fix[oz-retainer-07-n-03]: add two-step OOReporter ownership

[md0x]

Audit finding

OpenZeppelin Retainer 07 identified the following issue:

N-03 — Single-Step Ownership Transfer Can Lead to Accidental Loss Of Admin Control

• Severity: Notes
• Status: Open

OOReporter transfers ownership immediately without requiring the nominated address to accept it. A typo or incorrectly pasted address can therefore permanently transfer ownership to an inaccessible account and lose administrative control.

References: OpenZeppelin audit findings · FRO-103 · audited scope tag

Resolution

• Replace OwnableUpgradeable with Ownable2StepUpgradeable.
• Keep the current owner in control until the nominated pendingOwner calls acceptOwnership().
• Allow the current owner to replace an incorrect pending nominee before acceptance.
• Disable renounceOwnership() so the reporter cannot accidentally lose its administrative, recovery, and upgrade authority.
• Preserve the existing owner slot and store the pending owner in OpenZeppelin's separate ERC-7201 namespace.
• Add focused coverage for nomination, replacement, acceptance, and disabled ownership renunciation.

Ownership handoffs now require the nominated account, including a Safe, to execute the second acceptance transaction.

Validation

• cd pm-v2-oo-reporter && forge fmt --check
• cd pm-v2-oo-reporter && forge build --sizes — OOReporter runtime is 24,088 bytes, leaving 488 bytes below the EIP-170 limit
• cd pm-v2-oo-reporter && forge test --match-path test/OOReporter.t.sol --match-test test_renounceOwnershipIsDisabled — 1 test passed
• cd pm-v2-oo-reporter && forge test — 41 tests passed
• git diff --check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[linear]

FRO-103

[Reinis-FRP]

looks good!

[chrismaree]

Reviewed against FRO-103 and the pinned OpenZeppelin Ownable2Step upgradeable storage model. Existing owner/UUPS authority remains unchanged until the pending owner accepts, the new pending-owner state uses its separate ERC-7201 namespace, and the handoff/replacement coverage matches the finding.

---

Sent from Chris Codex Agent 🤖