(t),
-		TimelockExecutors: e.Env.AllDeployerKeys(),
-		TimelockMinDelay:  big.NewInt(0),
+		Canceller:        commonchangeset.SingleGroupMCMS(t),
+		Bypasser:         commonchangeset.SingleGroupMCMS(t),
+		Proposer:         commonchangeset.SingleGroupMCMS(t),
+		TimelockMinDelay: big.NewInt(0),
 	}
 	e.Env, err = commonchangeset.ApplyChangesets(t, e.Env, nil, []commonchangeset.ChangesetApplication{
 		{

deployment/ccip/changeset/cs_deploy_chain_test.go

@@ -31,11 +31,10 @@ func TestDeployChainContractsChangeset(t *testing.T) {
 	cfg := make(map[uint64]commontypes.MCMSWithTimelockConfig)
 	for _, chain := range e.AllChainSelectors() {
 		cfg[chain] = commontypes.MCMSWithTimelockConfig{
-			Canceller:         commonchangeset.SingleGroupMCMS(t),
-			Bypasser:          commonchangeset.SingleGroupMCMS(t),
-			Proposer:          commonchangeset.SingleGroupMCMS(t),
-			TimelockExecutors: e.AllDeployerKeys(),
-			TimelockMinDelay:  big.NewInt(0),
+			Canceller:        commonchangeset.SingleGroupMCMS(t),
+			Bypasser:         commonchangeset.SingleGroupMCMS(t),
+			Proposer:         commonchangeset.SingleGroupMCMS(t),
+			TimelockMinDelay: big.NewInt(0),
 		}
 	}
 	e, err = commonchangeset.ApplyChangesets(t, e, nil, []commonchangeset.ChangesetApplication{

deployment/ccip/changeset/test_helpers.go

@@ -279,11 +279,10 @@ func NewMemoryEnvironmentWithJobsAndContracts(t *testing.T, lggr logger.Logger,
 	mcmsCfg := make(map[uint64]commontypes.MCMSWithTimelockConfig)
 	for _, c := range e.Env.AllChainSelectors() {
 		mcmsCfg[c] = commontypes.MCMSWithTimelockConfig{
-			Canceller:         commonchangeset.SingleGroupMCMS(t),
-			Bypasser:          commonchangeset.SingleGroupMCMS(t),
-			Proposer:          commonchangeset.SingleGroupMCMS(t),
-			TimelockExecutors: e.Env.AllDeployerKeys(),
-			TimelockMinDelay:  big.NewInt(0),
+			Canceller:        commonchangeset.SingleGroupMCMS(t),
+			Bypasser:         commonchangeset.SingleGroupMCMS(t),
+			Proposer:         commonchangeset.SingleGroupMCMS(t),
+			TimelockMinDelay: big.NewInt(0),
 		}
 	}
 	var (

deployment/common/changeset/internal/mcms.go

@@ -106,10 +106,10 @@ func DeployMCMSWithTimelockContracts(
 				// TODO: Could expose this as config?
 				// Or keep this enforced to follow the same pattern?
 				chain.DeployerKey.From,
-				[]common.Address{proposer.Address},  // proposers
-				config.TimelockExecutors,            //executors
-				[]common.Address{canceller.Address}, // cancellers
-				[]common.Address{bypasser.Address},  // bypassers
+				[]common.Address{proposer.Address}, // proposers
+				[]common.Address{},                 // executors
+				[]common.Address{canceller.Address, proposer.Address, bypasser.Address}, // cancellers
+				[]common.Address{bypasser.Address},                                      // bypassers
 			)
 			return deployment.ContractDeploy[*owner_helpers.RBACTimelock]{
 				timelock, cc, tx2, deployment.NewTypeAndVersion(types.RBACTimelock, deployment.Version1_0_0), err2,
@@ -119,6 +119,37 @@ func DeployMCMSWithTimelockContracts(
 		lggr.Errorw("Failed to deploy timelock", "chain", chain.String(), "err", err)
 		return nil, err
 	}
+
+	callProxy, err := deployment.DeployContract(lggr, chain, ab,
+		func(chain deployment.Chain) deployment.ContractDeploy[*owner_helpers.CallProxy] {
+			callProxy, tx2, cc, err2 := owner_helpers.DeployCallProxy(
+				chain.DeployerKey,
+				chain.Client,
+				timelock.Address,
+			)
+			return deployment.ContractDeploy[*owner_helpers.CallProxy]{
+				callProxy, cc, tx2, deployment.NewTypeAndVersion(types.CallProxy, deployment.Version1_0_0), err2,
+			}
+		})
+	if err != nil {
+		lggr.Errorw("Failed to deploy call proxy", "chain", chain.String(), "err", err)
+		return nil, err
+	}
+
+	grantRoleTx, err := timelock.Contract.GrantRole(
+		chain.DeployerKey,
+		v1_0.EXECUTOR_ROLE.ID,
+		callProxy.Address,
+	)
+	if err != nil {
+		lggr.Errorw("Failed to grant timelock executor role", "chain", chain.String(), "err", err)
+		return nil, err
+	}
+
+	if _, err := deployment.ConfirmIfNoError(chain, grantRoleTx, err); err != nil {
+		lggr.Errorw("Failed to grant timelock executor role", "chain", chain.String(), "err", err)
+		return nil, err
+	}
 	// We grant the timelock the admin role on the MCMS contracts.
 	tx, err := timelock.Contract.GrantRole(chain.DeployerKey,
 		v1_0.ADMIN_ROLE.ID, timelock.Address)

