Audit trust-assumption (immutable updaters) is stale for mutable-vkey design in SP1Helios.sol

[Lutviansyah]

The OpenZeppelin audit of SP1Helios (March 2025, PR #2 on across-protocol/sp1-helios,
commit 6d554b9) explicitly stated as a trust assumption:

"The updaters set is immutable—defined at deployment and cannot be modified
afterward... Risk Labs will control the updater role."

Since sp1-helios@045b722 ("feat: mutable vkey"), this assumption no longer holds
for the version now living at contracts/sp1-helios/SP1Helios.sol:
heliosProgramVkey can be rotated post-deployment via updateHeliosProgramVkey(),
gated by VKEY_UPDATER_ROLE.

We verified on-chain (via broadcast/deployed-addresses.json) that
DEFAULT_ADMIN_ROLE and VKEY_UPDATER_ROLE are currently held by each chain's
SpokePool contract (checked 56/999/9745/43114), not an EOA — so access control
itself looks sound today, gated by the same governance that secures the rest
of the bridge.

However, since the originally audited security model assumed immutability
and the current model doesn't, worth flagging:

1. The mutable-vkey change (and its delegation to SpokePool) doesn't appear to
   have had a dedicated audit pass of its own.
2. If SpokePool's own admin/governance structure ever changes, the security
   assumption underlying SP1Helios's vkey mutability changes with it — worth
   documenting explicitly as a dependency.

Not reporting this as a vulnerability — access control is correctly enforced
today. Just flagging that the original audit's stated trust assumption is
outdated and might be worth a formal note or re-review.

[dookynme-bit]

Commit

[Lutviansyah]

Commit

Could you clarify what you mean by "Commit"? Are you asking for the
specific commit that introduced the mutable vkey delegation to
SpokePool, or something else? Happy to point to the relevant commit
if that's what's needed.