dexorder
This commit is contained in:
dexorder
209
lib_openzeppelin_contracts/contracts/access/AccessControl.sol
Normal file
209
lib_openzeppelin_contracts/contracts/access/AccessControl.sol
Normal file
@@ -0,0 +1,209 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/AccessControl.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessControl} from "./IAccessControl.sol";
|
||||
import {Context} from "../utils/Context.sol";
|
||||
import {ERC165} from "../utils/introspection/ERC165.sol";
|
||||
|
||||
/**
|
||||
* @dev Contract module that allows children to implement role-based access
|
||||
* control mechanisms. This is a lightweight version that doesn't allow enumerating role
|
||||
* members except through off-chain means by accessing the contract event logs. Some
|
||||
* applications may benefit from on-chain enumerability, for those cases see
|
||||
* {AccessControlEnumerable}.
|
||||
*
|
||||
* Roles are referred to by their `bytes32` identifier. These should be exposed
|
||||
* in the external API and be unique. The best way to achieve this is by
|
||||
* using `public constant` hash digests:
|
||||
*
|
||||
* ```solidity
|
||||
* bytes32 public constant MY_ROLE = keccak256("MY_ROLE");
|
||||
* ```
|
||||
*
|
||||
* Roles can be used to represent a set of permissions. To restrict access to a
|
||||
* function call, use {hasRole}:
|
||||
*
|
||||
* ```solidity
|
||||
* function foo() public {
|
||||
* require(hasRole(MY_ROLE, msg.sender));
|
||||
* ...
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* Roles can be granted and revoked dynamically via the {grantRole} and
|
||||
* {revokeRole} functions. Each role has an associated admin role, and only
|
||||
* accounts that have a role's admin role can call {grantRole} and {revokeRole}.
|
||||
*
|
||||
* By default, the admin role for all roles is `DEFAULT_ADMIN_ROLE`, which means
|
||||
* that only accounts with this role will be able to grant or revoke other
|
||||
* roles. More complex role relationships can be created by using
|
||||
* {_setRoleAdmin}.
|
||||
*
|
||||
* WARNING: The `DEFAULT_ADMIN_ROLE` is also its own admin: it has permission to
|
||||
* grant and revoke this role. Extra precautions should be taken to secure
|
||||
* accounts that have been granted it. We recommend using {AccessControlDefaultAdminRules}
|
||||
* to enforce additional security measures for this role.
|
||||
*/
|
||||
abstract contract AccessControl is Context, IAccessControl, ERC165 {
|
||||
struct RoleData {
|
||||
mapping(address account => bool) hasRole;
|
||||
bytes32 adminRole;
|
||||
}
|
||||
|
||||
mapping(bytes32 role => RoleData) private _roles;
|
||||
|
||||
bytes32 public constant DEFAULT_ADMIN_ROLE = 0x00;
|
||||
|
||||
/**
|
||||
* @dev Modifier that checks that an account has a specific role. Reverts
|
||||
* with an {AccessControlUnauthorizedAccount} error including the required role.
|
||||
*/
|
||||
modifier onlyRole(bytes32 role) {
|
||||
_checkRole(role);
|
||||
_;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC165-supportsInterface}.
|
||||
*/
|
||||
function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
|
||||
return interfaceId == type(IAccessControl).interfaceId || super.supportsInterface(interfaceId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns `true` if `account` has been granted `role`.
|
||||
*/
|
||||
function hasRole(bytes32 role, address account) public view virtual returns (bool) {
|
||||
return _roles[role].hasRole[account];
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Reverts with an {AccessControlUnauthorizedAccount} error if `_msgSender()`
|
||||
* is missing `role`. Overriding this function changes the behavior of the {onlyRole} modifier.
|
||||
*/
|
||||
function _checkRole(bytes32 role) internal view virtual {
|
||||
_checkRole(role, _msgSender());
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Reverts with an {AccessControlUnauthorizedAccount} error if `account`
|
||||
* is missing `role`.
|
||||
*/
|
||||
function _checkRole(bytes32 role, address account) internal view virtual {
|
||||
if (!hasRole(role, account)) {
|
||||
revert AccessControlUnauthorizedAccount(account, role);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the admin role that controls `role`. See {grantRole} and
|
||||
* {revokeRole}.
|
||||
*
|
||||
* To change a role's admin, use {_setRoleAdmin}.
|
||||
*/
|
||||
function getRoleAdmin(bytes32 role) public view virtual returns (bytes32) {
|
||||
return _roles[role].adminRole;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Grants `role` to `account`.
|
||||
*
|
||||
* If `account` had not been already granted `role`, emits a {RoleGranted}
|
||||
* event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have ``role``'s admin role.
|
||||
*
|
||||
* May emit a {RoleGranted} event.
|
||||
*/
|
||||
function grantRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
|
||||
_grantRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Revokes `role` from `account`.
|
||||
*
|
||||
* If `account` had been granted `role`, emits a {RoleRevoked} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have ``role``'s admin role.
|
||||
*
|
||||
* May emit a {RoleRevoked} event.
|
||||
*/
|
||||
function revokeRole(bytes32 role, address account) public virtual onlyRole(getRoleAdmin(role)) {
|
||||
_revokeRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Revokes `role` from the calling account.
|
||||
*
|
||||
* Roles are often managed via {grantRole} and {revokeRole}: this function's
|
||||
* purpose is to provide a mechanism for accounts to lose their privileges
|
||||
* if they are compromised (such as when a trusted device is misplaced).
|
||||
*
|
||||
* If the calling account had been revoked `role`, emits a {RoleRevoked}
|
||||
* event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be `callerConfirmation`.
|
||||
*
|
||||
* May emit a {RoleRevoked} event.
|
||||
*/
|
||||
function renounceRole(bytes32 role, address callerConfirmation) public virtual {
|
||||
if (callerConfirmation != _msgSender()) {
|
||||
revert AccessControlBadConfirmation();
|
||||
}
|
||||
|
||||
_revokeRole(role, callerConfirmation);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Sets `adminRole` as ``role``'s admin role.
|
||||
*
|
||||
* Emits a {RoleAdminChanged} event.
|
||||
*/
|
||||
function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal virtual {
|
||||
bytes32 previousAdminRole = getRoleAdmin(role);
|
||||
_roles[role].adminRole = adminRole;
|
||||
emit RoleAdminChanged(role, previousAdminRole, adminRole);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Attempts to grant `role` to `account` and returns a boolean indicating if `role` was granted.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*
|
||||
* May emit a {RoleGranted} event.
|
||||
*/
|
||||
function _grantRole(bytes32 role, address account) internal virtual returns (bool) {
|
||||
if (!hasRole(role, account)) {
|
||||
_roles[role].hasRole[account] = true;
|
||||
emit RoleGranted(role, account, _msgSender());
|
||||
return true;
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Attempts to revoke `role` to `account` and returns a boolean indicating if `role` was revoked.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*
|
||||
* May emit a {RoleRevoked} event.
|
||||
*/
|
||||
function _revokeRole(bytes32 role, address account) internal virtual returns (bool) {
|
||||
if (hasRole(role, account)) {
|
||||
_roles[role].hasRole[account] = false;
|
||||
emit RoleRevoked(role, account, _msgSender());
|
||||
return true;
|
||||
} else {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,98 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/IAccessControl.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
/**
|
||||
* @dev External interface of AccessControl declared to support ERC-165 detection.
|
||||
*/
|
||||
interface IAccessControl {
|
||||
/**
|
||||
* @dev The `account` is missing a role.
|
||||
*/
|
||||
error AccessControlUnauthorizedAccount(address account, bytes32 neededRole);
|
||||
|
||||
/**
|
||||
* @dev The caller of a function is not the expected one.
|
||||
*
|
||||
* NOTE: Don't confuse with {AccessControlUnauthorizedAccount}.
|
||||
*/
|
||||
error AccessControlBadConfirmation();
|
||||
|
||||
/**
|
||||
* @dev Emitted when `newAdminRole` is set as ``role``'s admin role, replacing `previousAdminRole`
|
||||
*
|
||||
* `DEFAULT_ADMIN_ROLE` is the starting admin for all roles, despite
|
||||
* {RoleAdminChanged} not being emitted signaling this.
|
||||
*/
|
||||
event RoleAdminChanged(bytes32 indexed role, bytes32 indexed previousAdminRole, bytes32 indexed newAdminRole);
|
||||
|
||||
/**
|
||||
* @dev Emitted when `account` is granted `role`.
|
||||
*
|
||||
* `sender` is the account that originated the contract call. This account bears the admin role (for the granted role).
|
||||
* Expected in cases where the role was granted using the internal {AccessControl-_grantRole}.
|
||||
*/
|
||||
event RoleGranted(bytes32 indexed role, address indexed account, address indexed sender);
|
||||
|
||||
/**
|
||||
* @dev Emitted when `account` is revoked `role`.
|
||||
*
|
||||
* `sender` is the account that originated the contract call:
|
||||
* - if using `revokeRole`, it is the admin role bearer
|
||||
* - if using `renounceRole`, it is the role bearer (i.e. `account`)
|
||||
*/
|
||||
event RoleRevoked(bytes32 indexed role, address indexed account, address indexed sender);
|
||||
|
||||
/**
|
||||
* @dev Returns `true` if `account` has been granted `role`.
|
||||
*/
|
||||
function hasRole(bytes32 role, address account) external view returns (bool);
|
||||
|
||||
/**
|
||||
* @dev Returns the admin role that controls `role`. See {grantRole} and
|
||||
* {revokeRole}.
|
||||
*
|
||||
* To change a role's admin, use {AccessControl-_setRoleAdmin}.
|
||||
*/
|
||||
function getRoleAdmin(bytes32 role) external view returns (bytes32);
|
||||
|
||||
/**
|
||||
* @dev Grants `role` to `account`.
|
||||
*
|
||||
* If `account` had not been already granted `role`, emits a {RoleGranted}
|
||||
* event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have ``role``'s admin role.
|
||||
*/
|
||||
function grantRole(bytes32 role, address account) external;
|
||||
|
||||
/**
|
||||
* @dev Revokes `role` from `account`.
|
||||
*
|
||||
* If `account` had been granted `role`, emits a {RoleRevoked} event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must have ``role``'s admin role.
|
||||
*/
|
||||
function revokeRole(bytes32 role, address account) external;
|
||||
|
||||
/**
|
||||
* @dev Revokes `role` from the calling account.
|
||||
*
|
||||
* Roles are often managed via {grantRole} and {revokeRole}: this function's
|
||||
* purpose is to provide a mechanism for accounts to lose their privileges
|
||||
* if they are compromised (such as when a trusted device is misplaced).
|
||||
*
|
||||
* If the calling account had been granted `role`, emits a {RoleRevoked}
|
||||
* event.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be `callerConfirmation`.
|
||||
*/
|
||||
function renounceRole(bytes32 role, address callerConfirmation) external;
|
||||
}
|
||||
100
lib_openzeppelin_contracts/contracts/access/Ownable.sol
Normal file
100
lib_openzeppelin_contracts/contracts/access/Ownable.sol
Normal file
@@ -0,0 +1,100 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Context} from "../utils/Context.sol";
|
||||
|
||||
/**
|
||||
* @dev Contract module which provides a basic access control mechanism, where
|
||||
* there is an account (an owner) that can be granted exclusive access to
|
||||
* specific functions.
|
||||
*
|
||||
* The initial owner is set to the address provided by the deployer. This can
|
||||
* later be changed with {transferOwnership}.
|
||||
*
|
||||
* This module is used through inheritance. It will make available the modifier
|
||||
* `onlyOwner`, which can be applied to your functions to restrict their use to
|
||||
* the owner.
|
||||
*/
|
||||
abstract contract Ownable is Context {
|
||||
address private _owner;
|
||||
|
||||
/**
|
||||
* @dev The caller account is not authorized to perform an operation.
|
||||
*/
|
||||
error OwnableUnauthorizedAccount(address account);
|
||||
|
||||
/**
|
||||
* @dev The owner is not a valid owner account. (eg. `address(0)`)
|
||||
*/
|
||||
error OwnableInvalidOwner(address owner);
|
||||
|
||||
event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);
|
||||
|
||||
/**
|
||||
* @dev Initializes the contract setting the address provided by the deployer as the initial owner.
|
||||
*/
|
||||
constructor(address initialOwner) {
|
||||
if (initialOwner == address(0)) {
|
||||
revert OwnableInvalidOwner(address(0));
|
||||
}
|
||||
_transferOwnership(initialOwner);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Throws if called by any account other than the owner.
|
||||
*/
|
||||
modifier onlyOwner() {
|
||||
_checkOwner();
|
||||
_;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the address of the current owner.
|
||||
*/
|
||||
function owner() public view virtual returns (address) {
|
||||
return _owner;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Throws if the sender is not the owner.
|
||||
*/
|
||||
function _checkOwner() internal view virtual {
|
||||
if (owner() != _msgSender()) {
|
||||
revert OwnableUnauthorizedAccount(_msgSender());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Leaves the contract without owner. It will not be possible to call
|
||||
* `onlyOwner` functions. Can only be called by the current owner.
|
||||
*
|
||||
* NOTE: Renouncing ownership will leave the contract without an owner,
|
||||
* thereby disabling any functionality that is only available to the owner.
|
||||
*/
|
||||
function renounceOwnership() public virtual onlyOwner {
|
||||
_transferOwnership(address(0));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Transfers ownership of the contract to a new account (`newOwner`).
|
||||
* Can only be called by the current owner.
|
||||
*/
|
||||
function transferOwnership(address newOwner) public virtual onlyOwner {
|
||||
if (newOwner == address(0)) {
|
||||
revert OwnableInvalidOwner(address(0));
|
||||
}
|
||||
_transferOwnership(newOwner);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Transfers ownership of the contract to a new account (`newOwner`).
