Note

Medium Risk
Changes affect core withdrawal authorization (who can set the vault root) and proof validation strictness; misconfiguration of the new vault_root_provider address or unexpected proof formats could block withdrawals.

Overview
Vault root setting is tightened and re-wired. VaultWithdrawalProcessor now takes an immutable VAULT_ROOT_PROVIDER address in the constructor (wired from new vault_root_provider config + deploy script) and setVaultRoot no longer uses an AccessControl role; it instead enforces msg.sender == VAULT_ROOT_PROVIDER with a dedicated UnauthorizedVaultRootProvider error.

Proof validation is made stricter. VaultEscapeProofVerifier now only accepts proofs of exactly length 68 (single supported format) and the processor relies on the verifier for length checks; unit tests are updated to match the new revert reasons.

Proxy/upgrade safety improvement. StarkExchangeMigration now disables initializers in the implementation constructor, and tests are updated to deploy it behind an ERC1967Proxy and assert initialization behavior accordingly.

^{Written by Cursor Bugbot for commit 3587321. This will update automatically on new commits. Configure here.}