deployment/common/changeset/internal/mcms_test.go

@@ -5,7 +5,6 @@ import (
 	"math/big"
 	"testing"
 
-	"github.com/ethereum/go-ethereum/common"
 	chainsel "github.com/smartcontractkit/chain-selectors"
 	"github.com/stretchr/testify/require"
 
@@ -37,18 +36,15 @@ func TestDeployMCMSWithTimelockContracts(t *testing.T) {
 	_, err := internal.DeployMCMSWithTimelockContracts(lggr,
 		chains[chainsel.TEST_90000001.Selector],
 		ab, types.MCMSWithTimelockConfig{
-			Canceller: changeset.SingleGroupMCMS(t),
-			Bypasser:  changeset.SingleGroupMCMS(t),
-			Proposer:  changeset.SingleGroupMCMS(t),
-			TimelockExecutors: []common.Address{
-				chains[chainsel.TEST_90000001.Selector].DeployerKey.From,
-			},
+			Canceller:        changeset.SingleGroupMCMS(t),
+			Bypasser:         changeset.SingleGroupMCMS(t),
+			Proposer:         changeset.SingleGroupMCMS(t),
 			TimelockMinDelay: big.NewInt(0),
 		})
 	require.NoError(t, err)
 	addresses, err := ab.AddressesForChain(chainsel.TEST_90000001.Selector)
 	require.NoError(t, err)
-	require.Len(t, addresses, 4)
+	require.Len(t, addresses, 5)
 	mcmsState, err := changeset.MaybeLoadMCMSWithTimelockState(chains[chainsel.TEST_90000001.Selector], addresses)
 	require.NoError(t, err)
 	v, err := mcmsState.GenerateMCMSWithTimelockView()

deployment/common/changeset/transfer_to_mcms_with_timelock_test.go

@@ -30,11 +30,10 @@ func TestTransferToMCMSWithTimelock(t *testing.T) {
 			Changeset: WrapChangeSet(DeployMCMSWithTimelock),
 			Config: map[uint64]types.MCMSWithTimelockConfig{
 				chain1: {
-					Canceller:         SingleGroupMCMS(t),
-					Bypasser:          SingleGroupMCMS(t),
-					Proposer:          SingleGroupMCMS(t),
-					TimelockExecutors: e.AllDeployerKeys(),
-					TimelockMinDelay:  big.NewInt(0),
+					Canceller:        SingleGroupMCMS(t),
+					Bypasser:         SingleGroupMCMS(t),
+					Proposer:         SingleGroupMCMS(t),
+					TimelockMinDelay: big.NewInt(0),
 				},
 			},
 		},

deployment/common/types/types.go

@@ -5,7 +5,6 @@ import (
 	"math/big"
 	"time"
 
-	"github.com/ethereum/go-ethereum/common"
 	"github.com/smartcontractkit/ccip-owner-contracts/pkg/config"
 