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _transferOwnership(address newOwner) internal virtual {
|
||||
address oldOwner = _owner;
|
||||
_owner = newOwner;
|
||||
emit OwnershipTransferred(oldOwner, newOwner);
|
||||
}
|
||||
}
|
||||
65
lib_openzeppelin_contracts/contracts/access/Ownable2Step.sol
Normal file
65
lib_openzeppelin_contracts/contracts/access/Ownable2Step.sol
Normal file
@@ -0,0 +1,65 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable2Step.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {Ownable} from "./Ownable.sol";
|
||||
|
||||
/**
|
||||
* @dev Contract module which provides access control mechanism, where
|
||||
* there is an account (an owner) that can be granted exclusive access to
|
||||
* specific functions.
|
||||
*
|
||||
* This extension of the {Ownable} contract includes a two-step mechanism to transfer
|
||||
* ownership, where the new owner must call {acceptOwnership} in order to replace the
|
||||
* old one. This can help prevent common mistakes, such as transfers of ownership to
|
||||
* incorrect accounts, or to contracts that are unable to interact with the
|
||||
* permission system.
|
||||
*
|
||||
* The initial owner is specified at deployment time in the constructor for `Ownable`. This
|
||||
* can later be changed with {transferOwnership} and {acceptOwnership}.
|
||||
*
|
||||
* This module is used through inheritance. It will make available all functions
|
||||
* from parent (Ownable).
|
||||
*/
|
||||
abstract contract Ownable2Step is Ownable {
|
||||
address private _pendingOwner;
|
||||
|
||||
event OwnershipTransferStarted(address indexed previousOwner, address indexed newOwner);
|
||||
|
||||
/**
|
||||
* @dev Returns the address of the pending owner.
|
||||
*/
|
||||
function pendingOwner() public view virtual returns (address) {
|
||||
return _pendingOwner;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Starts the ownership transfer of the contract to a new account. Replaces the pending transfer if there is one.
|
||||
* Can only be called by the current owner.
|
||||
*/
|
||||
function transferOwnership(address newOwner) public virtual override onlyOwner {
|
||||
_pendingOwner = newOwner;
|
||||
emit OwnershipTransferStarted(owner(), newOwner);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Transfers ownership of the contract to a new account (`newOwner`) and deletes any pending owner.
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _transferOwnership(address newOwner) internal virtual override {
|
||||
delete _pendingOwner;
|
||||
super._transferOwnership(newOwner);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev The new owner accepts the ownership transfer.
|
||||
*/
|
||||
function acceptOwnership() public virtual {
|
||||
address sender = _msgSender();
|
||||
if (pendingOwner() != sender) {
|
||||
revert OwnableUnauthorizedAccount(sender);
|
||||
}
|
||||
_transferOwnership(sender);
|
||||
}
|
||||
}
|
||||
45
lib_openzeppelin_contracts/contracts/access/README.adoc
Normal file
45
lib_openzeppelin_contracts/contracts/access/README.adoc
Normal file
@@ -0,0 +1,45 @@
|
||||
= Access Control
|
||||
|
||||
[.readme-notice]
|
||||
NOTE: This document is better viewed at https://docs.openzeppelin.com/contracts/api/access
|
||||
|
||||
This directory provides ways to restrict who can access the functions of a contract or when they can do it.
|
||||
|
||||
- {AccessManager} is a full-fledged access control solution for smart contract systems. Allows creating and assigning multiple hierarchical roles with execution delays for each account across various contracts.
|
||||
- {AccessManaged} delegates its access control to an authority that dictates the permissions of the managed contract. It's compatible with an AccessManager as an authority.
|
||||
- {AccessControl} provides a per-contract role based access control mechanism. Multiple hierarchical roles can be created and assigned each to multiple accounts within the same instance.
|
||||
- {Ownable} is a simpler mechanism with a single owner "role" that can be assigned to a single account. This simpler mechanism can be useful for quick tests but projects with production concerns are likely to outgrow it.
|
||||
|
||||
== Core
|
||||
|
||||
{{Ownable}}
|
||||
|
||||
{{Ownable2Step}}
|
||||
|
||||
{{IAccessControl}}
|
||||
|
||||
{{AccessControl}}
|
||||
|
||||
== Extensions
|
||||
|
||||
{{IAccessControlEnumerable}}
|
||||
|
||||
{{AccessControlEnumerable}}
|
||||
|
||||
{{IAccessControlDefaultAdminRules}}
|
||||
|
||||
{{AccessControlDefaultAdminRules}}
|
||||
|
||||
== AccessManager
|
||||
|
||||
{{IAuthority}}
|
||||
|
||||
{{IAccessManager}}
|
||||
|
||||
{{AccessManager}}
|
||||
|
||||
{{IAccessManaged}}
|
||||
|
||||
{{AccessManaged}}
|
||||
|
||||
{{AuthorityUtils}}
|
||||
@@ -0,0 +1,396 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/extensions/AccessControlDefaultAdminRules.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessControlDefaultAdminRules} from "./IAccessControlDefaultAdminRules.sol";
|
||||
import {AccessControl, IAccessControl} from "../AccessControl.sol";
|
||||
import {SafeCast} from "../../utils/math/SafeCast.sol";
|
||||
import {Math} from "../../utils/math/Math.sol";
|
||||
import {IERC5313} from "../../interfaces/IERC5313.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {AccessControl} that allows specifying special rules to manage
|
||||
* the `DEFAULT_ADMIN_ROLE` holder, which is a sensitive role with special permissions
|
||||
* over other roles that may potentially have privileged rights in the system.
|
||||
*
|
||||
* If a specific role doesn't have an admin role assigned, the holder of the
|
||||
* `DEFAULT_ADMIN_ROLE` will have the ability to grant it and revoke it.
|
||||
*
|
||||
* This contract implements the following risk mitigations on top of {AccessControl}:
|
||||
*
|
||||
* * Only one account holds the `DEFAULT_ADMIN_ROLE` since deployment until it's potentially renounced.
|
||||
* * Enforces a 2-step process to transfer the `DEFAULT_ADMIN_ROLE` to another account.
|
||||
* * Enforces a configurable delay between the two steps, with the ability to cancel before the transfer is accepted.
|
||||
* * The delay can be changed by scheduling, see {changeDefaultAdminDelay}.
|
||||
* * It is not possible to use another role to manage the `DEFAULT_ADMIN_ROLE`.
|
||||
*
|
||||
* Example usage:
|
||||
*
|
||||
* ```solidity
|
||||
* contract MyToken is AccessControlDefaultAdminRules {
|
||||
* constructor() AccessControlDefaultAdminRules(
|
||||
* 3 days,
|
||||
* msg.sender // Explicit initial `DEFAULT_ADMIN_ROLE` holder
|
||||
* ) {}
|
||||
* }
|
||||
* ```
|
||||
*/
|
||||
abstract contract AccessControlDefaultAdminRules is IAccessControlDefaultAdminRules, IERC5313, AccessControl {
|
||||
// pending admin pair read/written together frequently
|
||||
address private _pendingDefaultAdmin;
|
||||
uint48 private _pendingDefaultAdminSchedule; // 0 == unset
|
||||
|
||||
uint48 private _currentDelay;
|
||||
address private _currentDefaultAdmin;
|
||||
|
||||
// pending delay pair read/written together frequently
|
||||
uint48 private _pendingDelay;
|
||||
uint48 private _pendingDelaySchedule; // 0 == unset
|
||||
|
||||
/**
|
||||
* @dev Sets the initial values for {defaultAdminDelay} and {defaultAdmin} address.
|
||||
*/
|
||||
constructor(uint48 initialDelay, address initialDefaultAdmin) {
|
||||
if (initialDefaultAdmin == address(0)) {
|
||||
revert AccessControlInvalidDefaultAdmin(address(0));
|
||||
}
|
||||
_currentDelay = initialDelay;
|
||||
_grantRole(DEFAULT_ADMIN_ROLE, initialDefaultAdmin);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC165-supportsInterface}.
|
||||
*/
|
||||
function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
|
||||
return interfaceId == type(IAccessControlDefaultAdminRules).interfaceId || super.supportsInterface(interfaceId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {IERC5313-owner}.
|
||||
*/
|
||||
function owner() public view virtual returns (address) {
|
||||
return defaultAdmin();
|
||||
}
|
||||
|
||||
///
|
||||
/// Override AccessControl role management
|
||||
///
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-grantRole}. Reverts for `DEFAULT_ADMIN_ROLE`.
|
||||
*/
|
||||
function grantRole(bytes32 role, address account) public virtual override(AccessControl, IAccessControl) {
|
||||
if (role == DEFAULT_ADMIN_ROLE) {
|
||||
revert AccessControlEnforcedDefaultAdminRules();
|
||||
}
|
||||
super.grantRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-revokeRole}. Reverts for `DEFAULT_ADMIN_ROLE`.
|
||||
*/
|
||||
function revokeRole(bytes32 role, address account) public virtual override(AccessControl, IAccessControl) {
|
||||
if (role == DEFAULT_ADMIN_ROLE) {
|
||||
revert AccessControlEnforcedDefaultAdminRules();
|
||||
}
|
||||
super.revokeRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-renounceRole}.
|
||||
*
|
||||
* For the `DEFAULT_ADMIN_ROLE`, it only allows renouncing in two steps by first calling
|
||||
* {beginDefaultAdminTransfer} to the `address(0)`, so it's required that the {pendingDefaultAdmin} schedule
|
||||
* has also passed when calling this function.
|
||||
*
|
||||
* After its execution, it will not be possible to call `onlyRole(DEFAULT_ADMIN_ROLE)` functions.
|
||||
*
|
||||
* NOTE: Renouncing `DEFAULT_ADMIN_ROLE` will leave the contract without a {defaultAdmin},
|
||||
* thereby disabling any functionality that is only available for it, and the possibility of reassigning a
|
||||
* non-administrated role.
|
||||
*/
|
||||
function renounceRole(bytes32 role, address account) public virtual override(AccessControl, IAccessControl) {
|
||||
if (role == DEFAULT_ADMIN_ROLE && account == defaultAdmin()) {
|
||||
(address newDefaultAdmin, uint48 schedule) = pendingDefaultAdmin();
|
||||
if (newDefaultAdmin != address(0) || !_isScheduleSet(schedule) || !_hasSchedulePassed(schedule)) {
|
||||
revert AccessControlEnforcedDefaultAdminDelay(schedule);
|
||||
}
|
||||
delete _pendingDefaultAdminSchedule;
|
||||
}
|
||||
super.renounceRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-_grantRole}.
|
||||
*
|
||||
* For `DEFAULT_ADMIN_ROLE`, it only allows granting if there isn't already a {defaultAdmin} or if the
|
||||
* role has been previously renounced.
|
||||
*
|
||||
* NOTE: Exposing this function through another mechanism may make the `DEFAULT_ADMIN_ROLE`
|
||||
* assignable again. Make sure to guarantee this is the expected behavior in your implementation.
|
||||
*/
|
||||
function _grantRole(bytes32 role, address account) internal virtual override returns (bool) {
|
||||
if (role == DEFAULT_ADMIN_ROLE) {
|
||||
if (defaultAdmin() != address(0)) {
|
||||
revert AccessControlEnforcedDefaultAdminRules();
|
||||
}
|
||||
_currentDefaultAdmin = account;
|
||||
}
|
||||
return super._grantRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-_revokeRole}.
