Access control and roles

Sources: src/modules/ACLModule.sol · FundRoles.sol · FundSpokeACLModule.sol · FundACLModule.sol · FundManagerACLModule.sol · StrategyACLModule.sol

Two auth patterns

Local ACL (`ACLModule`)
Spoke callback ACL (`FundSpokeACLModule`)

OpenZeppelin AccessControlEnumerable + Multicall, with batch grantRoles/revokeRoles (admin-only) and constructor seeding via RoleHolder[] {role, account}.Contracts that own role state:

Contract	Role constants module
Fund	`FundACLModule` (= `ACLModule` + `FundRoles`)
FundManager	`FundManagerACLModule`
FundManagerDeployer	roles declared inline
Strategy / StandaloneStrategy	`StrategyACLModule` (+ `CallValidatorModule` roles)
StandaloneStrategyDeployer	roles declared inline

The fund spokes (DepositQueue, RedeemQueue, Oracle, FeeManager, RiskManager) hold no role state of their own.Their onlyRole(ROLE) modifier calls back to the Fund:

if (!IAccessControl(_fund()).hasRole(role, msg.sender)) revert UnauthorizedRole();

All roles for a fund and its five spokes are granted and revoked on the Fund (fund.grantRoles(...) by DEFAULT_ADMIN_ROLE).Role-name constants live in FundRoles, shared by Fund and spokes.

Fund role table (`FundRoles`)

All identifiers are keccak256("<NAME>"). “Enforced by” shows where the guarded function lives.

Role	Enforced by	Grants ability to
`DEFAULT_ADMIN_ROLE` (`0x00`)	Fund	Grant/revoke every other role.
`ACCEPT_REPORT_ROLE`	Fund	`acceptReport` — accept prices & settle batches.
`ACCEPT_SUSPICIOUS_REPORT_ROLE`	Fund	`acceptSuspiciousReport` — settle despite suspicious flags.
`FUND_REDEEM_ROLE`	Fund	`fundRedeem` — deliver assets to settled redeem batches.
`CREATE_STRATEGY_ROLE`	Fund	`createStrategy`.
`ADD_STRATEGY_ROLE` / `REMOVE_STRATEGY_ROLE`	Fund	Manage the strategy registry.
`PUSH_TO_STRATEGY_ROLE` / `PULL_FROM_STRATEGY_ROLE`	Fund	Move assets Fund ↔ strategies.
`ADD_EXTERNAL_WALLET_ROLE` / `REMOVE_EXTERNAL_WALLET_ROLE` / `PUSH_TO_WALLET_ROLE`	Fund	Manage the external-wallet whitelist and push assets to it.
`SUBMIT_REPORT_ROLE`	Oracle	`submitReport` — post batch prices.
`REJECT_REPORT_ROLE`	Oracle	`rejectReport` — veto pending prices.
`SET_PRICE_SAFETY_ROLE`	Oracle	Configure suspicious-price bounds.
`SET_NEXT_CUTOFF_TIME_ROLE`	Oracle	Move the batch cutoff.
`SET_MIN_ACCEPT_REPORT_DELAY_ROLE` / `SET_MAX_ACCEPT_REPORT_DELAY_ROLE`	Oracle	Tune the accept window.
`SET_FEES_ROLE`	FeeManager	`setFeeConfig` (all five fee bps).
`SET_FEE_RECIPIENT_ROLE`	FeeManager	`setFeeRecipient`.
`SET_FEE_BASE_ASSET_ROLE`	FeeManager	`setFeeBaseAsset`.
`SET_DEPOSIT_ALLOWED_ASSETS_ROLE`	DepositQueue	`setAllowedAssets`.
`PAUSE_DEPOSIT_ROLE` / `UNPAUSE_DEPOSIT_ROLE`	DepositQueue	Global & per-asset pause.
`CANCEL_DEPOSIT_REQUEST_ROLE`	DepositQueue	`adminCancelDeposit`.
`PULL_DEPOSIT_ASSET_ROLE`	DepositQueue	`pullAsset` (queue → Fund).
`SET_REDEEM_ALLOWED_ASSETS_ROLE`	RedeemQueue	`setAllowedAssets`.
`PAUSE_REDEEM_ROLE` / `UNPAUSE_REDEEM_ROLE`	RedeemQueue	Global & per-asset pause.
`CANCEL_REDEEM_REQUEST_ROLE`	RedeemQueue	`adminCancelRedeem`.
`PULL_REDEEM_ASSET_ROLE`	RedeemQueue	`pullAsset` (queue → Fund).
`SET_TVL_CAP_ROLE`	RiskManager	`setTvlCap`.
`SET_BATCH_CAPS_ROLE`	RiskManager	`setMaxBatchDepositCap` / `setMaxBatchRedeemCap`.
`SET_MIN_DEPOSIT_AMOUNT_ROLE` / `SET_MIN_REDEEM_AMOUNT_ROLE`	RiskManager	Minimum request sizes.
`SET_MAX_DRAWDOWN_ROLE`	RiskManager	`setMaxDrawdown`.
`SET_WHITELIST_ROLE`	RiskManager	`setMerkleRoot` (depositor whitelist).
`EMERGENCY_PAUSE_ROLE`	RiskManager	`emergencyPause` / `emergencyUnpause`.

Other role tables

Contract	Roles
FundManager (`FundManagerACLModule`)	`CREATE_FUND_ROLE`, plus one `SET_<COMPONENT>_FACTORY_ROLE` per component (fund, share, deposit queue, redeem queue, oracle, fee manager, risk manager, strategy) guarding both `set<Component>Factory` and `set<Component>Implementation`.
FundManagerDeployer	`CREATE_FUND_MANAGER_ROLE`, `SET_IMPLEMENTATIONS_ROLE`, `SET_PROTOCOL_FEE_RECIPIENT_ROLE`.
Strategy / StandaloneStrategy (`StrategyACLModule` + `CallValidatorModule`)	`CALLER_ROLE` (execute allowlisted calls), `ADD_ALLOWED_CALL_ROLE`, `REMOVE_ALLOWED_CALL_ROLE`.
StandaloneStrategyDeployer	`CREATE_STRATEGY_ROLE`, `SET_IMPLEMENTATIONS_ROLE`.

Upgrade authority

Every contract is a TransparentUpgradeableProxy; upgrade rights belong to whoever owns each proxy’s auto-deployed ProxyAdmin — the proxyAdmin address chosen at tenant/fund creation.

Roles govern behavior; ProxyAdmin ownership governs code. An operator can hold operational roles without upgrade rights; upgrade authority need not hold operational roles.

Separation of duties

Prefer split keys over one account holding everything:

Reporter (SUBMIT_REPORT_ROLE) ≠ acceptor (ACCEPT_REPORT_ROLE)
Third party for reviewer veto (REJECT_REPORT_ROLE)
ACCEPT_SUSPICIOUS_REPORT_ROLE and EMERGENCY_PAUSE_ROLE on higher-security keys
DEFAULT_ADMIN_ROLE and ProxyAdmin ownership on the most protected keys

Getting started

Overview

Using Red Potion

Developers

Security

Access control and roles

Two auth patterns

Fund role table (`FundRoles`)

Other role tables

Upgrade authority

Separation of duties

​Two auth patterns

​Fund role table (FundRoles)

​Other role tables

​Upgrade authority

​Separation of duties

Two auth patterns

Fund role table (`FundRoles`)

Other role tables

Upgrade authority

Separation of duties