Grant EEPCI5R5… on-chain access to update market caps (MarketController)

Summary

Wallet EEPCI5R5WCC7EX7THSIHYENKVOXZG4QDBMHNZ6EK5423K3XYNGELXD3IGE can already open the Admin UI, but cannot successfully update market caps (max deposits / max borrows, including the WAD mint cap). Cap updates go through MarketController and are owner-only.

Context

• Admin UI allowlist (AuthGuard) already includes this address.
• Cap updates call MarketController methods:
  • set_market_max_total_deposits
  • set_market_max_total_borrows
• On Algorand prod, MarketController app id is 3333688332.
• Current MarketController owner (and creator/upgrader): CRI5WQWSLYN7TT4LNJYWHK4LICMOX6QR6HCSSTOG3TVNWFG2HB4G2EKIQQ
• MarketController has no transfer_ownership and no role-based access for these methods.
• Lending-pool rmc (MarketController role) does not authorize the current Admin cap-update flow.

Problem

Operators with Admin UI access cannot raise caps (e.g. WAD mint / borrow cap) unless they control the MarketController owner key. This blocks operational responses when markets hit mint/borrow caps.

Goal

Allow EEPCI5R5WCC7EX7THSIHYENKVOXZG4QDBMHNZ6EK5423K3XYNGELXD3IGE to update market max deposits and max borrows on production (at minimum for the WAD mint / A-market path), preferably via the existing Admin UI.

Proposed options (pick one)

Option A — Operational (fastest, no contract change)

Keep cap updates signed by CRI5…, or provide shared/custody/rekey access to that owner account for authorized operators.

Option B — Upgrade MarketController (recommended for durable multi-admin)

1. Upgrade MarketController (signed by current upgrader CRI5…) to support either:
   • transfer_ownership, then transfer owner to EEPCI…, or
   • multi-admin / role checks for cap setters (preferred if multiple operators need access)
2. Update app clients / Admin wiring if ABI changes.
3. Verify Admin “Max Deposits” / “Max Borrows” succeed when signed by EEPCI….

Option C — Bypass via pool rmc + direct set_market

1. Grant rmc on each target lending pool to EEPCI….
2. Call LendingPool.set_market with updated caps (or change Admin to use this path).

Note: current Admin UI does not use this path, so this needs tooling or UI work.

Acceptance criteria

• EEPCI5R5WCC7EX7THSIHYENKVOXZG4QDBMHNZ6EK5423K3XYNGELXD3IGE can successfully update max borrows on the WAD mint market (A-market / sToken WAD).
• Same wallet can update max deposits/borrows on other intended pools/markets (list targets in implementation).
• Unauthorized wallets still cannot update caps.
• Admin UI path works end-to-end (or documented alternate tooling if Option C).
• Owner/upgrader/role state documented after change.
• Rollback / recovery plan noted (especially if ownership is transferred).

Out of scope

• Changing AuthGuard allowlist (already includes this wallet)
• Changing mint/borrow utilization thresholds in the frontend
• Governance proposal flow (unless we decide caps must go through governance)

References

• src/components/AuthGuard.tsx — Admin UI allowlist
• src/services/adminService.ts — updateMarketMaxDeposits / updateMarketMaxBorrows
• src/clients/MarketControllerClient.ts — owner-gated cap methods
• src/pages/Admin.tsx — Max Deposits / Max Borrows UI
• Prod MarketController: app 3333688332, owner CRI5WQWSLYN7TT4LNJYWHK4LICMOX6QR6HCSSTOG3TVNWFG2HB4G2EKIQQ

Open questions

1. Prefer durable multi-admin (Option B) or temporary shared owner access (Option A)?
2. Should ownership move fully to EEPCI…, or should we keep CRI5… as owner and add an additional admin role?
3. Which networks/pools must be covered beyond Algorand prod A-market WAD?