|
||||
*/
|
||||
function _revokeRole(bytes32 role, address account) internal virtual override returns (bool) {
|
||||
if (role == DEFAULT_ADMIN_ROLE && account == defaultAdmin()) {
|
||||
delete _currentDefaultAdmin;
|
||||
}
|
||||
return super._revokeRole(role, account);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {AccessControl-_setRoleAdmin}. Reverts for `DEFAULT_ADMIN_ROLE`.
|
||||
*/
|
||||
function _setRoleAdmin(bytes32 role, bytes32 adminRole) internal virtual override {
|
||||
if (role == DEFAULT_ADMIN_ROLE) {
|
||||
revert AccessControlEnforcedDefaultAdminRules();
|
||||
}
|
||||
super._setRoleAdmin(role, adminRole);
|
||||
}
|
||||
|
||||
///
|
||||
/// AccessControlDefaultAdminRules accessors
|
||||
///
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function defaultAdmin() public view virtual returns (address) {
|
||||
return _currentDefaultAdmin;
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function pendingDefaultAdmin() public view virtual returns (address newAdmin, uint48 schedule) {
|
||||
return (_pendingDefaultAdmin, _pendingDefaultAdminSchedule);
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function defaultAdminDelay() public view virtual returns (uint48) {
|
||||
uint48 schedule = _pendingDelaySchedule;
|
||||
return (_isScheduleSet(schedule) && _hasSchedulePassed(schedule)) ? _pendingDelay : _currentDelay;
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function pendingDefaultAdminDelay() public view virtual returns (uint48 newDelay, uint48 schedule) {
|
||||
schedule = _pendingDelaySchedule;
|
||||
return (_isScheduleSet(schedule) && !_hasSchedulePassed(schedule)) ? (_pendingDelay, schedule) : (0, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function defaultAdminDelayIncreaseWait() public view virtual returns (uint48) {
|
||||
return 5 days;
|
||||
}
|
||||
|
||||
///
|
||||
/// AccessControlDefaultAdminRules public and internal setters for defaultAdmin/pendingDefaultAdmin
|
||||
///
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function beginDefaultAdminTransfer(address newAdmin) public virtual onlyRole(DEFAULT_ADMIN_ROLE) {
|
||||
_beginDefaultAdminTransfer(newAdmin);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {beginDefaultAdminTransfer}.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _beginDefaultAdminTransfer(address newAdmin) internal virtual {
|
||||
uint48 newSchedule = SafeCast.toUint48(block.timestamp) + defaultAdminDelay();
|
||||
_setPendingDefaultAdmin(newAdmin, newSchedule);
|
||||
emit DefaultAdminTransferScheduled(newAdmin, newSchedule);
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function cancelDefaultAdminTransfer() public virtual onlyRole(DEFAULT_ADMIN_ROLE) {
|
||||
_cancelDefaultAdminTransfer();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {cancelDefaultAdminTransfer}.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _cancelDefaultAdminTransfer() internal virtual {
|
||||
_setPendingDefaultAdmin(address(0), 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function acceptDefaultAdminTransfer() public virtual {
|
||||
(address newDefaultAdmin, ) = pendingDefaultAdmin();
|
||||
if (_msgSender() != newDefaultAdmin) {
|
||||
// Enforce newDefaultAdmin explicit acceptance.
|
||||
revert AccessControlInvalidDefaultAdmin(_msgSender());
|
||||
}
|
||||
_acceptDefaultAdminTransfer();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {acceptDefaultAdminTransfer}.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _acceptDefaultAdminTransfer() internal virtual {
|
||||
(address newAdmin, uint48 schedule) = pendingDefaultAdmin();
|
||||
if (!_isScheduleSet(schedule) || !_hasSchedulePassed(schedule)) {
|
||||
revert AccessControlEnforcedDefaultAdminDelay(schedule);
|
||||
}
|
||||
_revokeRole(DEFAULT_ADMIN_ROLE, defaultAdmin());
|
||||
_grantRole(DEFAULT_ADMIN_ROLE, newAdmin);
|
||||
delete _pendingDefaultAdmin;
|
||||
delete _pendingDefaultAdminSchedule;
|
||||
}
|
||||
|
||||
///
|
||||
/// AccessControlDefaultAdminRules public and internal setters for defaultAdminDelay/pendingDefaultAdminDelay
|
||||
///
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function changeDefaultAdminDelay(uint48 newDelay) public virtual onlyRole(DEFAULT_ADMIN_ROLE) {
|
||||
_changeDefaultAdminDelay(newDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {changeDefaultAdminDelay}.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _changeDefaultAdminDelay(uint48 newDelay) internal virtual {
|
||||
uint48 newSchedule = SafeCast.toUint48(block.timestamp) + _delayChangeWait(newDelay);
|
||||
_setPendingDelay(newDelay, newSchedule);
|
||||
emit DefaultAdminDelayChangeScheduled(newDelay, newSchedule);
|
||||
}
|
||||
|
||||
/**
|
||||
* @inheritdoc IAccessControlDefaultAdminRules
|
||||
*/
|
||||
function rollbackDefaultAdminDelay() public virtual onlyRole(DEFAULT_ADMIN_ROLE) {
|
||||
_rollbackDefaultAdminDelay();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev See {rollbackDefaultAdminDelay}.
|
||||
*
|
||||
* Internal function without access restriction.
|
||||
*/
|
||||
function _rollbackDefaultAdminDelay() internal virtual {
|
||||
_setPendingDelay(0, 0);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the amount of seconds to wait after the `newDelay` will
|
||||
* become the new {defaultAdminDelay}.
|
||||
*
|
||||
* The value returned guarantees that if the delay is reduced, it will go into effect
|
||||
* after a wait that honors the previously set delay.
|
||||
*
|
||||
* See {defaultAdminDelayIncreaseWait}.
|
||||
*/
|
||||
function _delayChangeWait(uint48 newDelay) internal view virtual returns (uint48) {
|
||||
uint48 currentDelay = defaultAdminDelay();
|
||||
|
||||
// When increasing the delay, we schedule the delay change to occur after a period of "new delay" has passed, up
|
||||
// to a maximum given by defaultAdminDelayIncreaseWait, by default 5 days. For example, if increasing from 1 day
|
||||
// to 3 days, the new delay will come into effect after 3 days. If increasing from 1 day to 10 days, the new
|
||||
// delay will come into effect after 5 days. The 5 day wait period is intended to be able to fix an error like
|
||||
// using milliseconds instead of seconds.
|
||||
//
|
||||
// When decreasing the delay, we wait the difference between "current delay" and "new delay". This guarantees
|
||||
// that an admin transfer cannot be made faster than "current delay" at the time the delay change is scheduled.
|
||||
// For example, if decreasing from 10 days to 3 days, the new delay will come into effect after 7 days.
|
||||
return
|
||||
newDelay > currentDelay
|
||||
? uint48(Math.min(newDelay, defaultAdminDelayIncreaseWait())) // no need to safecast, both inputs are uint48
|
||||
: currentDelay - newDelay;
|
||||
}
|
||||
|
||||
///
|
||||
/// Private setters
|
||||
///
|
||||
|
||||
/**
|
||||
* @dev Setter of the tuple for pending admin and its schedule.
|
||||
*
|
||||
* May emit a DefaultAdminTransferCanceled event.
|
||||
*/
|
||||
function _setPendingDefaultAdmin(address newAdmin, uint48 newSchedule) private {
|
||||
(, uint48 oldSchedule) = pendingDefaultAdmin();
|
||||
|
||||
_pendingDefaultAdmin = newAdmin;
|
||||
_pendingDefaultAdminSchedule = newSchedule;
|
||||
|
||||
// An `oldSchedule` from `pendingDefaultAdmin()` is only set if it hasn't been accepted.
|
||||
if (_isScheduleSet(oldSchedule)) {
|
||||
// Emit for implicit cancellations when another default admin was scheduled.
|
||||
emit DefaultAdminTransferCanceled();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Setter of the tuple for pending delay and its schedule.
|
||||
*
|
||||
* May emit a DefaultAdminDelayChangeCanceled event.
|
||||
*/
|
||||
function _setPendingDelay(uint48 newDelay, uint48 newSchedule) private {
|
||||
uint48 oldSchedule = _pendingDelaySchedule;
|
||||
|
||||
if (_isScheduleSet(oldSchedule)) {
|
||||
if (_hasSchedulePassed(oldSchedule)) {
|
||||
// Materialize a virtual delay
|
||||
_currentDelay = _pendingDelay;
|
||||
} else {
|
||||
// Emit for implicit cancellations when another delay was scheduled.
|
||||
emit DefaultAdminDelayChangeCanceled();
|
||||
}
|
||||
}
|
||||
|
||||
_pendingDelay = newDelay;
|
||||
_pendingDelaySchedule = newSchedule;
|
||||
}
|
||||
|
||||
///
|
||||
/// Private helpers
|
||||
///
|
||||
|
||||
/**
|
||||
* @dev Defines if an `schedule` is considered set. For consistency purposes.
|
||||
*/
|
||||
function _isScheduleSet(uint48 schedule) private pure returns (bool) {
|
||||
return schedule != 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Defines if an `schedule` is considered passed. For consistency purposes.
|
||||
*/
|
||||
function _hasSchedulePassed(uint48 schedule) private view returns (bool) {
|
||||
return schedule < block.timestamp;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/extensions/AccessControlEnumerable.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessControlEnumerable} from "./IAccessControlEnumerable.sol";
|
||||
import {AccessControl} from "../AccessControl.sol";
|
||||
import {EnumerableSet} from "../../utils/structs/EnumerableSet.sol";
|
||||
|
||||
/**
|
||||
* @dev Extension of {AccessControl} that allows enumerating the members of each role.
|
||||
*/
|
||||
abstract contract AccessControlEnumerable is IAccessControlEnumerable, AccessControl {
|
||||
using EnumerableSet for EnumerableSet.AddressSet;
|
||||
|
||||
mapping(bytes32 role => EnumerableSet.AddressSet) private _roleMembers;
|
||||
|
||||
/**
|
||||
* @dev See {IERC165-supportsInterface}.
|
||||
*/
|
||||
function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) {
|
||||
return interfaceId == type(IAccessControlEnumerable).interfaceId || super.supportsInterface(interfaceId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns one of the accounts that have `role`. `index` must be a
|
||||
* value between 0 and {getRoleMemberCount}, non-inclusive.
|
||||
*
|
||||
* Role bearers are not sorted in any particular way, and their ordering may
|
||||
* change at any point.
|
||||
*
|
||||
* WARNING: When using {getRoleMember} and {getRoleMemberCount}, make sure
|
||||
* you perform all queries on the same block. See the following
|
||||
* https://forum.openzeppelin.com/t/iterating-over-elements-on-enumerableset-in-openzeppelin-contracts/2296[forum post]
|
||||
* for more information.
|
||||
*/
|
||||
function getRoleMember(bytes32 role, uint256 index) public view virtual returns (address) {
|
||||
return _roleMembers[role].at(index);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns the number of accounts that have `role`. Can be used
|
||||
* together with {getRoleMember} to enumerate all bearers of a role.
|
||||
*/
|
||||
function getRoleMemberCount(bytes32 role) public view virtual returns (uint256) {
|
||||
return _roleMembers[role].length();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Return all accounts that have `role`
|
||||
*
|
||||
* WARNING: This operation will copy the entire storage to memory, which can be quite expensive. This is designed
|
||||
* to mostly be used by view accessors that are queried without any gas fees. Developers should keep in mind that
|
||||
* this function has an unbounded cost, and using it as part of a state-changing function may render the function
|
||||
* uncallable if the set grows to a point where copying to memory consumes too much gas to fit in a block.
|
||||
*/
|
||||
function getRoleMembers(bytes32 role) public view virtual returns (address[] memory) {
|
||||
return _roleMembers[role].values();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overload {AccessControl-_grantRole} to track enumerable memberships
|
||||
*/
|
||||
function _grantRole(bytes32 role, address account) internal virtual override returns (bool) {
|
||||
bool granted = super._grantRole(role, account);
|
||||
if (granted) {
|
||||
_roleMembers[role].add(account);
|
||||
}
|
||||
return granted;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Overload {AccessControl-_revokeRole} to track enumerable memberships
|
||||
*/
|
||||
function _revokeRole(bytes32 role, address account) internal virtual override returns (bool) {
|
||||
bool revoked = super._revokeRole(role, account);
|
||||
if (revoked) {
|
||||
_roleMembers[role].remove(account);
|
||||
}
|
||||
return revoked;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,192 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/extensions/IAccessControlDefaultAdminRules.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessControl} from "../IAccessControl.sol";
|
||||
|
||||
/**
|
||||
* @dev External interface of AccessControlDefaultAdminRules declared to support ERC-165 detection.
