Add Ownable2Step extension with 2-step transfer

CHANGELOG.md

@@ -14,6 +14,7 @@
  * `SafeCast`: optimize downcasting of signed integers. ([#3565](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3565))
  * `VestingWallet`: remove unused library `Math.sol`. ([#3605](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3605))
  * `ECDSA`: Remove redundant check on the `v` value. ([#3591](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3591))
+ * `SafeOwnable`: add new contract SafeOwnable, makes the transfers a two step process `SafeOwnable.sol`. ([#3620](https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3620))
 
 ### Compatibility Note
 

contracts/access/SafeOwnable.sol

@@ -0,0 +1,49 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Contracts (last updated v4.7.0) (access/Ownable.sol)
+
+pragma solidity ^0.8.0;
+
+import "./Ownable.sol";
+
+/**
+ * @dev Contract module which provides access control mechanism, where
+ * there is an account (an owner) that can be granted exclusive access to
+ * specific functions.
+ *
+ * By default, the owner account will be the one that deploys the contract. This
+ * can later be changed with {transferOwnership} and {acceptOwnership}.
+ *
+ * This module is used through inheritance. It will make available all functions
+ * from parent (Ownable).
+ */
+abstract contract SafeOwnable is Ownable {
+    address private _pendingOwner;
+
+    event OwnershipTransferStarted(address indexed newOwner);
+
+    /**
+     * @dev Starts the ownership transfer of the contract to a new account
+     * Can only be called by the current owner.
+     */
+    function transferOwnership(address newOwner) public virtual override onlyOwner {
+        _pendingOwner = newOwner;
+        emit OwnershipTransferStarted(newOwner);
+    }
+
+    /**
+     * @dev Transfers ownership of the contract to a new account (`newOwner`).
+     * Internal function without access restriction.
+     */
+    function _transferOwnership(address newOwner) internal virtual override {
+        delete _pendingOwner;
+        super._transferOwnership(newOwner);
+    }
+
+    /**
+     * @dev The new owner accepts the ownership transfer.
+     */
+    function acceptOwnership() external {
+        require(_pendingOwner == _msgSender(), "SafeOwnable: caller is not the new owner");
+        _transferOwnership(_msgSender());
+    }
+}

contracts/mocks/SafeOwnableMock.sol

@@ -0,0 +1,7 @@
+// SPDX-License-Identifier: MIT
+
+pragma solidity ^0.8.0;
+
+import "../access/SafeOwnable.sol";
+
+contract SafeOwnableMock is SafeOwnable {}

test/access/SafeOwnable.test.js

@@ -0,0 +1,36 @@
+const { expectEvent, expectRevert } = require('@openzeppelin/test-helpers');
+
+const { expect } = require('chai');
+
+const SafeOwnable = artifacts.require('SafeOwnableMock');
+
+contract('SafeOwnable', function (accounts) {
+  const [ owner, accountA, accountB ] = accounts;
+
+  beforeEach(async function () {
+    this.safeOwnable = await SafeOwnable.new({ from: owner });
+  });
+
+  describe('transfer ownership', function () {
+    it('starting a transfer does not change owner', async function () {
+      const receipt = await this.safeOwnable.transferOwnership(accountA, { from: owner });
+      expectEvent(receipt, 'OwnershipTransferStarted');
+      expect(await this.safeOwnable.owner()).to.equal(owner);
+    });
+
+    it('changes owner after transfer', async function () {
+      await this.safeOwnable.transferOwnership(accountA, { from: owner });
+      const receipt = await this.safeOwnable.acceptOwnership({ from: accountA });
+      expectEvent(receipt, 'OwnershipTransferred');
+      expect(await this.safeOwnable.owner()).to.equal(accountA);
+    });
+
+    it('guards transfer against invalid user', async function () {
+      await this.safeOwnable.transferOwnership(accountA, { from: owner });
+      await expectRevert(
+        this.safeOwnable.acceptOwnership({ from: accountB }),
+        'SafeOwnable: caller is not the new owner',
+      );
+    });
+  });
+});