chore(deployments): reconcile 10.json to live chain + add timelock deploy infra

[rplusq]

• deployments/10.json was stale: LTS entries pointed at old immutable contracts; StakeWeight/Distributor/Pauser impls predated P3/fix(stakeweight): correct permanent lock epoch accounting #45. Reconciled all proxy entries to live on-chain values (verified via EIP-1967 slots + getPostClaimHandlers).
• Add TimelockDeploy.s.sol + arbitrum/base RPC aliases so ProxyAdmin ownership and the token admin role can be moved behind a per-chain timelock.

🤖 Generated with Claude Code

[claude]

Claude finished @rplusq's task in 2m 11s —— View job

---

PR Review

• Gather context
• Read changed files
• Run data classification subagent
• Synthesize findings and post review

---

Found 3 issue(s)

Issue 1: Arbitrum/Base not in BaseScript production-chain guard — test mnemonic fallback risk

ID: timelockdeploy-arb-base-mnemonic-guard-a3f1
File: evm/script/deploy/TimelockDeploy.s.sol:22 (root cause: evm/script/Base.s.sol:69-74)
Severity: HIGH
Category: security

Context:

• Pattern: BaseScript constructor only gates the test-mnemonic fallback for mainnet and optimism. Arbitrum (42161) and Base (8453) are not in isMainnetOrOptimism, so a broadcaster is silently derived from the public test test test…junk mnemonic if ETH_FROM is unset.
• Risk: The deployed Timelock would be administered by the well-known test key (0xf39F…2266). Anyone with that key could immediately call grantRole/revokeRole on it, subverting the CONT-10 remediation entirely.
• Impact: Compromised ProxyAdmin ownership and DEFAULT_ADMIN_ROLE for WCT on Arbitrum/Base.
• Trigger: Operator runs the script without setting ETH_FROM — easy to miss on a new chain.

The script already documents this via an IMPORTANT comment (line 18-20), but documentation doesn't prevent mistakes for a security-critical contract. The fix belongs in BaseScript:

bool isProduction =
    block.chainid == getChain("mainnet").chainId ||
    block.chainid == getChain("optimism").chainId ||
    block.chainid == 42161 || // Arbitrum One
    block.chainid == 8453;    // Base
if (isProduction && specifiedSender == address(0)) {
    revert("You must specify a sender for a production deployment");
}

Fix this →

---

Issue 2: No deployment artifact written for Arbitrum/Base timelock

ID: timelockdeploy-no-artifact-write-c2e8
File: evm/script/deploy/TimelockDeploy.s.sol:23-35
Severity: MEDIUM
Category: code_quality

Context:

• Pattern: EthereumDeploy calls _writeEthereumDeployments + DeploymentJsonWriter.writeEthereumDeploymentsToJson to persist the deployed address. TimelockDeploy only emits console2.log.
• Risk: The deployed Timelock address on Arbitrum/Base is only visible in broadcast output — not recorded in a machine-readable file.
• Impact: The CONT-10 hand-off scripts (Safe bundles) that reference the timelock address must be manually copied from broadcast logs; a transcription error would point the ProxyAdmin/admin role at the wrong address.
• Trigger: Any time the deployment output needs to be referenced programmatically or verified later.

Minimally: gate the JSON write behind BROADCAST/WRITE_JSON env vars like other scripts and use DeploymentJsonWriter (or create the Arbitrum/Base JSON files). At minimum, write the address to a deployment JSON for the corresponding chain ID.

---

Issue 3: Missing Etherscan config for Arbitrum and Base

ID: foundry-missing-etherscan-arb-base-d5b9
File: evm/foundry.toml:45-50
Severity: LOW
Category: code_quality

Context:

• Pattern: [etherscan] section has entries for sepolia, mainnet, optimism, optimism_sepolia — but not arbitrum or base. RPC aliases were added for both chains.
• Risk: forge script … --verify will silently fail or error on Arbitrum/Base with no Etherscan API config.
• Impact: Timelock contract won't be verified on-chain, reducing transparency for a security-critical component.
• Trigger: Running TimelockDeploy with --verify.

[etherscan]
  arbitrum = { key = "${API_KEY_ARBISCAN}" }
  base     = { key = "${API_KEY_BASESCAN}" }

Data classification: No issues — addresses are public on-chain data, env vars are used for all secrets.

[github-actions]

🤖 Auto Review Issue: Arbitrum/Base not in BaseScript production-chain guard — test mnemonic fallback risk

Severity: HIGH
Category: security
Tool: Claude Auto Review

Context:

• Pattern: BaseScript constructor only gates the test-mnemonic fallback for mainnet and optimism. Arbitrum (42161) and Base (8453) are not in isMainnetOrOptimism, so a broadcaster is silently derived from the public test test test…junk mnemonic if ETH_FROM is unset.
• Risk: The deployed Timelock would be administered by the well-known test key (0xf39F…2266). Anyone with that key could immediately call grantRole/revokeRole on it, subverting the CONT-10 remediation entirely.
• Impact: Compromised ProxyAdmin ownership and DEFAULT_ADMIN_ROLE for WCT on Arbitrum/Base.
• Trigger: Operator runs the script without setting ETH_FROM — easy to miss on a new chain.

The script already documents this via an IMPORTANT comment (line 18-20), but documentation doesn't prevent mistakes for a security-critical contract. The fix belongs in BaseScript:

bool isProduction =
    block.chainid == getChain("mainnet").chainId ||
    block.chainid == getChain("optimism").chainId ||
    block.chainid == 42161 || // Arbitrum One
    block.chainid == 8453;    // Base
if (isProduction && specifiedSender == address(0)) {
    revert("You must specify a sender for a production deployment");
}

Fix this →

[github-actions]

🤖 Auto Review Issue: No deployment artifact written for Arbitrum/Base timelock

Severity: MEDIUM
Category: code_quality
Tool: Claude Auto Review

Context:

• Pattern: EthereumDeploy calls _writeEthereumDeployments + DeploymentJsonWriter.writeEthereumDeploymentsToJson to persist the deployed address. TimelockDeploy only emits console2.log.
• Risk: The deployed Timelock address on Arbitrum/Base is only visible in broadcast output — not recorded in a machine-readable file.
• Impact: The CONT-10 hand-off scripts (Safe bundles) that reference the timelock address must be manually copied from broadcast logs; a transcription error would point the ProxyAdmin/admin role at the wrong address.
• Trigger: Any time the deployment output needs to be referenced programmatically or verified later.

Minimally: gate the JSON write behind BROADCAST/WRITE_JSON env vars like other scripts and use DeploymentJsonWriter (or create the Arbitrum/Base JSON files). At minimum, write the address to a deployment JSON for the corresponding chain ID.