|
||||
*/
|
||||
interface IAccessControlDefaultAdminRules is IAccessControl {
|
||||
/**
|
||||
* @dev The new default admin is not a valid default admin.
|
||||
*/
|
||||
error AccessControlInvalidDefaultAdmin(address defaultAdmin);
|
||||
|
||||
/**
|
||||
* @dev At least one of the following rules was violated:
|
||||
*
|
||||
* - The `DEFAULT_ADMIN_ROLE` must only be managed by itself.
|
||||
* - The `DEFAULT_ADMIN_ROLE` must only be held by one account at the time.
|
||||
* - Any `DEFAULT_ADMIN_ROLE` transfer must be in two delayed steps.
|
||||
*/
|
||||
error AccessControlEnforcedDefaultAdminRules();
|
||||
|
||||
/**
|
||||
* @dev The delay for transferring the default admin delay is enforced and
|
||||
* the operation must wait until `schedule`.
|
||||
*
|
||||
* NOTE: `schedule` can be 0 indicating there's no transfer scheduled.
|
||||
*/
|
||||
error AccessControlEnforcedDefaultAdminDelay(uint48 schedule);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a {defaultAdmin} transfer is started, setting `newAdmin` as the next
|
||||
* address to become the {defaultAdmin} by calling {acceptDefaultAdminTransfer} only after `acceptSchedule`
|
||||
* passes.
|
||||
*/
|
||||
event DefaultAdminTransferScheduled(address indexed newAdmin, uint48 acceptSchedule);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a {pendingDefaultAdmin} is reset if it was never accepted, regardless of its schedule.
|
||||
*/
|
||||
event DefaultAdminTransferCanceled();
|
||||
|
||||
/**
|
||||
* @dev Emitted when a {defaultAdminDelay} change is started, setting `newDelay` as the next
|
||||
* delay to be applied between default admin transfer after `effectSchedule` has passed.
|
||||
*/
|
||||
event DefaultAdminDelayChangeScheduled(uint48 newDelay, uint48 effectSchedule);
|
||||
|
||||
/**
|
||||
* @dev Emitted when a {pendingDefaultAdminDelay} is reset if its schedule didn't pass.
|
||||
*/
|
||||
event DefaultAdminDelayChangeCanceled();
|
||||
|
||||
/**
|
||||
* @dev Returns the address of the current `DEFAULT_ADMIN_ROLE` holder.
|
||||
*/
|
||||
function defaultAdmin() external view returns (address);
|
||||
|
||||
/**
|
||||
* @dev Returns a tuple of a `newAdmin` and an accept schedule.
|
||||
*
|
||||
* After the `schedule` passes, the `newAdmin` will be able to accept the {defaultAdmin} role
|
||||
* by calling {acceptDefaultAdminTransfer}, completing the role transfer.
|
||||
*
|
||||
* A zero value only in `acceptSchedule` indicates no pending admin transfer.
|
||||
*
|
||||
* NOTE: A zero address `newAdmin` means that {defaultAdmin} is being renounced.
|
||||
*/
|
||||
function pendingDefaultAdmin() external view returns (address newAdmin, uint48 acceptSchedule);
|
||||
|
||||
/**
|
||||
* @dev Returns the delay required to schedule the acceptance of a {defaultAdmin} transfer started.
|
||||
*
|
||||
* This delay will be added to the current timestamp when calling {beginDefaultAdminTransfer} to set
|
||||
* the acceptance schedule.
|
||||
*
|
||||
* NOTE: If a delay change has been scheduled, it will take effect as soon as the schedule passes, making this
|
||||
* function returns the new delay. See {changeDefaultAdminDelay}.
|
||||
*/
|
||||
function defaultAdminDelay() external view returns (uint48);
|
||||
|
||||
/**
|
||||
* @dev Returns a tuple of `newDelay` and an effect schedule.
|
||||
*
|
||||
* After the `schedule` passes, the `newDelay` will get into effect immediately for every
|
||||
* new {defaultAdmin} transfer started with {beginDefaultAdminTransfer}.
|
||||
*
|
||||
* A zero value only in `effectSchedule` indicates no pending delay change.
|
||||
*
|
||||
* NOTE: A zero value only for `newDelay` means that the next {defaultAdminDelay}
|
||||
* will be zero after the effect schedule.
|
||||
*/
|
||||
function pendingDefaultAdminDelay() external view returns (uint48 newDelay, uint48 effectSchedule);
|
||||
|
||||
/**
|
||||
* @dev Starts a {defaultAdmin} transfer by setting a {pendingDefaultAdmin} scheduled for acceptance
|
||||
* after the current timestamp plus a {defaultAdminDelay}.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Only can be called by the current {defaultAdmin}.
|
||||
*
|
||||
* Emits a DefaultAdminRoleChangeStarted event.
|
||||
*/
|
||||
function beginDefaultAdminTransfer(address newAdmin) external;
|
||||
|
||||
/**
|
||||
* @dev Cancels a {defaultAdmin} transfer previously started with {beginDefaultAdminTransfer}.
|
||||
*
|
||||
* A {pendingDefaultAdmin} not yet accepted can also be cancelled with this function.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Only can be called by the current {defaultAdmin}.
|
||||
*
|
||||
* May emit a DefaultAdminTransferCanceled event.
|
||||
*/
|
||||
function cancelDefaultAdminTransfer() external;
|
||||
|
||||
/**
|
||||
* @dev Completes a {defaultAdmin} transfer previously started with {beginDefaultAdminTransfer}.
|
||||
*
|
||||
* After calling the function:
|
||||
*
|
||||
* - `DEFAULT_ADMIN_ROLE` should be granted to the caller.
|
||||
* - `DEFAULT_ADMIN_ROLE` should be revoked from the previous holder.
|
||||
* - {pendingDefaultAdmin} should be reset to zero values.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Only can be called by the {pendingDefaultAdmin}'s `newAdmin`.
|
||||
* - The {pendingDefaultAdmin}'s `acceptSchedule` should've passed.
|
||||
*/
|
||||
function acceptDefaultAdminTransfer() external;
|
||||
|
||||
/**
|
||||
* @dev Initiates a {defaultAdminDelay} update by setting a {pendingDefaultAdminDelay} scheduled for getting
|
||||
* into effect after the current timestamp plus a {defaultAdminDelay}.
|
||||
*
|
||||
* This function guarantees that any call to {beginDefaultAdminTransfer} done between the timestamp this
|
||||
* method is called and the {pendingDefaultAdminDelay} effect schedule will use the current {defaultAdminDelay}
|
||||
* set before calling.
|
||||
*
|
||||
* The {pendingDefaultAdminDelay}'s effect schedule is defined in a way that waiting until the schedule and then
|
||||
* calling {beginDefaultAdminTransfer} with the new delay will take at least the same as another {defaultAdmin}
|
||||
* complete transfer (including acceptance).
|
||||
*
|
||||
* The schedule is designed for two scenarios:
|
||||
*
|
||||
* - When the delay is changed for a larger one the schedule is `block.timestamp + newDelay` capped by
|
||||
* {defaultAdminDelayIncreaseWait}.
|
||||
* - When the delay is changed for a shorter one, the schedule is `block.timestamp + (current delay - new delay)`.
|
||||
*
|
||||
* A {pendingDefaultAdminDelay} that never got into effect will be canceled in favor of a new scheduled change.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Only can be called by the current {defaultAdmin}.
|
||||
*
|
||||
* Emits a DefaultAdminDelayChangeScheduled event and may emit a DefaultAdminDelayChangeCanceled event.
|
||||
*/
|
||||
function changeDefaultAdminDelay(uint48 newDelay) external;
|
||||
|
||||
/**
|
||||
* @dev Cancels a scheduled {defaultAdminDelay} change.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - Only can be called by the current {defaultAdmin}.
|
||||
*
|
||||
* May emit a DefaultAdminDelayChangeCanceled event.
|
||||
*/
|
||||
function rollbackDefaultAdminDelay() external;
|
||||
|
||||
/**
|
||||
* @dev Maximum time in seconds for an increase to {defaultAdminDelay} (that is scheduled using {changeDefaultAdminDelay})
|
||||
* to take effect. Default to 5 days.
|
||||
*
|
||||
* When the {defaultAdminDelay} is scheduled to be increased, it goes into effect after the new delay has passed with
|
||||
* the purpose of giving enough time for reverting any accidental change (i.e. using milliseconds instead of seconds)
|
||||
* that may lock the contract. However, to avoid excessive schedules, the wait is capped by this function and it can
|
||||
* be overrode for a custom {defaultAdminDelay} increase scheduling.
|
||||
*
|
||||
* IMPORTANT: Make sure to add a reasonable amount of time while overriding this value, otherwise,
|
||||
* there's a risk of setting a high new delay that goes into effect almost immediately without the
|
||||
* possibility of human intervention in the case of an input error (eg. set milliseconds instead of seconds).
|
||||
*/
|
||||
function defaultAdminDelayIncreaseWait() external view returns (uint48);
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/extensions/IAccessControlEnumerable.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessControl} from "../IAccessControl.sol";
|
||||
|
||||
/**
|
||||
* @dev External interface of AccessControlEnumerable declared to support ERC-165 detection.
|
||||
*/
|
||||
interface IAccessControlEnumerable is IAccessControl {
|
||||
/**
|
||||
* @dev Returns one of the accounts that have `role`. `index` must be a
|
||||
* value between 0 and {getRoleMemberCount}, non-inclusive.
|
||||
*
|
||||
* Role bearers are not sorted in any particular way, and their ordering may
|
||||
* change at any point.
|
||||
*
|
||||
* WARNING: When using {getRoleMember} and {getRoleMemberCount}, make sure
|
||||
* you perform all queries on the same block. See the following
|
||||
* https://forum.openzeppelin.com/t/iterating-over-elements-on-enumerableset-in-openzeppelin-contracts/2296[forum post]
|
||||
* for more information.
|
||||
*/
|
||||
function getRoleMember(bytes32 role, uint256 index) external view returns (address);
|
||||
|
||||
/**
|
||||
* @dev Returns the number of accounts that have `role`. Can be used
|
||||
* together with {getRoleMember} to enumerate all bearers of a role.
|
||||
*/
|
||||
function getRoleMemberCount(bytes32 role) external view returns (uint256);
|
||||
}
|
||||
@@ -0,0 +1,113 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/AccessManaged.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAuthority} from "./IAuthority.sol";
|
||||
import {AuthorityUtils} from "./AuthorityUtils.sol";
|
||||
import {IAccessManager} from "./IAccessManager.sol";
|
||||
import {IAccessManaged} from "./IAccessManaged.sol";
|
||||
import {Context} from "../../utils/Context.sol";
|
||||
|
||||
/**
|
||||
* @dev This contract module makes available a {restricted} modifier. Functions decorated with this modifier will be
|
||||
* permissioned according to an "authority": a contract like {AccessManager} that follows the {IAuthority} interface,
|
||||
* implementing a policy that allows certain callers to access certain functions.
|
||||
*
|
||||
* IMPORTANT: The `restricted` modifier should never be used on `internal` functions, judiciously used in `public`
|
||||
* functions, and ideally only used in `external` functions. See {restricted}.
|
||||
*/
|
||||
abstract contract AccessManaged is Context, IAccessManaged {
|
||||
address private _authority;
|
||||
|
||||
bool private _consumingSchedule;
|
||||
|
||||
/**
|
||||
* @dev Initializes the contract connected to an initial authority.
|
||||
*/
|
||||
constructor(address initialAuthority) {
|
||||
_setAuthority(initialAuthority);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Restricts access to a function as defined by the connected Authority for this contract and the
|
||||
* caller and selector of the function that entered the contract.
|
||||
*
|
||||
* [IMPORTANT]
|
||||
* ====
|
||||
* In general, this modifier should only be used on `external` functions. It is okay to use it on `public`
|
||||
* functions that are used as external entry points and are not called internally. Unless you know what you're
|
||||
* doing, it should never be used on `internal` functions. Failure to follow these rules can have critical security
|
||||
* implications! This is because the permissions are determined by the function that entered the contract, i.e. the
|
||||
* function at the bottom of the call stack, and not the function where the modifier is visible in the source code.
|
||||
* ====
|
||||
*
|
||||
* [WARNING]
|
||||
* ====
|
||||
* Avoid adding this modifier to the https://docs.soliditylang.org/en/v0.8.20/contracts.html#receive-ether-function[`receive()`]
|
||||
* function or the https://docs.soliditylang.org/en/v0.8.20/contracts.html#fallback-function[`fallback()`]. These
|
||||
* functions are the only execution paths where a function selector cannot be unambiguously determined from the calldata
|
||||
* since the selector defaults to `0x00000000` in the `receive()` function and similarly in the `fallback()` function
|
||||
* if no calldata is provided. (See {_checkCanCall}).
