|
|
@@ -126,26 +126,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
|
|
|
// =================================================== GETTERS ====================================================
|
|
|
- /**
|
|
|
- * @dev Check if an address (`caller`) is authorised to call a given function on a given contract directly (with
|
|
|
- * no restriction). Additionally, it returns the delay needed to perform the call indirectly through the {schedule}
|
|
|
- * & {execute} workflow.
|
|
|
- *
|
|
|
- * This function is usually called by the targeted contract to control immediate execution of restricted functions.
|
|
|
- * Therefore we only return true if the call can be performed without any delay. If the call is subject to a
|
|
|
- * previously set delay (not zero), then the function should return false and the caller should schedule the operation
|
|
|
- * for future execution.
|
|
|
- *
|
|
|
- * If `immediate` is true, the delay can be disregarded and the operation can be immediately executed, otherwise
|
|
|
- * the operation can be executed if and only if delay is greater than 0.
|
|
|
- *
|
|
|
- * NOTE: The IAuthority interface does not include the `uint32` delay. This is an extension of that interface that
|
|
|
- * is backward compatible. Some contracts may thus ignore the second return argument. In that case they will fail
|
|
|
- * to identify the indirect workflow, and will consider calls that require a delay to be forbidden.
|
|
|
- *
|
|
|
- * NOTE: This function does not report the permissions of this manager itself. These are defined by the
|
|
|
- * {_canCallSelf} function instead.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function canCall(
|
|
|
address caller,
|
|
|
address target,
|
|
|
@@ -164,86 +145,47 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Expiration delay for scheduled proposals. Defaults to 1 week.
|
|
|
- *
|
|
|
- * IMPORTANT: Avoid overriding the expiration with 0. Otherwise every contract proposal will be expired immediately,
|
|
|
- * disabling any scheduling usage.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function expiration() public view virtual returns (uint32) {
|
|
|
return 1 weeks;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Minimum setback for all delay updates, with the exception of execution delays. It
|
|
|
- * can be increased without setback (and in the event of an accidental increase can be reset
|
|
|
- * via {revokeRole}). Defaults to 5 days.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function minSetback() public view virtual returns (uint32) {
|
|
|
return 5 days;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get whether the contract is closed disabling any access. Otherwise role permissions are applied.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function isTargetClosed(address target) public view virtual returns (bool) {
|
|
|
return _targets[target].closed;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the role required to call a function.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getTargetFunctionRole(address target, bytes4 selector) public view virtual returns (uint64) {
|
|
|
return _targets[target].allowedRoles[selector];
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the admin delay for a target contract. Changes to contract configuration are subject to this delay.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getTargetAdminDelay(address target) public view virtual returns (uint32) {
|
|
|
return _targets[target].adminDelay.get();
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the id of the role that acts as an admin for the given role.
|
|
|
- *
|
|
|
- * The admin permission is required to grant the role, revoke the role and update the execution delay to execute
|
|
|
- * an operation that is restricted to this role.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getRoleAdmin(uint64 roleId) public view virtual returns (uint64) {
|
|
|
return _roles[roleId].admin;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the role that acts as a guardian for a given role.
|
|
|
- *
|
|
|
- * The guardian permission allows canceling operations that have been scheduled under the role.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getRoleGuardian(uint64 roleId) public view virtual returns (uint64) {
|
|
|
return _roles[roleId].guardian;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the role current grant delay.
|
|
|
- *
|
|
|
- * Its value may change at any point without an event emitted following a call to {setGrantDelay}.
|
|
|
- * Changes to this value, including effect timepoint are notified in advance by the {RoleGrantDelayChanged} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getRoleGrantDelay(uint64 roleId) public view virtual returns (uint32) {
|
|
|
return _roles[roleId].grantDelay.get();
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Get the access details for a given account for a given role. These details include the timepoint at which
|
|
|
- * membership becomes active, and the delay applied to all operation by this user that requires this permission
|
|
|
- * level.
|
|
|
- *
|
|
|
- * Returns:
|
|
|
- * [0] Timestamp at which the account membership becomes valid. 0 means role is not granted.
|
|
|
- * [1] Current execution delay for the account.
|
|
|
- * [2] Pending execution delay for the account.
