Add check to ensure initialOwner is not a ProxyAdmin contract when deploying a transparent proxy

[ericglau]

With OpenZeppelin Contracts v5, the initialOwner when deploying a transparent proxy must not be a predeployed ProxyAdmin contract. The transparent proxy deploys its own ProxyAdmin using this initialOwner as the owner, therefore the initialOwner must be an EOA or a contract that is able to call functions on a ProxyAdmin.

This PR adds the following check: if the initialOwner when deploying a transparent proxy is a contract that has an owner() getter which returns something that looks like an address, it might be a ProxyAdmin contract. In this case, throw an error.

It may have false positives if the initialOwner is some other contract (such as a smart account) which has an owner. If this false positive occurs and the user is sure that the initialOwner is a contract that can invoke functions on a ProxyAdmin but is not a ProxyAdmin itself, this check can be skipped with the unsafeSkipProxyAdminCheck option.

Hardhat equivalent of OpenZeppelin/openzeppelin-foundry-upgrades#76

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/sinon@19.0.2	None	+2	5.84 MB	cjohansen, fatso83, mantoni, ...1 more

🚮 Removed packages: npm/@openzeppelin/upgrades-core@1.37.1

View full report↗︎