|
||||
*
|
||||
* The `receive()` function will always panic whereas the `fallback()` may panic depending on the calldata length.
|
||||
* ====
|
||||
*/
|
||||
modifier restricted() {
|
||||
_checkCanCall(_msgSender(), _msgData());
|
||||
_;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManaged
|
||||
function authority() public view virtual returns (address) {
|
||||
return _authority;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManaged
|
||||
function setAuthority(address newAuthority) public virtual {
|
||||
address caller = _msgSender();
|
||||
if (caller != authority()) {
|
||||
revert AccessManagedUnauthorized(caller);
|
||||
}
|
||||
if (newAuthority.code.length == 0) {
|
||||
revert AccessManagedInvalidAuthority(newAuthority);
|
||||
}
|
||||
_setAuthority(newAuthority);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManaged
|
||||
function isConsumingScheduledOp() public view returns (bytes4) {
|
||||
return _consumingSchedule ? this.isConsumingScheduledOp.selector : bytes4(0);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Transfers control to a new authority. Internal function with no access restriction. Allows bypassing the
|
||||
* permissions set by the current authority.
|
||||
*/
|
||||
function _setAuthority(address newAuthority) internal virtual {
|
||||
_authority = newAuthority;
|
||||
emit AuthorityUpdated(newAuthority);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Reverts if the caller is not allowed to call the function identified by a selector. Panics if the calldata
|
||||
* is less than 4 bytes long.
|
||||
*/
|
||||
function _checkCanCall(address caller, bytes calldata data) internal virtual {
|
||||
(bool immediate, uint32 delay) = AuthorityUtils.canCallWithDelay(
|
||||
authority(),
|
||||
caller,
|
||||
address(this),
|
||||
bytes4(data[0:4])
|
||||
);
|
||||
if (!immediate) {
|
||||
if (delay > 0) {
|
||||
_consumingSchedule = true;
|
||||
IAccessManager(authority()).consumeScheduledOp(caller, data);
|
||||
_consumingSchedule = false;
|
||||
} else {
|
||||
revert AccessManagedUnauthorized(caller);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,731 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/AccessManager.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessManager} from "./IAccessManager.sol";
|
||||
import {IAccessManaged} from "./IAccessManaged.sol";
|
||||
import {Address} from "../../utils/Address.sol";
|
||||
import {Context} from "../../utils/Context.sol";
|
||||
import {Multicall} from "../../utils/Multicall.sol";
|
||||
import {Math} from "../../utils/math/Math.sol";
|
||||
import {Time} from "../../utils/types/Time.sol";
|
||||
|
||||
/**
|
||||
* @dev AccessManager is a central contract to store the permissions of a system.
|
||||
*
|
||||
* A smart contract under the control of an AccessManager instance is known as a target, and will inherit from the
|
||||
* {AccessManaged} contract, be connected to this contract as its manager and implement the {AccessManaged-restricted}
|
||||
* modifier on a set of functions selected to be permissioned. Note that any function without this setup won't be
|
||||
* effectively restricted.
|
||||
*
|
||||
* The restriction rules for such functions are defined in terms of "roles" identified by an `uint64` and scoped
|
||||
* by target (`address`) and function selectors (`bytes4`). These roles are stored in this contract and can be
|
||||
* configured by admins (`ADMIN_ROLE` members) after a delay (see {getTargetAdminDelay}).
|
||||
*
|
||||
* For each target contract, admins can configure the following without any delay:
|
||||
*
|
||||
* * The target's {AccessManaged-authority} via {updateAuthority}.
|
||||
* * Close or open a target via {setTargetClosed} keeping the permissions intact.
|
||||
* * The roles that are allowed (or disallowed) to call a given function (identified by its selector) through {setTargetFunctionRole}.
|
||||
*
|
||||
* By default every address is member of the `PUBLIC_ROLE` and every target function is restricted to the `ADMIN_ROLE` until configured otherwise.
|
||||
* Additionally, each role has the following configuration options restricted to this manager's admins:
|
||||
*
|
||||
* * A role's admin role via {setRoleAdmin} who can grant or revoke roles.
|
||||
* * A role's guardian role via {setRoleGuardian} who's allowed to cancel operations.
|
||||
* * A delay in which a role takes effect after being granted through {setGrantDelay}.
|
||||
* * A delay of any target's admin action via {setTargetAdminDelay}.
|
||||
* * A role label for discoverability purposes with {labelRole}.
|
||||
*
|
||||
* Any account can be added and removed into any number of these roles by using the {grantRole} and {revokeRole} functions
|
||||
* restricted to each role's admin (see {getRoleAdmin}).
|
||||
*
|
||||
* Since all the permissions of the managed system can be modified by the admins of this instance, it is expected that
|
||||
* they will be highly secured (e.g., a multisig or a well-configured DAO).
|
||||
*
|
||||
* NOTE: This contract implements a form of the {IAuthority} interface, but {canCall} has additional return data so it
|
||||
* doesn't inherit `IAuthority`. It is however compatible with the `IAuthority` interface since the first 32 bytes of
|
||||
* the return data are a boolean as expected by that interface.
|
||||
*
|
||||
* NOTE: Systems that implement other access control mechanisms (for example using {Ownable}) can be paired with an
|
||||
* {AccessManager} by transferring permissions (ownership in the case of {Ownable}) directly to the {AccessManager}.
|
||||
* Users will be able to interact with these contracts through the {execute} function, following the access rules
|
||||
* registered in the {AccessManager}. Keep in mind that in that context, the msg.sender seen by restricted functions
|
||||
* will be {AccessManager} itself.
|
||||
*
|
||||
* WARNING: When granting permissions over an {Ownable} or {AccessControl} contract to an {AccessManager}, be very
|
||||
* mindful of the danger associated with functions such as {Ownable-renounceOwnership} or
|
||||
* {AccessControl-renounceRole}.
|
||||
*/
|
||||
contract AccessManager is Context, Multicall, IAccessManager {
|
||||
using Time for *;
|
||||
|
||||
// Structure that stores the details for a target contract.
|
||||
struct TargetConfig {
|
||||
mapping(bytes4 selector => uint64 roleId) allowedRoles;
|
||||
Time.Delay adminDelay;
|
||||
bool closed;
|
||||
}
|
||||
|
||||
// Structure that stores the details for a role/account pair. This structures fit into a single slot.
|
||||
struct Access {
|
||||
// Timepoint at which the user gets the permission.
|
||||
// If this is either 0 or in the future, then the role permission is not available.
|
||||
uint48 since;
|
||||
// Delay for execution. Only applies to restricted() / execute() calls.
|
||||
Time.Delay delay;
|
||||
}
|
||||
|
||||
// Structure that stores the details of a role.
|
||||
struct Role {
|
||||
// Members of the role.
|
||||
mapping(address user => Access access) members;
|
||||
// Admin who can grant or revoke permissions.
|
||||
uint64 admin;
|
||||
// Guardian who can cancel operations targeting functions that need this role.
|
||||
uint64 guardian;
|
||||
// Delay in which the role takes effect after being granted.
|
||||
Time.Delay grantDelay;
|
||||
}
|
||||
|
||||
// Structure that stores the details for a scheduled operation. This structure fits into a single slot.
|
||||
struct Schedule {
|
||||
// Moment at which the operation can be executed.
|
||||
uint48 timepoint;
|
||||
// Operation nonce to allow third-party contracts to identify the operation.
|
||||
uint32 nonce;
|
||||
}
|
||||
|
||||
uint64 public constant ADMIN_ROLE = type(uint64).min; // 0
|
||||
uint64 public constant PUBLIC_ROLE = type(uint64).max; // 2**64-1
|
||||
|
||||
mapping(address target => TargetConfig mode) private _targets;
|
||||
mapping(uint64 roleId => Role) private _roles;
|
||||
mapping(bytes32 operationId => Schedule) private _schedules;
|
||||
|
||||
// Used to identify operations that are currently being executed via {execute}.
|
||||
// This should be transient storage when supported by the EVM.
|
||||
bytes32 private _executionId;
|
||||
|
||||
/**
|
||||
* @dev Check that the caller is authorized to perform the operation.
|
||||
* See {AccessManager} description for a detailed breakdown of the authorization logic.
|
||||
*/
|
||||
modifier onlyAuthorized() {
|
||||
_checkAuthorized();
|
||||
_;
|
||||
}
|
||||
|
||||
constructor(address initialAdmin) {
|
||||
if (initialAdmin == address(0)) {
|
||||
revert AccessManagerInvalidInitialAdmin(address(0));
|
||||
}
|
||||
|
||||
// admin is active immediately and without any execution delay.
|
||||
_grantRole(ADMIN_ROLE, initialAdmin, 0, 0);
|
||||
}
|
||||
|
||||
// =================================================== GETTERS ====================================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function canCall(
|
||||
address caller,
|
||||
address target,
|
||||
bytes4 selector
|
||||
) public view virtual returns (bool immediate, uint32 delay) {
|
||||
if (isTargetClosed(target)) {
|
||||
return (false, 0);
|
||||
} else if (caller == address(this)) {
|
||||
// Caller is AccessManager, this means the call was sent through {execute} and it already checked
|
||||
// permissions. We verify that the call "identifier", which is set during {execute}, is correct.
|
||||
return (_isExecuting(target, selector), 0);
|
||||
} else {
|
||||
uint64 roleId = getTargetFunctionRole(target, selector);
|
||||
(bool isMember, uint32 currentDelay) = hasRole(roleId, caller);
|
||||
return isMember ? (currentDelay == 0, currentDelay) : (false, 0);
|
||||
}
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function expiration() public view virtual returns (uint32) {
|
||||
return 1 weeks;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function minSetback() public view virtual returns (uint32) {
|
||||
return 5 days;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function isTargetClosed(address target) public view virtual returns (bool) {
|
||||
return _targets[target].closed;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getTargetFunctionRole(address target, bytes4 selector) public view virtual returns (uint64) {
|
||||
return _targets[target].allowedRoles[selector];
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getTargetAdminDelay(address target) public view virtual returns (uint32) {
|
||||
return _targets[target].adminDelay.get();
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getRoleAdmin(uint64 roleId) public view virtual returns (uint64) {
|
||||
return _roles[roleId].admin;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getRoleGuardian(uint64 roleId) public view virtual returns (uint64) {
|
||||
return _roles[roleId].guardian;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getRoleGrantDelay(uint64 roleId) public view virtual returns (uint32) {
|
||||
return _roles[roleId].grantDelay.get();
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getAccess(
|
||||
uint64 roleId,
|
||||
address account
|
||||
) public view virtual returns (uint48 since, uint32 currentDelay, uint32 pendingDelay, uint48 effect) {
|
||||
Access storage access = _roles[roleId].members[account];
|
||||
|
||||
since = access.since;
|
||||
(currentDelay, pendingDelay, effect) = access.delay.getFull();
|
||||
|
||||
return (since, currentDelay, pendingDelay, effect);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function hasRole(
|
||||
uint64 roleId,
|
||||
address account
|
||||
) public view virtual returns (bool isMember, uint32 executionDelay) {
|
||||
if (roleId == PUBLIC_ROLE) {
|
||||
return (true, 0);
|
||||
} else {
|
||||
(uint48 hasRoleSince, uint32 currentDelay, , ) = getAccess(roleId, account);
|
||||
return (hasRoleSince != 0 && hasRoleSince <= Time.timestamp(), currentDelay);
|
||||
}
|
||||
}
|
||||
|
||||
// =============================================== ROLE MANAGEMENT ===============================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function labelRole(uint64 roleId, string calldata label) public virtual onlyAuthorized {
|
||||
if (roleId == ADMIN_ROLE || roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
emit RoleLabel(roleId, label);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function grantRole(uint64 roleId, address account, uint32 executionDelay) public virtual onlyAuthorized {
|
||||
_grantRole(roleId, account, getRoleGrantDelay(roleId), executionDelay);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function revokeRole(uint64 roleId, address account) public virtual onlyAuthorized {
|
||||
_revokeRole(roleId, account);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function renounceRole(uint64 roleId, address callerConfirmation) public virtual {
|
||||
if (callerConfirmation != _msgSender()) {
|
||||
revert AccessManagerBadConfirmation();
|
||||
}
|
||||
_revokeRole(roleId, callerConfirmation);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function setRoleAdmin(uint64 roleId, uint64 admin) public virtual onlyAuthorized {
|
||||
_setRoleAdmin(roleId, admin);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function setRoleGuardian(uint64 roleId, uint64 guardian) public virtual onlyAuthorized {
|
||||
_setRoleGuardian(roleId, guardian);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function setGrantDelay(uint64 roleId, uint32 newDelay) public virtual onlyAuthorized {
|
||||
_setGrantDelay(roleId, newDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {grantRole} without access control. Returns true if the role was newly granted.