|
|
|
- * [3] Timestamp at which the pending execution delay will become active. 0 means no delay update is scheduled.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getAccess(
|
|
|
uint64 roleId,
|
|
|
address account
|
|
|
@@ -256,10 +198,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
return (since, currentDelay, pendingDelay, effect);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Check if a given account currently has the permission level corresponding to a given role. Note that this
|
|
|
- * permission might be associated with an execution delay. {getAccess} can provide more details.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function hasRole(
|
|
|
uint64 roleId,
|
|
|
address account
|
|
|
@@ -273,15 +212,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
|
|
|
// =============================================== ROLE MANAGEMENT ===============================================
|
|
|
- /**
|
|
|
- * @dev Give a label to a role, for improved role discoverabily by UIs.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {RoleLabel} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function labelRole(uint64 roleId, string calldata label) public virtual onlyAuthorized {
|
|
|
if (roleId == ADMIN_ROLE || roleId == PUBLIC_ROLE) {
|
|
|
revert AccessManagerLockedRole(roleId);
|
|
|
@@ -289,55 +220,17 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
emit RoleLabel(roleId, label);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Add `account` to `roleId`, or change its execution delay.
|
|
|
- *
|
|
|
- * This gives the account the authorization to call any function that is restricted to this role. An optional
|
|
|
- * execution delay (in seconds) can be set. If that delay is non 0, the user is required to schedule any operation
|
|
|
- * that is restricted to members of this role. The user will only be able to execute the operation after the delay has
|
|
|
- * passed, before it has expired. During this period, admin and guardians can cancel the operation (see {cancel}).
|
|
|
- *
|
|
|
- * If the account has already been granted this role, the execution delay will be updated. This update is not
|
|
|
- * immediate and follows the delay rules. For example, if a user currently has a delay of 3 hours, and this is
|
|
|
- * called to reduce that delay to 1 hour, the new delay will take some time to take effect, enforcing that any
|
|
|
- * operation executed in the 3 hours that follows this update was indeed scheduled before this update.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be an admin for the role (see {getRoleAdmin})
|
|
|
- * - granted role must not be the `PUBLIC_ROLE`
|
|
|
- *
|
|
|
- * Emits a {RoleGranted} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function grantRole(uint64 roleId, address account, uint32 executionDelay) public virtual onlyAuthorized {
|
|
|
_grantRole(roleId, account, getRoleGrantDelay(roleId), executionDelay);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Remove an account from a role, with immediate effect. If the account does not have the role, this call has
|
|
|
- * no effect.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be an admin for the role (see {getRoleAdmin})
|
|
|
- * - revoked role must not be the `PUBLIC_ROLE`
|
|
|
- *
|
|
|
- * Emits a {RoleRevoked} event if the account had the role.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function revokeRole(uint64 roleId, address account) public virtual onlyAuthorized {
|
|
|
_revokeRole(roleId, account);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Renounce role permissions for the calling account with immediate effect. If the sender is not in
|
|
|
- * the role this call has no effect.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be `callerConfirmation`.
|
|
|
- *
|
|
|
- * Emits a {RoleRevoked} event if the account had the role.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function renounceRole(uint64 roleId, address callerConfirmation) public virtual {
|
|
|
if (callerConfirmation != _msgSender()) {
|
|
|
revert AccessManagerBadConfirmation();
|
|
|
@@ -345,41 +238,17 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
_revokeRole(roleId, callerConfirmation);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Change admin role for a given role.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {RoleAdminChanged} event
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setRoleAdmin(uint64 roleId, uint64 admin) public virtual onlyAuthorized {
|
|
|
_setRoleAdmin(roleId, admin);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Change guardian role for a given role.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {RoleGuardianChanged} event
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setRoleGuardian(uint64 roleId, uint64 guardian) public virtual onlyAuthorized {
|
|
|
_setRoleGuardian(roleId, guardian);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Update the delay for granting a `roleId`.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {RoleGrantDelayChanged} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setGrantDelay(uint64 roleId, uint32 newDelay) public virtual onlyAuthorized {
|
|
|
_setGrantDelay(roleId, newDelay);
|
|
|
}
|
|
|
@@ -492,15 +361,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
|
|
|
// ============================================= FUNCTION MANAGEMENT ==============================================
|
|
|
- /**
|
|
|
