The EVM CoreISSUE #40 of 48

access control · ownable · roles · accessmanager

SoliaVSThe Reentrancy Reaper

Solia saysRole-based access control replaces a single owner with a matrix of (role → addresses) — letting the protocol grant minting, pausing, and upgrading independently.

The simplest access control is Ownable: one owner address, one onlyOwner modifier. It does not scale: real protocols need separate authorities for minting, pausing, treasury moves, and parameter changes. Role-based access control (OpenZeppelin's AccessControl) maps role identifiers to sets of authorized addresses, and gates each function with a onlyRole(X) check.

Beyond static roles, EIP-5313 / AccessManager generalize to per-function delegation with time-bounded grants. The demo runs four calls against a role matrix and shows allowed vs reverted outcomes.

Power-ups you unlock

Ownable: single owner, all-or-nothing
AccessControl: role IDs → sets of addresses
Each function gates on a specific role (onlyRole)
Roles can be granted/revoked independently
AccessManager generalizes to per-function delegation

The Reentrancy Reaper attacks — common mistakes

Leaving the default admin role with a single EOA
Granting roles without expiration or revocation plan
Using a single role for incompatible privileges
Forgetting events on role changes (auditability)

Boss battleBuild a 3-role matrix (OWNER/MINTER/PAUSER) and verify 4 calls against it.

Example code

<!doctype html><html><head><meta charset="utf-8"></head>
<body style="background:#06040d;color:#e6e0ff;font-family:monospace;padding:20px"><pre id="o"></pre>
<script>
const roles = {
  OWNER:  new Set(['alice']),
  MINTER: new Set(['bob']),
  PAUSER: new Set(['carol'])
};
const hasRole = (role, who) => roles[role] && roles[role].has(who);
const calls = [
  { fn:'mint',  role:'MINTER', caller:'bob' },
  { fn:'mint',  role:'MINTER', caller:'eve' },
  { fn:'pause', role:'PAUSER', caller:'carol' },
  { fn:'pause', role:'PAUSER', caller:'eve' }
];
const rows = calls.map(c => '  ' + c.fn.padEnd(6) + ' by ' + c.caller.padEnd(6) + ' → ' + (hasRole(c.role, c.caller) ? 'ALLOWED' : 'REVERT (missing ' + c.role + ')'));
document.getElementById('o').textContent = [
  'role matrix:',
  ...Object.entries(roles).map(([r,s]) => '  ' + r.padEnd(8) + ' = {' + [...s].join(', ') + '}'),
  '',
  'calls:',
  ...rows
].join('\n');
</script></body></html>

▶ Open the interactive comic issue

‹ Pull Over Push · The Withdrawal Pattern Pausable · Emergency Stop · Circuit Breakers ›