Skip to content

L-07: Missing Admin Role Holder #432

@0xisk

Description

@0xisk

Source: OpenZeppelin Midnight - Compact Contracts Audit

Description

The ShieldedAccessControl contract should assign at least one role holder (typically for the DEFAULT_ADMIN_ROLE) during initialization. Otherwise, the access control mechanism will prevent any role from ever being granted.

However, the intended mechanism to achieve this is unclear.

Recommendation

Consider updating the initializer to require a default admin address. Alternatively, consider calling the initializer and then the (unauthenticated) _grantRole circuit in the example constructor documentation.

Metadata

Metadata

Assignees

Labels

auditIssues reported by an audit

Type

No type

Projects

Status

Backlog

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions