Permissions
App Administrator Roles
The super admin account is set during the deployment of the AppManager in the constructor. Ensure you use it when creating App Admins. App Admins are used to create all other admin roles.
Index
- Super Admin.
- App Admin.
- Risk Admin.
- Access Level Admin.
- Rule Admin.
- Treasury Account.
- Token Admin.
- Proxy Admin.
SUPER ADMIN
Overview
Super admin is set at construction of the AppManager(the root address argument of the AppManager constructor). This role is the highest in the hierarchy of roles and can grant/revoke the app admin role. Functions with the modifier onlyRole(SUPER_ADMIN_ROLE) can only be called by this role. There can only be one super admin in an application, and the only way to grant another account the super-admin role is by using the functionproposeNewSuperAdmin in which case, the current super admin would effectively renounce the super admin role and all of its privileges to grant it to the new address. The new address has to confirm the acceptance of the super-admin role for the process to take effect, otherwise the old super admin will remain in the role. This two step process is used to ensure there is always a super admin role assigned.
Proposed Super Admin
There is a transitionary role called “proposed super Admin”. There can only be one address member of this role, and it can only be added by the super admin role when invokingproposeNewSuperAdmin. Once the proposed account confirms the role by invoking confirmSuperAdmin, the new super Admin will renounce to the proposed-super-Admin role.
Capabilities
- The Super Administrator is the initial approver/creator of the application ecosystem.
- The Super Administrator may approve/add subsequent Application Administrators.
- The Super Administrator may NOT renounce it’s role except via the Proposed Super Admin process described above. There must be at least one Super Administrator at all times.
Role Hash
Roles can be identified by their Keccak256 hash in the logs.Super Admin
Proposed Super Admin
Recommendations
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
- For the production phase, it is strongly recommended that the Super Administrator is a multi-signature wallet where the approved signers don’t have admin privileges and their private keys are stored in hardware wallets.
APP ADMIN
Overview
TheAPP_ADMIN_ROLE can be granted only by the super admin at any time. App Admins do not have the ability to create/revoke other App Admins. This role can grant permissions to the access level, risk and rule admin roles as well as treasury accounts. This role also has control over setting addresses for provider contracts, registering/deregistering asset contracts and setting upgraded handler addresses. Functions with the modifier onlyRole(APP_ADMIN_ROLE) can only be called by this role.
Add Command
The following is an example of the command used to add an app admin by the super admin. ReplaceDESIRED_APP_ADMIN_ADDRESS in the following cast command with the address that is being granted the role of AppAdmin:
Capabilities
- Application Administrators may add/remove Rule Administrators
- Application Administrators may add/remove Risk Administrators.
- Application Administrators may add/remove Access Level Administrators.
- Application Administrators may add/remove Treasury Accounts.
- Application Administrators may add/edit/remove account metadata such as tags (not including risk/access levels).
- Application Administrators may renounce their role.
- Application Administrators may register/deregister asset contracts.
- Application Administrators may set upgraded handler addresses.
Role Hash
Revoke Command
The following is an example of the command used to revoke an app admin by the super admin. ReplaceAPP_ADMIN_ADDRESS_TO_BE_REVOKED with the address of a current app admin that is no longer desired to have the APP_ADMIN_ROLE. The bytes32 argument here is the keccak256 hash of the APP_ADMIN_ROLE.
Renounce Command
The following is an example of the command used to renounce theAPP_ADMIN_ROLE from the caller of this command. Replace APP_ADMIN_ADDRESS_TO_BE_RENOUNCED with the address associated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the APP_ADMIN_ROLE.
Recommendations
- It is recommended to have as few app admins as possible in the application since these have great indirect privileges. One app admin is the optimal amount.
- It is recommended to have a dedicated account for this role that doesn’t have any other admin roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
RISK ADMIN
Overview
Risk admin can be granted at any time by the app admin. This role sets the risk level for addresses within the application app manager. Functions with the modifier onlyRole(RISK_ADMIN_ROLE) can only be called by this role.Add Command
The following is an example of the command used to add a risk admin by the app admin. ReplaceDESIRED_RISK_ADMIN_ADDRESS in the following cast command with the address that is being granted the RISK_ADMIN_ROLE:
Capabilities
- Risk Administrators may alter user risk levels.
- Risk Administrators may not alter any rule configurations to include risk related rules.
- Risk Administrators may renounce their role.
Role Hash
Revoke Command
The following is an example of the command used to revoke a risk admin by an app admin. ReplaceRISK_ADMIN_ADDRESS_TO_BE_REVOKED with the address of a current risk admin that is no longer desired to have the RISK_ADMIN_ROLE. The bytes32 argument here is the keccak256 hash of the RISK_ADMIN_ROLE.
Renounce Command
The following is an example of the command used to renounce theRISK_ADMIN_ROLE from the caller of this command. Replace RISK_ADMIN_ADDRESS_TO_BE_REVOKED with the address associated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the RISK_ADMIN_ROLE.
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other admin roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
ACCESS LEVEL ADMIN
Overview
Access level admin can be granted at any time by the app admin. This role sets the access level for addresses within the application app manager. Functions with the modifier onlyRole(ACCESS_LEVEL_ADMIN_ROLE) can only be called by this role.Add Command
The following is an example of the command used to add an access level admin by the app admin. ReplaceDESIRED_ACCESS_LEVEL_ADMIN_ADDRESS in the following cast command with the address that is being granted the ACCESS_LEVEL_ADMIN_ROLE:
Capabilities
- Access Level Administrators may alter user access levels.
- Access Level Administrators may not alter any rule configurations to include risk related rules.
- Access Level Administrators may renounce their role.
Role Hash
Revoke Command
The following is an example of the command used to revoke an access level admin by an app admin. ReplaceACCESS_LEVEL_ADMIN_ADDRESS_TO_BE_REVOKED with the address of a current access level admin that is no longer desired to have the ACCESS_LEVEL_ADMIN_ROLE. The bytes32 argument here is the keccak256 hash of the ACCESS_LEVEL_ADMIN_ROLE.
Renounce Command
The following is an example of the command used to renounce theACCESS_LEVEL_ADMIN_ROLE from the caller of this command. Replace ACCESS_LEVEL_ADMIN_ADDRESS_TO_BE_REVOKED with the address associated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the ACCESS_LEVEL_ADMIN_ROLE.
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other admin roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
RULE ADMIN
Overview
Rule admin can be granted at any time by the app admin. This role can activate and deactivate economic rules within the handler contracts. Functions with the modifier onlyRole(RULE_ADMIN_ROLE) can only be called by this role.Add Command
The following is an example of the command used to add a rule admin by the app admin. ReplaceDESIRED_RULE_ADMIN_ADDRESS in the following cast command with the address that is being granted the RULE_ADMIN_ROLE:
Capabilities
- Rule Administrators may create rules.
- Rule Administrators may enable/disable rules.
- Rule Administrators may configure/edit rules.
- Rule Administrators may renounce their role.
Role Hash
Revoke Command
The following is an example of the command used to revoke a rule admin by an app admin. ReplaceRULE_ADMIN_ADDRESS_TO_BE_REVOKED with the address of a current rule admin that is no longer desired to have the RULE_ADMIN_ROLE. The bytes32 argument here is the keccak256 hash of the RULE_ADMIN_ROLE.
Renounce Command
The following is an example of the command used to renounce theRULE_ADMIN_ROLE from the caller of this command. Replace RULE_ADMIN_ADDRESS_TO_BE_REVOKED with the address associated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the RULE_ADMIN_ROLE.