- * @dev Set the role required to call functions identified by the `selectors` in the `target` contract.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {TargetFunctionRoleUpdated} event per selector.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setTargetFunctionRole(
|
|
|
address target,
|
|
|
bytes4[] calldata selectors,
|
|
|
@@ -521,15 +382,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
emit TargetFunctionRoleUpdated(target, selector, roleId);
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Set the delay for changing the configuration of a given target contract.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {TargetAdminDelayUpdated} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setTargetAdminDelay(address target, uint32 newDelay) public virtual onlyAuthorized {
|
|
|
_setTargetAdminDelay(target, newDelay);
|
|
|
}
|
|
|
@@ -547,15 +400,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
|
|
|
// =============================================== MODE MANAGEMENT ================================================
|
|
|
- /**
|
|
|
- * @dev Set the closed flag for a contract.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- *
|
|
|
- * Emits a {TargetClosed} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function setTargetClosed(address target, bool closed) public virtual onlyAuthorized {
|
|
|
_setTargetClosed(target, closed);
|
|
|
}
|
|
|
@@ -574,38 +419,18 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
|
|
|
// ============================================== DELAYED OPERATIONS ==============================================
|
|
|
- /**
|
|
|
- * @dev Return the timepoint at which a scheduled operation will be ready for execution. This returns 0 if the
|
|
|
- * operation is not yet scheduled, has expired, was executed, or was canceled.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getSchedule(bytes32 id) public view virtual returns (uint48) {
|
|
|
uint48 timepoint = _schedules[id].timepoint;
|
|
|
return _isExpired(timepoint) ? 0 : timepoint;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Return the nonce for the latest scheduled operation with a given id. Returns 0 if the operation has never
|
|
|
- * been scheduled.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function getNonce(bytes32 id) public view virtual returns (uint32) {
|
|
|
return _schedules[id].nonce;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Schedule a delayed operation for future execution, and return the operation identifier. It is possible to
|
|
|
- * choose the timestamp at which the operation becomes executable as long as it satisfies the execution delays
|
|
|
- * required for the caller. The special value zero will automatically set the earliest possible time.
|
|
|
- *
|
|
|
- * Returns the `operationId` that was scheduled. Since this value is a hash of the parameters, it can reoccur when
|
|
|
- * the same parameters are used; if this is relevant, the returned `nonce` can be used to uniquely identify this
|
|
|
- * scheduled operation from other occurrences of the same `operationId` in invocations of {execute} and {cancel}.
|
|
|
- *
|
|
|
- * Emits a {OperationScheduled} event.
|
|
|
- *
|
|
|
- * NOTE: It is not possible to concurrently schedule more than one operation with the same `target` and `data`. If
|
|
|
- * this is necessary, a random byte can be appended to `data` to act as a salt that will be ignored by the target
|
|
|
- * contract if it is using standard Solidity ABI encoding.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function schedule(
|
|
|
address target,
|
|
|
bytes calldata data,
|
|
|
@@ -653,15 +478,7 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Execute a function that is delay restricted, provided it was properly scheduled beforehand, or the
|
|
|
- * execution delay is 0.
|
|
|
- *
|
|
|
- * Returns the nonce that identifies the previously scheduled operation that is executed, or 0 if the
|
|
|
- * operation wasn't previously scheduled (if the caller doesn't have an execution delay).
|
|
|
- *
|
|
|
- * Emits an {OperationExecuted} event only if the call was scheduled and delayed.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
// Reentrancy is not an issue because permissions are checked on msg.sender. Additionally,
|
|
|
// _consumeScheduledOp guarantees a scheduled operation is only executed once.
|
|
|
// slither-disable-next-line reentrancy-no-eth
|
|
|
@@ -698,15 +515,31 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
return nonce;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Consume a scheduled operation targeting the caller. If such an operation exists, mark it as consumed
|
|
|
- * (emit an {OperationExecuted} event and clean the state). Otherwise, throw an error.
|
|
|
- *
|
|
|
- * This is useful for contract that want to enforce that calls targeting them were scheduled on the manager,
|
|
|
- * with all the verifications that it implies.
|
|
|
- *
|
|
|
- * Emit a {OperationExecuted} event.
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
+ function cancel(address caller, address target, bytes calldata data) public virtual returns (uint32) {
|
|
|
+ address msgsender = _msgSender();
|
|
|
+ bytes4 selector = _checkSelector(data);
|
|
|
+
|
|
|
+ bytes32 operationId = hashOperation(caller, target, data);
|
|
|
+ if (_schedules[operationId].timepoint == 0) {
|
|
|
+ revert AccessManagerNotScheduled(operationId);
|
|
|
+ } else if (caller != msgsender) {
|
|
|
+ // calls can only be canceled by the account that scheduled them, a global admin, or by a guardian of the required role.
