Access control and roles

OpenZeppelin AccessControlEnumerable + Multicall, plus batch grantRoles/revokeRoles (admin-only) and constructor-time role seeding via RoleHolder[] .

Sources: src/modules/ACLModule.sol · FundRoles.sol · FundSpokeACLModule.sol · FundACLModule.sol · FundManagerACLModule.sol · StrategyACLModule.sol

The two auth patterns

Local ACL (`ACLModule`)

OpenZeppelin AccessControlEnumerable + Multicall, plus batch grantRoles/revokeRoles (admin-only) and constructor-time role seeding via RoleHolder[] {role, account}.

Used directly by contracts that own their role state:

Contract	Role constants module
Fund	FundACLModule (= ACLModule + FundRoles)
FundManager	FundManagerACLModule
FundManagerDeployer	roles declared inline
Strategy / StandaloneStrategy	StrategyACLModule (+ CallValidatorModule roles)
StandaloneStrategyDeployer	roles declared inline

Spoke callback ACL (`FundSpokeACLModule`)

The fund spokes (DepositQueue, RedeemQueue, Oracle, FeeManager, RiskManager) hold no role state of their own.

Their onlyRole(ROLE) modifier calls back to the Fund:

if (!IAccessControl(_fund()).hasRole(role, msg.sender)) revert UnauthorizedRole();

So all roles for a fund and its five spokes are granted/revoked in one place: the Fund (fund.grantRoles(...) by the fund’s DEFAULT_ADMIN_ROLE).

Role-name constants live in FundRoles, inherited by both Fund and spokes so identifiers always match.

Fund role table (FundRoles)

All identifiers are keccak256("<NAME>"). “Enforced by” shows where the guarded function lives.

Role	Enforced by	Grants ability to
DEFAULT_ADMIN_ROLE (0x00)	Fund	Grant/revoke every other role.
ACCEPT_REPORT_ROLE	Fund	acceptReport — accept prices & settle batches.
ACCEPT_SUSPICIOUS_REPORT_ROLE	Fund	acceptSuspiciousReport — settle despite suspicious flags.
FUND_REDEEM_ROLE	Fund	fundRedeem — deliver assets to settled redeem batches.
CREATE_STRATEGY_ROLE	Fund	createStrategy.
ADD_STRATEGY_ROLE / REMOVE_STRATEGY_ROLE	Fund	Manage the strategy registry.
PUSH_TO_STRATEGY_ROLE / PULL_FROM_STRATEGY_ROLE	Fund	Move assets Fund ↔ strategies.
ADD_EXTERNAL_WALLET_ROLE / REMOVE_EXTERNAL_WALLET_ROLE / PUSH_TO_WALLET_ROLE	Fund	Manage the external-wallet whitelist and push assets to it.
SUBMIT_REPORT_ROLE	Oracle	submitReport — post batch prices.
REJECT_REPORT_ROLE	Oracle	rejectReport — veto pending prices.
SET_PRICE_SAFETY_ROLE	Oracle	Configure suspicious-price bounds.
SET_NEXT_CUTOFF_TIME_ROLE	Oracle	Move the batch cutoff.
SET_MIN_ACCEPT_REPORT_DELAY_ROLE / SET_MAX_ACCEPT_REPORT_DELAY_ROLE	Oracle	Tune the accept window.
SET_FEES_ROLE	FeeManager	setFeeConfig (all five fee bps).
SET_FEE_RECIPIENT_ROLE	FeeManager	setFeeRecipient.
SET_FEE_BASE_ASSET_ROLE	FeeManager	setFeeBaseAsset.
SET_DEPOSIT_ALLOWED_ASSETS_ROLE	DepositQueue	setAllowedAssets.
PAUSE_DEPOSIT_ROLE / UNPAUSE_DEPOSIT_ROLE	DepositQueue	Global & per-asset pause.
CANCEL_DEPOSIT_REQUEST_ROLE	DepositQueue	adminCancelDeposit.
PULL_DEPOSIT_ASSET_ROLE	DepositQueue	pullAsset (queue → Fund).
SET_REDEEM_ALLOWED_ASSETS_ROLE	RedeemQueue	setAllowedAssets.
PAUSE_REDEEM_ROLE / UNPAUSE_REDEEM_ROLE	RedeemQueue	Global & per-asset pause.
CANCEL_REDEEM_REQUEST_ROLE	RedeemQueue	adminCancelRedeem.
PULL_REDEEM_ASSET_ROLE	RedeemQueue	pullAsset (queue → Fund).
SET_TVL_CAP_ROLE	RiskManager	setTvlCap.
SET_BATCH_CAPS_ROLE	RiskManager	setMaxBatchDepositCap / setMaxBatchRedeemCap.
SET_MIN_DEPOSIT_AMOUNT_ROLE / SET_MIN_REDEEM_AMOUNT_ROLE	RiskManager	Minimum request sizes.
SET_MAX_DRAWDOWN_ROLE	RiskManager	setMaxDrawdown.
SET_WHITELIST_ROLE	RiskManager	setMerkleRoot (depositor whitelist).
EMERGENCY_PAUSE_ROLE	RiskManager	emergencyPause / emergencyUnpause.

Other role tables

Contract	Roles
FundManager (FundManagerACLModule)	CREATE_FUND_ROLE, plus one SET_<COMPONENT>_FACTORY_ROLE per component (fund, share, deposit queue, redeem queue, oracle, fee manager, risk manager, strategy) guarding both set<Component>Factory and set<Component>Implementation.
FundManagerDeployer	CREATE_FUND_MANAGER_ROLE, SET_IMPLEMENTATIONS_ROLE, SET_PROTOCOL_FEE_RECIPIENT_ROLE.
Strategy / StandaloneStrategy (StrategyACLModule + CallValidatorModule)	CALLER_ROLE (execute allowlisted calls), ADD_ALLOWED_CALL_ROLE, REMOVE_ALLOWED_CALL_ROLE.
StandaloneStrategyDeployer	CREATE_STRATEGY_ROLE, SET_IMPLEMENTATIONS_ROLE.

Upgrade authority

Every contract is a TransparentUpgradeableProxy; upgrade rights belong to whoever owns each proxy’s auto-deployed ProxyAdmin — the proxyAdmin address chosen at tenant/fund creation.

Roles govern behavior; ProxyAdmin ownership governs code.

The two are deliberately independent: an operator can hold rich behavioral roles without any ability to change contract code, and the upgrade authority can change code without holding any operational role.

Separation-of-duties guidance

Because roles can be split across parties and keys, funds should distribute them rather than concentrating everything in one account.

Common splits:

• Keep the reporter (SUBMIT_REPORT_ROLE) separate from the acceptor (ACCEPT_REPORT_ROLE).
• Give a third party the reviewer veto (REJECT_REPORT_ROLE).
• Hold ACCEPT_SUSPICIOUS_REPORT_ROLE and EMERGENCY_PAUSE_ROLE on more secure keys.
• Keep DEFAULT_ADMIN_ROLE and ProxyAdmin ownership on the most protected keys of all.