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other admin roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
TREASURY ACCOUNT
Treasury Account can be granted at any time by the app admin. This role is exempt from all economic rules. Any transactions involving a treasury account will bypass rule checks for all parties involved. Functions with the modifier onlyRole(TREASURY_ACCOUNT) can only be called by this role.Add Command
The following is an example of the command used to add a Treasury Account by the app admin. ReplaceDESIRED_TREASURY_ACCOUNT_ADDRESS in the following cast command with the address that is being granted the TREASURY_ACCOUNT role:
Capabilities
- Treasury Accounts are exempt from all economic rules.
- Treasury Accounts may not alter any rule configurations to include risk related rules.
Role Hash
Revoke Command
The following is an example of the command used to revoke a treasury account by an app admin. ReplaceTREASURY_ACCOUNT_ADDRESS_TO_BE_REVOKED with the address of a current treasury account that is no longer desired to have the TREASURY_ACCOUNT role. The bytes32 argument here is the keccak256 hash of the TREASURY_ACCOUNT role.
Renounce Command
The following is an example of the command used to renounce theTREASURY_ACCOUNT role from the caller of this command. Replace TREASURY_ACCOUNT_ADDRESS_TO_BE_REVOKED with the address associated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the TREASURY_ACCOUNT role.
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
Token Admin
The Token Admin role is granted during construction of the ApplicationERC20 and ApplicaitionERC721 contracts. Token Admin can be granted at any time by a current Token Admin. This role can connect a handler to the token. Functions with the modifier onlyRole(TOKEN_ADMIN_ROLE) can be called by this role.Add Command
The following is an example of the command used to add a Token Admin by a current Token Admin. ReplaceAPPLICATION_TOKEN_ADDRESS with the token address. Replace DESIRED_TOKEN_ADMIN_ADDRESS in the following command with the address that is being granted the TOKEN_ADMIN_ROLE:
Capabilities
- Token admins can connect a handler to the token.
- Token admins can set the baseURI and mint tokens on ApplicationERC721 contracts.
- Token admins can grant or revoke the
TOKEN_ADMIN_ROLE.
Role Hash
Revoke Command
The following is an example of the command used to revoke a Token Admin by a current Token Admin. ReplaceAPPLICATION_TOKEN_ADDRESS with the token address. Replace TOKEN_ADMIN_ADDRESS_TO_BE_REVOKED with the address of a current Token Admin that is no longer desired to have the TOKEN_ADMIN_ROLE. The bytes32 argument here is the keccak256 hash of the TOKEN_ADMIN_ROLE:
Renounce Command
The following is an example of the command used to renounce theTOKEN_ADMIN_ROLE from the caller of this command. Replace APPLICATION_TOKEN_ADDRESS with the token address. Replace TOKEN_ADMIN_ADDRESS_TO_BE_REVOKED with the address asoociated with the private key used to sign this transaction. The bytes32 argument here is the keccak256 hash of the TOKEN_ADMIN_ROLE:
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):
Proxy Admin
The proxy admin role is granted during construction of the ApplicationERC20UProxy and ApplicationERC721UProxy contracts. The proxy admin is provided by the OpenZeppelin ERC1967Upgrade contract. It is different than AccessControl roles and doesn’t have a role hash. Instead, it is stored at a specific slot in the proxy contract storage. There can only be one proxy admin at a time. Functions with the modifier ifAdmin can be called by this role.Change Command
The following is an example of the command used to change the proxy admin by the current proxy admin. ReplaceAPPLICATION_PROXY_ADDRESS with the proxy contract address. Replace NEW_PROXY_ADMIN with the address of the new proxy admin.
Capabilities
- Proxy admins can change the current proxy admin.
- Proxy admins can upgrade the implementaition contract.
Role Slot
Recommendations
- It is recommended to have a dedicated account for this role that doesn’t have any other roles in the application.
- To ensure this guide can be followed during the development phase, it is recommended to export the private key for this admin as an environment variable (you might want to follow other practices in production for security reasons):