feat: capped minter v2 minter role

l2-contracts/foundry.toml

@@ -1,5 +1,6 @@
 [profile.default]
   evm_version = "paris"
+  fs_permissions = [{ access = "read", path = "./zkout" }]
   fuzz = { runs = 50 }
   optimizer = true
   optimizer_runs = 10_000_000
@@ -8,10 +9,10 @@
     "@openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/",
     "@openzeppelin/foundry-upgrades/=lib/openzeppelin-foundry-upgrades/src/",
     "@murky/=lib/murky/",
+    "src/=src/",
   ]
   solc_version = "0.8.24"
   verbosity = 3
-  fs_permissions = [{ access = "read", path = "./zkout" }]
 
 [profile.ci]
   fuzz = { runs = 5000 }

l2-contracts/src/ZkCappedMinterV2.sol

@@ -1,58 +1,49 @@
 // SPDX-License-Identifier: MIT
 pragma solidity 0.8.24;
 
+import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";
 import {IMintableAndDelegatable} from "src/interfaces/IMintableAndDelegatable.sol";
 
 /// @title ZkCappedMinterV2
 /// @author [ScopeLift](https://scopelift.co)
 /// @notice A contract to allow a permissioned entity to mint ZK tokens up to a given amount (the cap).
 /// @custom:security-contact [email protected]
-contract ZkCappedMinterV2 {
+contract ZkCappedMinterV2 is AccessControl {
   /// @notice The contract where the tokens will be minted by an authorized minter.
   IMintableAndDelegatable public immutable TOKEN;
 
-  /// @notice The address that is allowed to mint tokens.
-  address public immutable ADMIN;
-
   /// @notice The maximum number of tokens that may be minted by the ZkCappedMinter.
   uint256 public immutable CAP;
 
   /// @notice The cumulative number of tokens that have been minted by the ZkCappedMinter.
   uint256 public minted = 0;
 
+  bytes32 public constant MINTER_ROLE = keccak256("MINTER_ROLE");
+
   /// @notice Error for when the cap is exceeded.
   error ZkCappedMinterV2__CapExceeded(address minter, uint256 amount);
 
-  /// @notice Error for when the caller is not the admin.
-  error ZkCappedMinterV2__Unauthorized(address account);
-
-  /// @notice Constructor for a new ZkCappedMinter contract
+  /// @notice Constructor for a new ZkCappedMinterV2 contract
   /// @param _token The token contract where tokens will be minted.
-  /// @param _admin The address that is allowed to mint tokens.
+  /// @param _admin The address that will be granted the admin role.
   /// @param _cap The maximum number of tokens that may be minted by the ZkCappedMinter.
   constructor(IMintableAndDelegatable _token, address _admin, uint256 _cap) {
     TOKEN = _token;
-    ADMIN = _admin;
     CAP = _cap;
+
+    _grantRole(DEFAULT_ADMIN_ROLE, _admin);
   }
 
   /// @notice Mints a given amount of tokens to a given address, so long as the cap is not exceeded.
   /// @param _to The address that will receive the new tokens.
   /// @param _amount The quantity of tokens, in raw decimals, that will be created.
   function mint(address _to, uint256 _amount) external {
-    _revertIfUnauthorized();
+    _checkRole(MINTER_ROLE, msg.sender);
     _revertIfCapExceeded(_amount);
     minted += _amount;
     TOKEN.mint(_to, _amount);
   }
 
-  /// @notice Reverts if msg.sender is not the contract admin.
-  function _revertIfUnauthorized() internal view {
-    if (msg.sender != ADMIN) {
-      revert ZkCappedMinterV2__Unauthorized(msg.sender);
-    }
-  }
-
   /// @notice Reverts if the amount of new tokens will increase the minted tokens beyond the mint cap.
   /// @param _amount The quantity of tokens, in raw decimals, that will checked against the cap.
   function _revertIfCapExceeded(uint256 _amount) internal view {

l2-contracts/test/ZkCappedMinterFactory.t.sol

@@ -15,7 +15,7 @@ contract ZkCappedMinterFactoryTest is ZkTokenTest {
 
   function setUp() public virtual override {
     super.setUp();
-    
+
     // Read the bytecode hash from the JSON file
     string memory root = vm.projectRoot();
     string memory path = string.concat(root, "/zkout/ZkCappedMinter.sol/ZkCappedMinter.json");

l2-contracts/test/ZkCappedMinterV2.t.sol

@@ -2,6 +2,7 @@
 pragma solidity 0.8.24;
 
 import {ZkTokenTest} from "test/utils/ZkTokenTest.sol";
+import {Strings} from "@openzeppelin/contracts/utils/Strings.sol";
 import {IMintableAndDelegatable} from "src/interfaces/IMintableAndDelegatable.sol";
 import {ZkCappedMinterV2} from "src/ZkCappedMinterV2.sol";
 import {console2} from "forge-std/Test.sol";
@@ -17,6 +18,11 @@ contract ZkCappedMinterV2Test is ZkTokenTest {
     token.grantRole(MINTER_ROLE, address(cappedMinter));
     return cappedMinter;
   }
+
+  function _grantMinterRole(ZkCappedMinterV2 _cappedMinter, address _cappedMinterAdmin, address _minter) internal {
+    vm.prank(_cappedMinterAdmin);
+    _cappedMinter.grantRole(MINTER_ROLE, _minter);
+  }
 }
 
 contract Constructor is ZkCappedMinterV2Test {
@@ -26,14 +32,15 @@ contract Constructor is ZkCappedMinterV2Test {
     _cap = bound(_cap, 0, MAX_MINT_SUPPLY);
     ZkCappedMinterV2 cappedMinter = createCappedMinter(_cappedMinterAdmin, _cap);
     assertEq(address(cappedMinter.TOKEN()), address(token));
-    assertEq(cappedMinter.ADMIN(), _cappedMinterAdmin);
+    assertEq(cappedMinter.hasRole(DEFAULT_ADMIN_ROLE, _cappedMinterAdmin), true);
     assertEq(cappedMinter.CAP(), _cap);
   }
 }
 
 contract Mint is ZkCappedMinterV2Test {
   function testFuzz_MintsNewTokensWhenTheAmountRequestedIsBelowTheCap(
     address _cappedMinterAdmin,
+    address _minter,
     address _receiver,
     uint256 _cap,
     uint256 _amount
@@ -42,14 +49,20 @@ contract Mint is ZkCappedMinterV2Test {
     _amount = bound(_amount, 1, MAX_MINT_SUPPLY);
     vm.assume(_cap > _amount);
     vm.assume(_receiver != address(0) && _receiver != initMintReceiver);
+    vm.assume(_minter != address(0));
+
     ZkCappedMinterV2 cappedMinter = createCappedMinter(_cappedMinterAdmin, _cap);
-    vm.prank(_cappedMinterAdmin);
+
+    _grantMinterRole(cappedMinter, _cappedMinterAdmin, _minter);
+
+    vm.prank(_minter);
     cappedMinter.mint(_receiver, _amount);
     assertEq(token.balanceOf(_receiver), _amount);
   }
 
   function testFuzz_MintsNewTokensInSuccessionToDifferentAccountsWhileRemainingBelowCap(
     address _cappedMinterAdmin,
+    address _minter,
     address _receiver1,
     address _receiver2,
     uint256 _cap,
@@ -63,38 +76,89 @@ contract Mint is ZkCappedMinterV2Test {
     vm.assume(_receiver1 != address(0) && _receiver1 != initMintReceiver);
     vm.assume(_receiver2 != address(0) && _receiver2 != initMintReceiver);
     vm.assume(_receiver1 != _receiver2);
+    vm.assume(_minter != address(0));
+
     ZkCappedMinterV2 cappedMinter = createCappedMinter(_cappedMinterAdmin, _cap);
-    vm.startPrank(_cappedMinterAdmin);
+
+    _grantMinterRole(cappedMinter, _cappedMinterAdmin, _minter);
+
+    vm.startPrank(_minter);
     cappedMinter.mint(_receiver1, _amount1);
     cappedMinter.mint(_receiver2, _amount2);
     vm.stopPrank();
+
     assertEq(token.balanceOf(_receiver1), _amount1);
     assertEq(token.balanceOf(_receiver2), _amount2);
   }
 
