auditing-smart-contract-access-control

Auditing smart-contract access control: who is allowed to call the privileged function

Access control on a contract is a set of gates: a modifier or a check that says only the owner, only a role, only during initialization. The bug is a privileged action, moving funds, changing configuration, upgrading, self-destructing, whose gate is missing, wrong, or reachable by the wrong caller. This is a crowded audit area, so the discipline is confirming the action is genuinely privileged and the gate is genuinely absent or defeated on a reachable path, not flagging every public function. The dividing line from reentrancy: if the fix is to add or repair an authorization check, it belongs here; if the fix is to reorder effects before interactions or add a mutex, it belongs in the reentrancy skill. Two initialization and delegation shapes, the unprotected initializer and the delegatecall to an attacker-controlled target, are access-control bugs and are audited here.

When to use

• A function changes state, moves funds, upgrades, self-destructs, or grants a role.
• You see an authorization modifier, an ownership or role check, an initializer, or a delegatecall.
• You want to know whether an attacker can reach a privileged action the contract meant to restrict.

Scope check

Audit only contracts you own or are authorized to assess, and exercise a privileged path only on a test network or a local fork, calling an unguarded privileged function on a live contract can seize or destroy real value. Prove it on a fork. If you can't name the authorization, stop.

The loop

1. Inventory the privileged actions and their gates first. List every function that moves funds, changes configuration, upgrades, self-destructs, or grants a role, and for each find the gate that is meant to restrict it (an owner or role modifier, an internal check). A function is only a finding if it is genuinely privileged and its gate is absent, wrong, or reachable by the wrong caller; establish both before flagging.