LI.FI Executor Role Admin

Scope

Use this runbook when deploying, replacing, or validating the LI.FI hook executor contract.

Authority Required

Deployer or protocol admin authority for the executor and any connected hook or settlement roles.

Preconditions

• Confirm the LI.FI executor manifest.
• Confirm solver custody for the intended chain.
• Confirm no live orders depend on the executor being replaced.

Procedure

Deploy or refresh the executor with the production script:

forge script script/production/DeployLifiHookExecutor.s.sol --rpc-url "$SEPOLIA_RPC_URL" --broadcast --private-key "$SEPOLIA_DEPLOYER_PRIVATE_KEY"

Then verify the manifest output and connected roles before opening new orders.

Expired Pending Fill Recovery

If an input settler transferred funds but never delivered the callback, wait until the fill deadline has passed and cancel the pending commitment:

executor.cancelExpiredPendingFill(orderId);

The caller must hold OPERATOR_ROLE. Cancellation removes the pending callback and balance-snapshot state, tombstones the order ID, and does not transfer any tokens. A replacement order must use a new order ID.

Inspect all other live orders before recovering stranded tokens with sweep. Executor balances are pooled, so sweeping a token that another order still uses can remove that order's funds.

Executor Replacement

LifiHookExecutor is deployed directly rather than through an upgradeable proxy. Replacing it changes the LI.FI solver identity because solverId is derived from the executor address.

Before cutover:

1. Stop opening orders against the old executor.
2. Reconcile every pending order and token balance on the old executor.
3. Deploy the replacement with the same reviewed role and allowlist policy.
4. Update the manifest, solver registration, and off-chain fill configuration.
5. Execute a controlled end-to-end fill through the replacement.
6. Decommission the old executor only after its orders and balances are closed.

Verification

• deployments/manifests/11155111-lifi-hook-executor.json points at the expected executor.
• LI.FI readiness passes in strict mode.
• A controlled one-shot serve or order-opening test uses the new executor.
• No cancelled order ID is reused, and any token sweep is reconciled against all other pending orders first.

Rollback

Stop order opening, restore the previous executor manifest, and avoid new fills until the solver process is reading the intended address.

Source Files

• script/production/DeployLifiHookExecutor.s.sol
• deployments/manifests/11155111-lifi-hook-executor.json
• quote-server/src/lifi-readiness.ts