 	"github.com/smartcontractkit/chainlink/deployment"
@@ -16,6 +15,7 @@ const (
 	CancellerManyChainMultisig deployment.ContractType = "CancellerManyChainMultiSig"
 	ProposerManyChainMultisig  deployment.ContractType = "ProposerManyChainMultiSig"
 	RBACTimelock               deployment.ContractType = "RBACTimelock"
+	CallProxy                  deployment.ContractType = "CallProxy"
 	// LinkToken is the burn/mint link token. It should be used everywhere for
 	// new deployments. Corresponds to
 	// https://github.com/smartcontractkit/chainlink/blob/develop/core/gethwrappers/shared/generated/link_token/link_token.go#L34
@@ -29,11 +29,10 @@ const (
 )
 
 type MCMSWithTimelockConfig struct {
-	Canceller         config.Config
-	Bypasser          config.Config
-	Proposer          config.Config
-	TimelockExecutors []common.Address
-	TimelockMinDelay  *big.Int
+	Canceller        config.Config
+	Bypasser         config.Config
+	Proposer         config.Config
+	TimelockMinDelay *big.Int
 }
 
 type OCRParameters struct {

deployment/keystone/changeset/accept_ownership_test.go

@@ -42,11 +42,10 @@ func TestAcceptAllOwnership(t *testing.T) {
 			Changeset: commonchangeset.WrapChangeSet(commonchangeset.DeployMCMSWithTimelock),
 			Config: map[uint64]types.MCMSWithTimelockConfig{
 				registrySel: {
-					Canceller:         commonchangeset.SingleGroupMCMS(t),
-					Bypasser:          commonchangeset.SingleGroupMCMS(t),
-					Proposer:          commonchangeset.SingleGroupMCMS(t),
-					TimelockExecutors: env.AllDeployerKeys(),
-					TimelockMinDelay:  big.NewInt(0),
+					Canceller:        commonchangeset.SingleGroupMCMS(t),
+					Bypasser:         commonchangeset.SingleGroupMCMS(t),
+					Proposer:         commonchangeset.SingleGroupMCMS(t),
+					TimelockMinDelay: big.NewInt(0),
 				},
 			},
 		},

deployment/keystone/changeset/helpers_test.go

@@ -265,11 +265,10 @@ func SetupTestEnv(t *testing.T, c TestConfig) TestEnv {
 		for sel := range env.Chains {
 			t.Logf("Enabling MCMS on chain %d", sel)
 			timelockCfgs[sel] = commontypes.MCMSWithTimelockConfig{
-				Canceller:         commonchangeset.SingleGroupMCMS(t),
-				Bypasser:          commonchangeset.SingleGroupMCMS(t),
-				Proposer:          commonchangeset.SingleGroupMCMS(t),
-				TimelockExecutors: env.AllDeployerKeys(),
-				TimelockMinDelay:  big.NewInt(0),
+				Canceller:        commonchangeset.SingleGroupMCMS(t),
+				Bypasser:         commonchangeset.SingleGroupMCMS(t),
+				Proposer:         commonchangeset.SingleGroupMCMS(t),
+				TimelockMinDelay: big.NewInt(0),
 			}
 		}
 		env, err = commonchangeset.ApplyChangesets(t, env, nil, []commonchangeset.ChangesetApplication{

integration-tests/testsetups/ccip/test_helpers.go

@@ -147,11 +147,10 @@ func NewLocalDevEnvironment(
 	mcmsCfg := make(map[uint64]commontypes.MCMSWithTimelockConfig)
 	for _, c := range env.AllChainSelectors() {
 		mcmsCfg[c] = commontypes.MCMSWithTimelockConfig{
-			Canceller:         commonchangeset.SingleGroupMCMS(t),
-			Bypasser:          commonchangeset.SingleGroupMCMS(t),
-			Proposer:          commonchangeset.SingleGroupMCMS(t),
-			TimelockExecutors: env.AllDeployerKeys(),
-			TimelockMinDelay:  big.NewInt(0),
+			Canceller:        commonchangeset.SingleGroupMCMS(t),
+			Bypasser:         commonchangeset.SingleGroupMCMS(t),
+			Proposer:         commonchangeset.SingleGroupMCMS(t),
+			TimelockMinDelay: big.NewInt(0),
 		}
 	}
 	// Need to deploy prerequisites first so that we can form the USDC config