CGP-0243 listed 0xC85639289D4Bbb5F90e380A0f4db6B77a2F777bF as Kobi Gurkan's address. It is Eran Tromer's. Kobi Gurkan's address is 0xFD74A4b05F12B9aB6020CB202aDE1BBa4Bc99aba. The Governance Approver multisig executed the rotation as written (multisig transaction 263, replaceOwner(0xC856… → Paul Lange)), so Eran Tromer was removed instead of Kobi Gurkan. Every other change in CGP-0243 (Rob Witoff out; Javier Cortejoso, Paul Lange, Marcin Majchrzak, Pavel Hornak in) executed as intended.
This temperature check asks the community to approve the correction: re-add Eran Tromer, remove Kobi Gurkan. It carries no on-chain transactions. If it passes, the multisig executes one replaceOwner call on itself. Signer count stays at 14, approval threshold stays at 3.
No transactions. After the vote passes, the Governance Approver multisig (0x41822d8A191fcfB1cfcA5F7048818aCd8eE933d3) executes one self-call:
replaceOwner(Kobi Gurkan 0xFD74A4b05F12B9aB6020CB202aDE1BBa4Bc99aba -> Eran Tromer 0xC85639289D4Bbb5F90e380A0f4db6B77a2F777bF)
0xe20056e6000000000000000000000000fd74a4b05f12b9ab6020cb202ade1bba4bc99aba000000000000000000000000c85639289d4bbb5f90e380a0f4db6b77a2f777bf
replaceOwner is onlyWallet. Self-calls use the multisig's internal threshold, which is 5 of 14 (internalRequired), not the 3 of 14 used for governance approvals (required). Five signers submit/confirm; the fifth confirmation executes.
N/A — mainnet.json is an empty array.
Current state (block 80,498,471):
RPC=https://forno.celo.org
MS=0x41822d8A191fcfB1cfcA5F7048818aCd8eE933d3
cast call 0xD533Ca259b330c7A88f74E000a3FaEa2d63B7972 "approver()(address)" --rpc-url $RPC
# 0x41822d8A191fcfB1cfcA5F7048818aCd8eE933d3
cast call $MS "required()(uint256)" --rpc-url $RPC # 3
cast call $MS "internalRequired()(uint256)" --rpc-url $RPC # 5
cast call $MS "isOwner(address)(bool)" 0xFD74A4b05F12B9aB6020CB202aDE1BBa4Bc99aba --rpc-url $RPC # true (Kobi Gurkan)
cast call $MS "isOwner(address)(bool)" 0xC85639289D4Bbb5F90e380A0f4db6B77a2F777bF --rpc-url $RPC # false (Eran Tromer)
celocli multisig:show $MS
After the correction: isOwner(0xFD74…) is false, isOwner(0xC856…) is true, 14 owners, required 3, internalRequired 5, the other 13 owners unchanged. Expected owner set is the CGP-0243 list with 0xFD74…9aba replaced by 0xC856…77bF.
Fork test: test-cgp-0254.sh forks mainnet with anvil, confirms the state above, runs the full propose/dequeue/approve/vote/execute lifecycle on the empty proposal, then replays the correction on the multisig: one owner submits, two more confirm and the call does not execute at 3 confirmations, the fifth confirmation executes it, and the owner set matches the expected list. 32 checks, all passing at block 80,498,637.
None from the vote itself: no transactions. The multisig change is a single replaceOwner behind the 5-of-14 internal flow on the audited Celo MultiSig. Signers must verify the calldata above before confirming, since the previous rotation shows what a wrong address costs.
replaceOwner, isConfirmed, internalRequired)