|
||||
*
|
||||
* Emits a {RoleGranted} event.
|
||||
*/
|
||||
function _grantRole(
|
||||
uint64 roleId,
|
||||
address account,
|
||||
uint32 grantDelay,
|
||||
uint32 executionDelay
|
||||
) internal virtual returns (bool) {
|
||||
if (roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
|
||||
bool newMember = _roles[roleId].members[account].since == 0;
|
||||
uint48 since;
|
||||
|
||||
if (newMember) {
|
||||
since = Time.timestamp() + grantDelay;
|
||||
_roles[roleId].members[account] = Access({since: since, delay: executionDelay.toDelay()});
|
||||
} else {
|
||||
// No setback here. Value can be reset by doing revoke + grant, effectively allowing the admin to perform
|
||||
// any change to the execution delay within the duration of the role admin delay.
|
||||
(_roles[roleId].members[account].delay, since) = _roles[roleId].members[account].delay.withUpdate(
|
||||
executionDelay,
|
||||
0
|
||||
);
|
||||
}
|
||||
|
||||
emit RoleGranted(roleId, account, executionDelay, since, newMember);
|
||||
return newMember;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {revokeRole} without access control. This logic is also used by {renounceRole}.
|
||||
* Returns true if the role was previously granted.
|
||||
*
|
||||
* Emits a {RoleRevoked} event if the account had the role.
|
||||
*/
|
||||
function _revokeRole(uint64 roleId, address account) internal virtual returns (bool) {
|
||||
if (roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
|
||||
if (_roles[roleId].members[account].since == 0) {
|
||||
return false;
|
||||
}
|
||||
|
||||
delete _roles[roleId].members[account];
|
||||
|
||||
emit RoleRevoked(roleId, account);
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setRoleAdmin} without access control.
|
||||
*
|
||||
* Emits a {RoleAdminChanged} event.
|
||||
*
|
||||
* NOTE: Setting the admin role as the `PUBLIC_ROLE` is allowed, but it will effectively allow
|
||||
* anyone to set grant or revoke such role.
|
||||
*/
|
||||
function _setRoleAdmin(uint64 roleId, uint64 admin) internal virtual {
|
||||
if (roleId == ADMIN_ROLE || roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
|
||||
_roles[roleId].admin = admin;
|
||||
|
||||
emit RoleAdminChanged(roleId, admin);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setRoleGuardian} without access control.
|
||||
*
|
||||
* Emits a {RoleGuardianChanged} event.
|
||||
*
|
||||
* NOTE: Setting the guardian role as the `PUBLIC_ROLE` is allowed, but it will effectively allow
|
||||
* anyone to cancel any scheduled operation for such role.
|
||||
*/
|
||||
function _setRoleGuardian(uint64 roleId, uint64 guardian) internal virtual {
|
||||
if (roleId == ADMIN_ROLE || roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
|
||||
_roles[roleId].guardian = guardian;
|
||||
|
||||
emit RoleGuardianChanged(roleId, guardian);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setGrantDelay} without access control.
|
||||
*
|
||||
* Emits a {RoleGrantDelayChanged} event.
|
||||
*/
|
||||
function _setGrantDelay(uint64 roleId, uint32 newDelay) internal virtual {
|
||||
if (roleId == PUBLIC_ROLE) {
|
||||
revert AccessManagerLockedRole(roleId);
|
||||
}
|
||||
|
||||
uint48 effect;
|
||||
(_roles[roleId].grantDelay, effect) = _roles[roleId].grantDelay.withUpdate(newDelay, minSetback());
|
||||
|
||||
emit RoleGrantDelayChanged(roleId, newDelay, effect);
|
||||
}
|
||||
|
||||
// ============================================= FUNCTION MANAGEMENT ==============================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function setTargetFunctionRole(
|
||||
address target,
|
||||
bytes4[] calldata selectors,
|
||||
uint64 roleId
|
||||
) public virtual onlyAuthorized {
|
||||
for (uint256 i = 0; i < selectors.length; ++i) {
|
||||
_setTargetFunctionRole(target, selectors[i], roleId);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setTargetFunctionRole} without access control.
|
||||
*
|
||||
* Emits a {TargetFunctionRoleUpdated} event.
|
||||
*/
|
||||
function _setTargetFunctionRole(address target, bytes4 selector, uint64 roleId) internal virtual {
|
||||
_targets[target].allowedRoles[selector] = roleId;
|
||||
emit TargetFunctionRoleUpdated(target, selector, roleId);
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function setTargetAdminDelay(address target, uint32 newDelay) public virtual onlyAuthorized {
|
||||
_setTargetAdminDelay(target, newDelay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal version of {setTargetAdminDelay} without access control.
|
||||
*
|
||||
* Emits a {TargetAdminDelayUpdated} event.
|
||||
*/
|
||||
function _setTargetAdminDelay(address target, uint32 newDelay) internal virtual {
|
||||
uint48 effect;
|
||||
(_targets[target].adminDelay, effect) = _targets[target].adminDelay.withUpdate(newDelay, minSetback());
|
||||
|
||||
emit TargetAdminDelayUpdated(target, newDelay, effect);
|
||||
}
|
||||
|
||||
// =============================================== MODE MANAGEMENT ================================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function setTargetClosed(address target, bool closed) public virtual onlyAuthorized {
|
||||
_setTargetClosed(target, closed);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Set the closed flag for a contract. This is an internal setter with no access restrictions.
|
||||
*
|
||||
* Emits a {TargetClosed} event.
|
||||
*/
|
||||
function _setTargetClosed(address target, bool closed) internal virtual {
|
||||
if (target == address(this)) {
|
||||
revert AccessManagerLockedAccount(target);
|
||||
}
|
||||
_targets[target].closed = closed;
|
||||
emit TargetClosed(target, closed);
|
||||
}
|
||||
|
||||
// ============================================== DELAYED OPERATIONS ==============================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function getSchedule(bytes32 id) public view virtual returns (uint48) {
|
||||
uint48 timepoint = _schedules[id].timepoint;
|
||||
return _isExpired(timepoint) ? 0 : timepoint;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function getNonce(bytes32 id) public view virtual returns (uint32) {
|
||||
return _schedules[id].nonce;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function schedule(
|
||||
address target,
|
||||
bytes calldata data,
|
||||
uint48 when
|
||||
) public virtual returns (bytes32 operationId, uint32 nonce) {
|
||||
address caller = _msgSender();
|
||||
|
||||
// Fetch restrictions that apply to the caller on the targeted function
|
||||
(, uint32 setback) = _canCallExtended(caller, target, data);
|
||||
|
||||
uint48 minWhen = Time.timestamp() + setback;
|
||||
|
||||
// If call with delay is not authorized, or if requested timing is too soon, revert
|
||||
if (setback == 0 || (when > 0 && when < minWhen)) {
|
||||
revert AccessManagerUnauthorizedCall(caller, target, _checkSelector(data));
|
||||
}
|
||||
|
||||
// Reuse variable due to stack too deep
|
||||
when = uint48(Math.max(when, minWhen)); // cast is safe: both inputs are uint48
|
||||
|
||||
// If caller is authorised, schedule operation
|
||||
operationId = hashOperation(caller, target, data);
|
||||
|
||||
_checkNotScheduled(operationId);
|
||||
|
||||
unchecked {
|
||||
// It's not feasible to overflow the nonce in less than 1000 years
|
||||
nonce = _schedules[operationId].nonce + 1;
|
||||
}
|
||||
_schedules[operationId].timepoint = when;
|
||||
_schedules[operationId].nonce = nonce;
|
||||
emit OperationScheduled(operationId, nonce, when, caller, target, data);
|
||||
|
||||
// Using named return values because otherwise we get stack too deep
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Reverts if the operation is currently scheduled and has not expired.
|
||||
*
|
||||
* NOTE: This function was introduced due to stack too deep errors in schedule.
|
||||
*/
|
||||
function _checkNotScheduled(bytes32 operationId) private view {
|
||||
uint48 prevTimepoint = _schedules[operationId].timepoint;
|
||||
if (prevTimepoint != 0 && !_isExpired(prevTimepoint)) {
|
||||
revert AccessManagerAlreadyScheduled(operationId);
|
||||
}
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
// Reentrancy is not an issue because permissions are checked on msg.sender. Additionally,
|
||||
// _consumeScheduledOp guarantees a scheduled operation is only executed once.
|
||||
// slither-disable-next-line reentrancy-no-eth
|
||||
function execute(address target, bytes calldata data) public payable virtual returns (uint32) {
|
||||
address caller = _msgSender();
|
||||
|
||||
// Fetch restrictions that apply to the caller on the targeted function
|
||||
(bool immediate, uint32 setback) = _canCallExtended(caller, target, data);
|
||||
|
||||
// If call is not authorized, revert
|
||||
if (!immediate && setback == 0) {
|
||||
revert AccessManagerUnauthorizedCall(caller, target, _checkSelector(data));
|
||||
}
|
||||
|
||||
bytes32 operationId = hashOperation(caller, target, data);
|
||||
uint32 nonce;
|
||||
|
||||
// If caller is authorised, check operation was scheduled early enough
|
||||
// Consume an available schedule even if there is no currently enforced delay
|
||||
if (setback != 0 || getSchedule(operationId) != 0) {
|
||||
nonce = _consumeScheduledOp(operationId);
|
||||
}
|
||||
|
||||
// Mark the target and selector as authorised
|
||||
bytes32 executionIdBefore = _executionId;
|
||||
_executionId = _hashExecutionId(target, _checkSelector(data));
|
||||
|
||||
// Perform call
|
||||
Address.functionCallWithValue(target, data, msg.value);
|
||||
|
||||
// Reset execute identifier
|
||||
_executionId = executionIdBefore;
|
||||
|
||||
return nonce;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function cancel(address caller, address target, bytes calldata data) public virtual returns (uint32) {
|
||||
address msgsender = _msgSender();
|
||||
bytes4 selector = _checkSelector(data);
|
||||
|
||||
bytes32 operationId = hashOperation(caller, target, data);
|
||||
if (_schedules[operationId].timepoint == 0) {
|
||||
revert AccessManagerNotScheduled(operationId);
|
||||
} else if (caller != msgsender) {
|
||||
// calls can only be canceled by the account that scheduled them, a global admin, or by a guardian of the required role.
|
||||
(bool isAdmin, ) = hasRole(ADMIN_ROLE, msgsender);
|
||||
(bool isGuardian, ) = hasRole(getRoleGuardian(getTargetFunctionRole(target, selector)), msgsender);
|
||||
if (!isAdmin && !isGuardian) {
|
||||
revert AccessManagerUnauthorizedCancel(msgsender, caller, target, selector);
|
||||
}
|
||||
}
|
||||
|
||||
delete _schedules[operationId].timepoint; // reset the timepoint, keep the nonce
|
||||
uint32 nonce = _schedules[operationId].nonce;
|
||||
emit OperationCanceled(operationId, nonce);
|
||||
|
||||
return nonce;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function consumeScheduledOp(address caller, bytes calldata data) public virtual {
|
||||
address target = _msgSender();
|
||||
if (IAccessManaged(target).isConsumingScheduledOp() != IAccessManaged.isConsumingScheduledOp.selector) {
|
||||
revert AccessManagerUnauthorizedConsume(target);
|
||||
}
|
||||
_consumeScheduledOp(hashOperation(caller, target, data));
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Internal variant of {consumeScheduledOp} that operates on bytes32 operationId.
|
||||
*
|
||||
* Returns the nonce of the scheduled operation that is consumed.
|
||||
*/
|
||||
function _consumeScheduledOp(bytes32 operationId) internal virtual returns (uint32) {
|
||||
uint48 timepoint = _schedules[operationId].timepoint;
|
||||
uint32 nonce = _schedules[operationId].nonce;
|
||||
|
||||
if (timepoint == 0) {
|
||||
revert AccessManagerNotScheduled(operationId);
|
||||
} else if (timepoint > Time.timestamp()) {
|
||||
revert AccessManagerNotReady(operationId);
|
||||
} else if (_isExpired(timepoint)) {
|
||||
revert AccessManagerExpired(operationId);
|
||||
}
|
||||
|
||||
delete _schedules[operationId].timepoint; // reset the timepoint, keep the nonce
|
||||
emit OperationExecuted(operationId, nonce);
|
||||
|
||||
return nonce;
|
||||
}
|
||||
|
||||
/// @inheritdoc IAccessManager
|
||||
function hashOperation(address caller, address target, bytes calldata data) public view virtual returns (bytes32) {
|
||||
return keccak256(abi.encode(caller, target, data));
|
||||
}
|
||||
|
||||
// ==================================================== OTHERS ====================================================
|
||||
/// @inheritdoc IAccessManager
|
||||
function updateAuthority(address target, address newAuthority) public virtual onlyAuthorized {
|
||||
IAccessManaged(target).setAuthority(newAuthority);
|
||||
}
|
||||
|
||||
// ================================================= ADMIN LOGIC ==================================================
|
||||
/**
|
||||
* @dev Check if the current call is authorized according to admin logic.