-  function testFuzz_RevertIf_MintAttemptedByNonAdmin(address _cappedMinterAdmin, uint256 _cap, address _nonAdmin)
+  function testFuzz_RevertIf_MintAttemptedByNonMinter(address _cappedMinterAdmin, address _nonMinter, uint256 _cap)
     public
   {
     _cap = bound(_cap, 0, MAX_MINT_SUPPLY);
-    vm.assume(_nonAdmin != _cappedMinterAdmin);
-
     ZkCappedMinterV2 cappedMinter = createCappedMinter(_cappedMinterAdmin, _cap);
-    vm.expectRevert(abi.encodeWithSelector(ZkCappedMinterV2.ZkCappedMinterV2__Unauthorized.selector, _nonAdmin));
-    vm.startPrank(_nonAdmin);
-    cappedMinter.mint(_nonAdmin, _cap);
+
+    vm.assume(_nonMinter != address(0));
+    vm.assume(!cappedMinter.hasRole(MINTER_ROLE, _nonMinter));
+
+    vm.expectRevert(
+      bytes(
+        string.concat(
+          "AccessControl: account ",
+          Strings.toHexString(uint160(_nonMinter), 20),
+          " is missing role ",
+          Strings.toHexString(uint256(MINTER_ROLE))
+        )
+      )
+    );
+    vm.prank(_nonMinter);
+    cappedMinter.mint(_nonMinter, _cap);
   }
 
-  function testFuzz_RevertIf_CapExceededOnMint(address _cappedMinterAdmin, address _receiver, uint256 _cap) public {
+  function testFuzz_RevertIf_CapExceededOnMint(
+    address _cappedMinterAdmin,
+    address _minter,
+    address _receiver,
+    uint256 _cap
+  ) public {
     _cap = bound(_cap, 4, MAX_MINT_SUPPLY);
     vm.assume(_receiver != address(0) && _receiver != initMintReceiver);
+    vm.assume(_minter != address(0));
+
     ZkCappedMinterV2 cappedMinter = createCappedMinter(_cappedMinterAdmin, _cap);
-    vm.prank(_cappedMinterAdmin);
+
+    _grantMinterRole(cappedMinter, _cappedMinterAdmin, _minter);
+
+    vm.prank(_minter);
     cappedMinter.mint(_receiver, _cap);
     assertEq(token.balanceOf(_receiver), _cap);
+
+    vm.expectRevert(abi.encodeWithSelector(ZkCappedMinterV2.ZkCappedMinterV2__CapExceeded.selector, _minter, _cap));
+    vm.prank(_minter);
+    cappedMinter.mint(_receiver, _cap);
+  }
+
+  function testFuzz_RevertIf_AdminMintsByDefault(address _admin, address _receiver, uint256 _cap, uint256 _amount)
+    public
+  {
+    _cap = bound(_cap, 0, MAX_MINT_SUPPLY);
+    vm.assume(_cap > 0);
+    _amount = bound(_amount, 1, _cap);
+    vm.assume(_admin != address(0));
+    vm.assume(_receiver != address(0) && _receiver != initMintReceiver);
+
+    ZkCappedMinterV2 cappedMinter = createCappedMinter(_admin, _cap);
+
     vm.expectRevert(
-      abi.encodeWithSelector(ZkCappedMinterV2.ZkCappedMinterV2__CapExceeded.selector, _cappedMinterAdmin, _cap)
+      bytes(
+        string.concat(
+          "AccessControl: account ",
+          Strings.toHexString(uint160(_admin), 20),
+          " is missing role ",
+          Strings.toHexString(uint256(MINTER_ROLE))
+        )
+      )
     );
-    vm.prank(_cappedMinterAdmin);
-    cappedMinter.mint(_receiver, _cap);
+    vm.prank(_admin);
+    cappedMinter.mint(_receiver, _amount);
   }
 }

l2-contracts/test/ZkCappedMinterV2Factory.t.sol

@@ -44,7 +44,7 @@ contract CreateCappedMinter is ZkCappedMinterV2FactoryTest {
 
     ZkCappedMinterV2 minter = ZkCappedMinterV2(minterAddress);
     assertEq(address(minter.TOKEN()), address(token));
-    assertEq(minter.ADMIN(), _cappedMinterAdmin);
+    assertEq(minter.hasRole(DEFAULT_ADMIN_ROLE, _cappedMinterAdmin), true);
     assertEq(minter.CAP(), _cap);
   }