centralization-risk

Skill: CENTRALIZATION_RISK

Trigger: Protocol has privileged roles (admin, operator, governance, resource account owner) Covers: Single points of failure, privilege escalation, external governance dependencies Required: NO (optional -- recommended when protocol has 3+ distinct privileged roles) Inject Into: Breadth agents

Trigger Patterns

admin|owner|operator|governance|signer_cap|SignerCapability|resource_account|
has_role|is_admin|only_admin|assert_admin|get_signer

Aptos Capability Model Context

Aptos Move uses a capability-based access control model fundamentally different from EVM modifiers:

• Signer-based: Functions receive &signer and check signer::address_of(account) == @admin
• Capability pattern: SignerCapability stored in resources grants signing rights to resource accounts
• No modifiers: Access control is enforced via assert! checks inside function bodies
• Resource accounts: Accounts controlled by SignerCapability rather than a private key
• Object ownership: Object<T> has an owner chain; ownership transfers control access

Reasoning Template

Step 1: Privilege Inventory

Enumerate ALL capability-gated functions by searching for signer checks and capability usage:

#	Function	Module	Access Gate	What It Controls	Impact If Abused
1	{func}	{module}	assert!(addr == @admin)	{parameter/state}	{worst case}
2	{func}	{module}	SignerCapability stored in {resource}	{operation}	{worst case}
3	{func}	{module}	Object<T> ownership check	{asset control}	{worst case}

MANDATORY GREP: Search all .move files for:

• signer::address_of followed by equality checks
• SignerCapability usage (creation, storage, account::create_signer_with_capability)
• object::is_owner and ownership assertions
• Named address references (@admin, @operator, @governance, @protocol)