|
||||
*/
|
||||
function _checkAuthorized() private {
|
||||
address caller = _msgSender();
|
||||
(bool immediate, uint32 delay) = _canCallSelf(caller, _msgData());
|
||||
if (!immediate) {
|
||||
if (delay == 0) {
|
||||
(, uint64 requiredRole, ) = _getAdminRestrictions(_msgData());
|
||||
revert AccessManagerUnauthorizedAccount(caller, requiredRole);
|
||||
} else {
|
||||
_consumeScheduledOp(hashOperation(caller, address(this), _msgData()));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Get the admin restrictions of a given function call based on the function and arguments involved.
|
||||
*
|
||||
* Returns:
|
||||
* - bool restricted: does this data match a restricted operation
|
||||
* - uint64: which role is this operation restricted to
|
||||
* - uint32: minimum delay to enforce for that operation (max between operation's delay and admin's execution delay)
|
||||
*/
|
||||
function _getAdminRestrictions(
|
||||
bytes calldata data
|
||||
) private view returns (bool restricted, uint64 roleAdminId, uint32 executionDelay) {
|
||||
if (data.length < 4) {
|
||||
return (false, 0, 0);
|
||||
}
|
||||
|
||||
bytes4 selector = _checkSelector(data);
|
||||
|
||||
// Restricted to ADMIN with no delay beside any execution delay the caller may have
|
||||
if (
|
||||
selector == this.labelRole.selector ||
|
||||
selector == this.setRoleAdmin.selector ||
|
||||
selector == this.setRoleGuardian.selector ||
|
||||
selector == this.setGrantDelay.selector ||
|
||||
selector == this.setTargetAdminDelay.selector
|
||||
) {
|
||||
return (true, ADMIN_ROLE, 0);
|
||||
}
|
||||
|
||||
// Restricted to ADMIN with the admin delay corresponding to the target
|
||||
if (
|
||||
selector == this.updateAuthority.selector ||
|
||||
selector == this.setTargetClosed.selector ||
|
||||
selector == this.setTargetFunctionRole.selector
|
||||
) {
|
||||
// First argument is a target.
|
||||
address target = abi.decode(data[0x04:0x24], (address));
|
||||
uint32 delay = getTargetAdminDelay(target);
|
||||
return (true, ADMIN_ROLE, delay);
|
||||
}
|
||||
|
||||
// Restricted to that role's admin with no delay beside any execution delay the caller may have.
|
||||
if (selector == this.grantRole.selector || selector == this.revokeRole.selector) {
|
||||
// First argument is a roleId.
|
||||
uint64 roleId = abi.decode(data[0x04:0x24], (uint64));
|
||||
return (true, getRoleAdmin(roleId), 0);
|
||||
}
|
||||
|
||||
return (false, 0, 0);
|
||||
}
|
||||
|
||||
// =================================================== HELPERS ====================================================
|
||||
/**
|
||||
* @dev An extended version of {canCall} for internal usage that checks {_canCallSelf}
|
||||
* when the target is this contract.
|
||||
*
|
||||
* Returns:
|
||||
* - bool immediate: whether the operation can be executed immediately (with no delay)
|
||||
* - uint32 delay: the execution delay
|
||||
*/
|
||||
function _canCallExtended(
|
||||
address caller,
|
||||
address target,
|
||||
bytes calldata data
|
||||
) private view returns (bool immediate, uint32 delay) {
|
||||
if (target == address(this)) {
|
||||
return _canCallSelf(caller, data);
|
||||
} else {
|
||||
return data.length < 4 ? (false, 0) : canCall(caller, target, _checkSelector(data));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev A version of {canCall} that checks for admin restrictions in this contract.
|
||||
*/
|
||||
function _canCallSelf(address caller, bytes calldata data) private view returns (bool immediate, uint32 delay) {
|
||||
if (data.length < 4) {
|
||||
return (false, 0);
|
||||
}
|
||||
|
||||
if (caller == address(this)) {
|
||||
// Caller is AccessManager, this means the call was sent through {execute} and it already checked
|
||||
// permissions. We verify that the call "identifier", which is set during {execute}, is correct.
|
||||
return (_isExecuting(address(this), _checkSelector(data)), 0);
|
||||
}
|
||||
|
||||
(bool enabled, uint64 roleId, uint32 operationDelay) = _getAdminRestrictions(data);
|
||||
if (!enabled) {
|
||||
return (false, 0);
|
||||
}
|
||||
|
||||
(bool inRole, uint32 executionDelay) = hasRole(roleId, caller);
|
||||
if (!inRole) {
|
||||
return (false, 0);
|
||||
}
|
||||
|
||||
// downcast is safe because both options are uint32
|
||||
delay = uint32(Math.max(operationDelay, executionDelay));
|
||||
return (delay == 0, delay);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns true if a call with `target` and `selector` is being executed via {executed}.
|
||||
*/
|
||||
function _isExecuting(address target, bytes4 selector) private view returns (bool) {
|
||||
return _executionId == _hashExecutionId(target, selector);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Returns true if a schedule timepoint is past its expiration deadline.
|
||||
*/
|
||||
function _isExpired(uint48 timepoint) private view returns (bool) {
|
||||
return timepoint + expiration() <= Time.timestamp();
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Extracts the selector from calldata. Panics if data is not at least 4 bytes
|
||||
*/
|
||||
function _checkSelector(bytes calldata data) private pure returns (bytes4) {
|
||||
return bytes4(data[0:4]);
|
||||
}
|
||||
|
||||
/**
|
||||
* @dev Hashing function for execute protection
|
||||
*/
|
||||
function _hashExecutionId(address target, bytes4 selector) private pure returns (bytes32) {
|
||||
return keccak256(abi.encode(target, selector));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/AuthorityUtils.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAuthority} from "./IAuthority.sol";
|
||||
|
||||
library AuthorityUtils {
|
||||
/**
|
||||
* @dev Since `AccessManager` implements an extended IAuthority interface, invoking `canCall` with backwards compatibility
|
||||
* for the preexisting `IAuthority` interface requires special care to avoid reverting on insufficient return data.
|
||||
* This helper function takes care of invoking `canCall` in a backwards compatible way without reverting.
|
||||
*/
|
||||
function canCallWithDelay(
|
||||
address authority,
|
||||
address caller,
|
||||
address target,
|
||||
bytes4 selector
|
||||
) internal view returns (bool immediate, uint32 delay) {
|
||||
(bool success, bytes memory data) = authority.staticcall(
|
||||
abi.encodeCall(IAuthority.canCall, (caller, target, selector))
|
||||
);
|
||||
if (success) {
|
||||
if (data.length >= 0x40) {
|
||||
(immediate, delay) = abi.decode(data, (bool, uint32));
|
||||
} else if (data.length >= 0x20) {
|
||||
immediate = abi.decode(data, (bool));
|
||||
}
|
||||
}
|
||||
return (immediate, delay);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/IAccessManaged.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
interface IAccessManaged {
|
||||
/**
|
||||
* @dev Authority that manages this contract was updated.
|
||||
*/
|
||||
event AuthorityUpdated(address authority);
|
||||
|
||||
error AccessManagedUnauthorized(address caller);
|
||||
error AccessManagedRequiredDelay(address caller, uint32 delay);
|
||||
error AccessManagedInvalidAuthority(address authority);
|
||||
|
||||
/**
|
||||
* @dev Returns the current authority.
|
||||
*/
|
||||
function authority() external view returns (address);
|
||||
|
||||
/**
|
||||
* @dev Transfers control to a new authority. The caller must be the current authority.
|
||||
*/
|
||||
function setAuthority(address) external;
|
||||
|
||||
/**
|
||||
* @dev Returns true only in the context of a delayed restricted call, at the moment that the scheduled operation is
|
||||
* being consumed. Prevents denial of service for delayed restricted calls in the case that the contract performs
|
||||
* attacker controlled calls.
|
||||
*/
|
||||
function isConsumingScheduledOp() external view returns (bytes4);
|
||||
}
|
||||
@@ -0,0 +1,399 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/IAccessManager.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
import {IAccessManaged} from "./IAccessManaged.sol";
|
||||
import {Time} from "../../utils/types/Time.sol";
|
||||
|
||||
interface IAccessManager {
|
||||
/**
|
||||
* @dev A delayed operation was scheduled.
|
||||
*/
|
||||
event OperationScheduled(
|
||||
bytes32 indexed operationId,
|
||||
uint32 indexed nonce,
|
||||
uint48 schedule,
|
||||
address caller,
|
||||
address target,
|
||||
bytes data
|
||||
);
|
||||
|
||||
/**
|
||||
* @dev A scheduled operation was executed.
|
||||
*/
|
||||
event OperationExecuted(bytes32 indexed operationId, uint32 indexed nonce);
|
||||
|
||||
/**
|
||||
* @dev A scheduled operation was canceled.
|
||||
*/
|
||||
event OperationCanceled(bytes32 indexed operationId, uint32 indexed nonce);
|
||||
|
||||
/**
|
||||
* @dev Informational labelling for a roleId.
|
||||
*/
|
||||
event RoleLabel(uint64 indexed roleId, string label);
|
||||
|
||||
/**
|
||||
* @dev Emitted when `account` is granted `roleId`.
|
||||
*
|
||||
* NOTE: The meaning of the `since` argument depends on the `newMember` argument.
|
||||
* If the role is granted to a new member, the `since` argument indicates when the account becomes a member of the role,
|
||||
* otherwise it indicates the execution delay for this account and roleId is updated.
|
||||
*/
|
||||
event RoleGranted(uint64 indexed roleId, address indexed account, uint32 delay, uint48 since, bool newMember);
|
||||
|
||||
/**
|
||||
* @dev Emitted when `account` membership or `roleId` is revoked. Unlike granting, revoking is instantaneous.
|
||||
*/
|
||||
event RoleRevoked(uint64 indexed roleId, address indexed account);
|
||||
|
||||
/**
|
||||
* @dev Role acting as admin over a given `roleId` is updated.
|
||||
*/
|
||||
event RoleAdminChanged(uint64 indexed roleId, uint64 indexed admin);
|
||||
|
||||
/**
|
||||
* @dev Role acting as guardian over a given `roleId` is updated.
|
||||
*/
|
||||
event RoleGuardianChanged(uint64 indexed roleId, uint64 indexed guardian);
|
||||
|
||||
/**
|
||||
* @dev Grant delay for a given `roleId` will be updated to `delay` when `since` is reached.
|
||||
*/
|
||||
event RoleGrantDelayChanged(uint64 indexed roleId, uint32 delay, uint48 since);
|
||||
|
||||
/**
|
||||
* @dev Target mode is updated (true = closed, false = open).
|
||||
*/
|
||||
event TargetClosed(address indexed target, bool closed);
|
||||
|
||||
/**
|
||||
* @dev Role required to invoke `selector` on `target` is updated to `roleId`.
|
||||
*/
|
||||
event TargetFunctionRoleUpdated(address indexed target, bytes4 selector, uint64 indexed roleId);
|
||||
|
||||
/**
|
||||
* @dev Admin delay for a given `target` will be updated to `delay` when `since` is reached.
|
||||
*/
|
||||
event TargetAdminDelayUpdated(address indexed target, uint32 delay, uint48 since);
|
||||
|
||||
error AccessManagerAlreadyScheduled(bytes32 operationId);
|
||||
error AccessManagerNotScheduled(bytes32 operationId);
|
||||
error AccessManagerNotReady(bytes32 operationId);
|
||||
error AccessManagerExpired(bytes32 operationId);
|
||||
error AccessManagerLockedAccount(address account);
|
||||
error AccessManagerLockedRole(uint64 roleId);
|
||||
error AccessManagerBadConfirmation();
|
||||
error AccessManagerUnauthorizedAccount(address msgsender, uint64 roleId);
|
||||
error AccessManagerUnauthorizedCall(address caller, address target, bytes4 selector);
|
||||
error AccessManagerUnauthorizedConsume(address target);
|
||||
error AccessManagerUnauthorizedCancel(address msgsender, address caller, address target, bytes4 selector);
|
||||
error AccessManagerInvalidInitialAdmin(address initialAdmin);
|
||||
|
||||
/**
|
||||
* @dev Check if an address (`caller`) is authorised to call a given function on a given contract directly (with
|
||||
* no restriction). Additionally, it returns the delay needed to perform the call indirectly through the {schedule}
|
||||
* & {execute} workflow.
