keep-core - operator contracts disabled via panic button can be re-enabled by RegistryKeeper
The Registry contract defines three administrative accounts: `Governance`, `registryKeeper`, and `panicButton`. All permissions are initially assigned to the deployer when the contract is created. The account acting like a super-admin, being allowed to re-assign administrative accounts - is `Governance`. `registryKeeper` is a lower privileged account maintaining the registry and `panicButton` is an emergency account that can disable operator contracts.\\nThe keep specification states the following:\\nPanic Button The Panic Button can disable malicious or malfunctioning contracts that have been previously approved by the Registry Keeper. When a contract is disabled by the Panic Button, its status on the registry changes to reflect this, and it becomes ineligible to penalize operators. Contracts disabled by the Panic Button can not be reactivated. The Panic Button can be rekeyed by Governance.\\nIt is assumed that the permissions are `Governance` > `panicButton` > `registryKeeper`, meaning that `panicButton` should be able to overrule `registryKeeper`, while `registryKeeper` cannot overrule `panicButton`.\\nWith the current implementation of the Registry the `registryKeeper` account can re-enable an operator contract that has previously been disabled by the `panicButton` account.\\nWe would also like to note the following:\\nThe contract should use enums instead of integer literals when working with contract states.\\nChanges to the contract take effect immediately, allowing an administrative account to selectively front-run calls to the Registry ACL and interfere with user activity.\\nThe operator contract state can be set to the current value without raising an error.\\nThe panic button can be called for operator contracts that are not yet active.\\n```\\nfunction approveOperatorContract(address operatorContract) public onlyRegistryKeeper {\\n    operatorContracts[operatorContract] = 1;\\n}\\n\\nfunction disableOperatorContract(address operatorContract) public onlyPanicButton {\\n    operatorContracts[operatorContract] = 2;\\n}\\n```\\n
The keep specification states:\\nThe Panic Button can be used to set the status of an APPROVED contract to DISABLED. Operator Contracts disabled with the Panic Button cannot be re-enabled, and disabled contracts may not punish operators nor be selected by service contracts to perform work.\\nAll three accounts are typically trusted. We recommend requiring the `Governance` or `paniceButton` accounts to reset the contract operator state before `registryKeeper` can change the state or disallow re-enabling of disabled operator contracts as stated in the specification.
```\\nfunction approveOperatorContract(address operatorContract) public onlyRegistryKeeper {\\n    operatorContracts[operatorContract] = 1;\\n}\\n\\nfunction disableOperatorContract(address operatorContract) public onlyPanicButton {\\n    operatorContracts[operatorContract] = 2;\\n}\\n```\\n