TL;DR
On all chains, revoke leftover permissions on the V2 vault for relayers that are deprecated or no longer used. Only the latest 20231031-batch-relayer-v6/BalancerRelayer is left intact.
Motivation
The V2 vault still grants swap, batchSwap, joinPool, exitPool, manageUserBalance, and/or setRelayerApproval to several relayers that have been deprecated or are no longer in use. They are leftover from old frontend paths and third-party integrations. Revoking them is good security practice and falls in line with the general sunsetting of V2.
CoW Protocol has deprecated API orders that settle via Balancer’s internal balances / batchSwap on cow/vault_relayer. The CronV1Relayer has had no onchain activity since February 2024. 20210812-lido-relayer/LidoRelayer and the batch relayers v1/v2/v3/v4/v5 are already deprecated deployments.
Technical Specifications
Call Authorizer.revokeRole(actionId, account) for any of the six roles mentioned above for the following accounts (followed by all applicable chain ids):
20211203-batch-relayer/BalancerRelayer(1, 137, 42161)20220318-batch-relayer-v2/BalancerRelayer(137)20220720-batch-relayer-v3/BalancerRelayer(1, 10, 137, 42161)20220916-batch-relayer-v4/BalancerRelayer(1, 10, 100, 137, 42161)20230314-batch-relayer-v5/BalancerRelayer(1, 10, 100, 137, 8453, 42161, 43114)cow/vault_relayer(1)20210812-lido-relayer/LidoRelayer(1)CronV1Relayer(1)