|
||||
*
|
||||
* This function is usually called by the targeted contract to control immediate execution of restricted functions.
|
||||
* Therefore we only return true if the call can be performed without any delay. If the call is subject to a
|
||||
* previously set delay (not zero), then the function should return false and the caller should schedule the operation
|
||||
* for future execution.
|
||||
*
|
||||
* If `immediate` is true, the delay can be disregarded and the operation can be immediately executed, otherwise
|
||||
* the operation can be executed if and only if delay is greater than 0.
|
||||
*
|
||||
* NOTE: The IAuthority interface does not include the `uint32` delay. This is an extension of that interface that
|
||||
* is backward compatible. Some contracts may thus ignore the second return argument. In that case they will fail
|
||||
* to identify the indirect workflow, and will consider calls that require a delay to be forbidden.
|
||||
*
|
||||
* NOTE: This function does not report the permissions of this manager itself. These are defined by the
|
||||
* {AccessManager} documentation.
|
||||
*/
|
||||
function canCall(
|
||||
address caller,
|
||||
address target,
|
||||
bytes4 selector
|
||||
) external view returns (bool allowed, uint32 delay);
|
||||
|
||||
/**
|
||||
* @dev Expiration delay for scheduled proposals. Defaults to 1 week.
|
||||
*
|
||||
* IMPORTANT: Avoid overriding the expiration with 0. Otherwise every contract proposal will be expired immediately,
|
||||
* disabling any scheduling usage.
|
||||
*/
|
||||
function expiration() external view returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Minimum setback for all delay updates, with the exception of execution delays. It
|
||||
* can be increased without setback (and reset via {revokeRole} in the case event of an
|
||||
* accidental increase). Defaults to 5 days.
|
||||
*/
|
||||
function minSetback() external view returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Get whether the contract is closed disabling any access. Otherwise role permissions are applied.
|
||||
*/
|
||||
function isTargetClosed(address target) external view returns (bool);
|
||||
|
||||
/**
|
||||
* @dev Get the role required to call a function.
|
||||
*/
|
||||
function getTargetFunctionRole(address target, bytes4 selector) external view returns (uint64);
|
||||
|
||||
/**
|
||||
* @dev Get the admin delay for a target contract. Changes to contract configuration are subject to this delay.
|
||||
*/
|
||||
function getTargetAdminDelay(address target) external view returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Get the id of the role that acts as an admin for the given role.
|
||||
*
|
||||
* The admin permission is required to grant the role, revoke the role and update the execution delay to execute
|
||||
* an operation that is restricted to this role.
|
||||
*/
|
||||
function getRoleAdmin(uint64 roleId) external view returns (uint64);
|
||||
|
||||
/**
|
||||
* @dev Get the role that acts as a guardian for a given role.
|
||||
*
|
||||
* The guardian permission allows canceling operations that have been scheduled under the role.
|
||||
*/
|
||||
function getRoleGuardian(uint64 roleId) external view returns (uint64);
|
||||
|
||||
/**
|
||||
* @dev Get the role current grant delay.
|
||||
*
|
||||
* Its value may change at any point without an event emitted following a call to {setGrantDelay}.
|
||||
* Changes to this value, including effect timepoint are notified in advance by the {RoleGrantDelayChanged} event.
|
||||
*/
|
||||
function getRoleGrantDelay(uint64 roleId) external view returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Get the access details for a given account for a given role. These details include the timepoint at which
|
||||
* membership becomes active, and the delay applied to all operation by this user that requires this permission
|
||||
* level.
|
||||
*
|
||||
* Returns:
|
||||
* [0] Timestamp at which the account membership becomes valid. 0 means role is not granted.
|
||||
* [1] Current execution delay for the account.
|
||||
* [2] Pending execution delay for the account.
|
||||
* [3] Timestamp at which the pending execution delay will become active. 0 means no delay update is scheduled.
|
||||
*/
|
||||
function getAccess(
|
||||
uint64 roleId,
|
||||
address account
|
||||
) external view returns (uint48 since, uint32 currentDelay, uint32 pendingDelay, uint48 effect);
|
||||
|
||||
/**
|
||||
* @dev Check if a given account currently has the permission level corresponding to a given role. Note that this
|
||||
* permission might be associated with an execution delay. {getAccess} can provide more details.
|
||||
*/
|
||||
function hasRole(uint64 roleId, address account) external view returns (bool isMember, uint32 executionDelay);
|
||||
|
||||
/**
|
||||
* @dev Give a label to a role, for improved role discoverability by UIs.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {RoleLabel} event.
|
||||
*/
|
||||
function labelRole(uint64 roleId, string calldata label) external;
|
||||
|
||||
/**
|
||||
* @dev Add `account` to `roleId`, or change its execution delay.
|
||||
*
|
||||
* This gives the account the authorization to call any function that is restricted to this role. An optional
|
||||
* execution delay (in seconds) can be set. If that delay is non 0, the user is required to schedule any operation
|
||||
* that is restricted to members of this role. The user will only be able to execute the operation after the delay has
|
||||
* passed, before it has expired. During this period, admin and guardians can cancel the operation (see {cancel}).
|
||||
*
|
||||
* If the account has already been granted this role, the execution delay will be updated. This update is not
|
||||
* immediate and follows the delay rules. For example, if a user currently has a delay of 3 hours, and this is
|
||||
* called to reduce that delay to 1 hour, the new delay will take some time to take effect, enforcing that any
|
||||
* operation executed in the 3 hours that follows this update was indeed scheduled before this update.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be an admin for the role (see {getRoleAdmin})
|
||||
* - granted role must not be the `PUBLIC_ROLE`
|
||||
*
|
||||
* Emits a {RoleGranted} event.
|
||||
*/
|
||||
function grantRole(uint64 roleId, address account, uint32 executionDelay) external;
|
||||
|
||||
/**
|
||||
* @dev Remove an account from a role, with immediate effect. If the account does not have the role, this call has
|
||||
* no effect.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be an admin for the role (see {getRoleAdmin})
|
||||
* - revoked role must not be the `PUBLIC_ROLE`
|
||||
*
|
||||
* Emits a {RoleRevoked} event if the account had the role.
|
||||
*/
|
||||
function revokeRole(uint64 roleId, address account) external;
|
||||
|
||||
/**
|
||||
* @dev Renounce role permissions for the calling account with immediate effect. If the sender is not in
|
||||
* the role this call has no effect.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be `callerConfirmation`.
|
||||
*
|
||||
* Emits a {RoleRevoked} event if the account had the role.
|
||||
*/
|
||||
function renounceRole(uint64 roleId, address callerConfirmation) external;
|
||||
|
||||
/**
|
||||
* @dev Change admin role for a given role.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {RoleAdminChanged} event
|
||||
*/
|
||||
function setRoleAdmin(uint64 roleId, uint64 admin) external;
|
||||
|
||||
/**
|
||||
* @dev Change guardian role for a given role.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {RoleGuardianChanged} event
|
||||
*/
|
||||
function setRoleGuardian(uint64 roleId, uint64 guardian) external;
|
||||
|
||||
/**
|
||||
* @dev Update the delay for granting a `roleId`.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {RoleGrantDelayChanged} event.
|
||||
*/
|
||||
function setGrantDelay(uint64 roleId, uint32 newDelay) external;
|
||||
|
||||
/**
|
||||
* @dev Set the role required to call functions identified by the `selectors` in the `target` contract.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {TargetFunctionRoleUpdated} event per selector.
|
||||
*/
|
||||
function setTargetFunctionRole(address target, bytes4[] calldata selectors, uint64 roleId) external;
|
||||
|
||||
/**
|
||||
* @dev Set the delay for changing the configuration of a given target contract.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {TargetAdminDelayUpdated} event.
|
||||
*/
|
||||
function setTargetAdminDelay(address target, uint32 newDelay) external;
|
||||
|
||||
/**
|
||||
* @dev Set the closed flag for a contract.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*
|
||||
* Emits a {TargetClosed} event.
|
||||
*/
|
||||
function setTargetClosed(address target, bool closed) external;
|
||||
|
||||
/**
|
||||
* @dev Return the timepoint at which a scheduled operation will be ready for execution. This returns 0 if the
|
||||
* operation is not yet scheduled, has expired, was executed, or was canceled.
|
||||
*/
|
||||
function getSchedule(bytes32 id) external view returns (uint48);
|
||||
|
||||
/**
|
||||
* @dev Return the nonce for the latest scheduled operation with a given id. Returns 0 if the operation has never
|
||||
* been scheduled.
|
||||
*/
|
||||
function getNonce(bytes32 id) external view returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Schedule a delayed operation for future execution, and return the operation identifier. It is possible to
|
||||
* choose the timestamp at which the operation becomes executable as long as it satisfies the execution delays
|
||||
* required for the caller. The special value zero will automatically set the earliest possible time.
|
||||
*
|
||||
* Returns the `operationId` that was scheduled. Since this value is a hash of the parameters, it can reoccur when
|
||||
* the same parameters are used; if this is relevant, the returned `nonce` can be used to uniquely identify this
|
||||
* scheduled operation from other occurrences of the same `operationId` in invocations of {execute} and {cancel}.
|
||||
*
|
||||
* Emits a {OperationScheduled} event.
|
||||
*
|
||||
* NOTE: It is not possible to concurrently schedule more than one operation with the same `target` and `data`. If
|
||||
* this is necessary, a random byte can be appended to `data` to act as a salt that will be ignored by the target
|
||||
* contract if it is using standard Solidity ABI encoding.
|
||||
*/
|
||||
function schedule(
|
||||
address target,
|
||||
bytes calldata data,
|
||||
uint48 when
|
||||
) external returns (bytes32 operationId, uint32 nonce);
|
||||
|
||||
/**
|
||||
* @dev Execute a function that is delay restricted, provided it was properly scheduled beforehand, or the
|
||||
* execution delay is 0.
|
||||
*
|
||||
* Returns the nonce that identifies the previously scheduled operation that is executed, or 0 if the
|
||||
* operation wasn't previously scheduled (if the caller doesn't have an execution delay).
|
||||
*
|
||||
* Emits an {OperationExecuted} event only if the call was scheduled and delayed.
|
||||
*/
|
||||
function execute(address target, bytes calldata data) external payable returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Cancel a scheduled (delayed) operation. Returns the nonce that identifies the previously scheduled
|
||||
* operation that is cancelled.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be the proposer, a guardian of the targeted function, or a global admin
|
||||
*
|
||||
* Emits a {OperationCanceled} event.
|
||||
*/
|
||||
function cancel(address caller, address target, bytes calldata data) external returns (uint32);
|
||||
|
||||
/**
|
||||
* @dev Consume a scheduled operation targeting the caller. If such an operation exists, mark it as consumed
|
||||
* (emit an {OperationExecuted} event and clean the state). Otherwise, throw an error.
|
||||
*
|
||||
* This is useful for contract that want to enforce that calls targeting them were scheduled on the manager,
|
||||
* with all the verifications that it implies.
|
||||
*
|
||||
* Emit a {OperationExecuted} event.
|
||||
*/
|
||||
function consumeScheduledOp(address caller, bytes calldata data) external;
|
||||
|
||||
/**
|
||||
* @dev Hashing function for delayed operations.
|
||||
*/
|
||||
function hashOperation(address caller, address target, bytes calldata data) external view returns (bytes32);
|
||||
|
||||
/**
|
||||
* @dev Changes the authority of a target managed by this manager instance.
|
||||
*
|
||||
* Requirements:
|
||||
*
|
||||
* - the caller must be a global admin
|
||||
*/
|
||||
function updateAuthority(address target, address newAuthority) external;
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
// SPDX-License-Identifier: MIT
|
||||
// OpenZeppelin Contracts (last updated v5.0.0) (access/manager/IAuthority.sol)
|
||||
|
||||
pragma solidity ^0.8.20;
|
||||
|
||||
/**
|
||||
* @dev Standard interface for permissioning originally defined in Dappsys.
|
||||
*/
|
||||
interface IAuthority {
|
||||
/**
|
||||
* @dev Returns true if the caller can invoke on a target the function identified by a function selector.
|
||||
*/
|
||||
function canCall(address caller, address target, bytes4 selector) external view returns (bool allowed);
|
||||
}
|
||||
Reference in New Issue
Block a user