|
|
|
+ (bool isAdmin, ) = hasRole(ADMIN_ROLE, msgsender);
|
|
|
+ (bool isGuardian, ) = hasRole(getRoleGuardian(getTargetFunctionRole(target, selector)), msgsender);
|
|
|
+ if (!isAdmin && !isGuardian) {
|
|
|
+ revert AccessManagerUnauthorizedCancel(msgsender, caller, target, selector);
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
+ delete _schedules[operationId].timepoint; // reset the timepoint, keep the nonce
|
|
|
+ uint32 nonce = _schedules[operationId].nonce;
|
|
|
+ emit OperationCanceled(operationId, nonce);
|
|
|
+
|
|
|
+ return nonce;
|
|
|
+ }
|
|
|
+
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function consumeScheduledOp(address caller, bytes calldata data) public virtual {
|
|
|
address target = _msgSender();
|
|
|
if (IAccessManaged(target).isConsumingScheduledOp() != IAccessManaged.isConsumingScheduledOp.selector) {
|
|
|
@@ -738,61 +571,13 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
return nonce;
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Cancel a scheduled (delayed) operation. Returns the nonce that identifies the previously scheduled
|
|
|
- * operation that is cancelled.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be the proposer, a guardian of the targeted function, or a global admin
|
|
|
- *
|
|
|
- * Emits a {OperationCanceled} event.
|
|
|
- */
|
|
|
- function cancel(address caller, address target, bytes calldata data) public virtual returns (uint32) {
|
|
|
- address msgsender = _msgSender();
|
|
|
- bytes4 selector = _checkSelector(data);
|
|
|
-
|
|
|
- bytes32 operationId = hashOperation(caller, target, data);
|
|
|
- if (_schedules[operationId].timepoint == 0) {
|
|
|
- revert AccessManagerNotScheduled(operationId);
|
|
|
- } else if (caller != msgsender) {
|
|
|
- // calls can only be canceled by the account that scheduled them, a global admin, or by a guardian of the required role.
|
|
|
- (bool isAdmin, ) = hasRole(ADMIN_ROLE, msgsender);
|
|
|
- (bool isGuardian, ) = hasRole(getRoleGuardian(getTargetFunctionRole(target, selector)), msgsender);
|
|
|
- if (!isAdmin && !isGuardian) {
|
|
|
- revert AccessManagerUnauthorizedCancel(msgsender, caller, target, selector);
|
|
|
- }
|
|
|
- }
|
|
|
-
|
|
|
- delete _schedules[operationId].timepoint; // reset the timepoint, keep the nonce
|
|
|
- uint32 nonce = _schedules[operationId].nonce;
|
|
|
- emit OperationCanceled(operationId, nonce);
|
|
|
-
|
|
|
- return nonce;
|
|
|
- }
|
|
|
-
|
|
|
- /**
|
|
|
- * @dev Hashing function for delayed operations
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function hashOperation(address caller, address target, bytes calldata data) public view virtual returns (bytes32) {
|
|
|
return keccak256(abi.encode(caller, target, data));
|
|
|
}
|
|
|
|
|
|
- /**
|
|
|
- * @dev Hashing function for execute protection
|
|
|
- */
|
|
|
- function _hashExecutionId(address target, bytes4 selector) private pure returns (bytes32) {
|
|
|
- return keccak256(abi.encode(target, selector));
|
|
|
- }
|
|
|
-
|
|
|
// ==================================================== OTHERS ====================================================
|
|
|
- /**
|
|
|
- * @dev Change the AccessManager instance used by a contract that correctly uses this instance.
|
|
|
- *
|
|
|
- * Requirements:
|
|
|
- *
|
|
|
- * - the caller must be a global admin
|
|
|
- */
|
|
|
+ /// @inheritdoc IAccessManager
|
|
|
function updateAuthority(address target, address newAuthority) public virtual onlyAuthorized {
|
|
|
IAccessManaged(target).setAuthority(newAuthority);
|
|
|
}
|
|
|
@@ -934,4 +719,11 @@ contract AccessManager is Context, Multicall, IAccessManager {
|
|
|
function _checkSelector(bytes calldata data) private pure returns (bytes4) {
|
|
|
return bytes4(data[0:4]);
|
|
|
}
|
|
|
+
|
|
|
+ /**
|
|
|
+ * @dev Hashing function for execute protection
|
|
|
+ */
|
|
|
+ function _hashExecutionId(address target, bytes4 selector) private pure returns (bytes32) {
|
|
|
+ return keccak256(abi.encode(target, selector));
|
|
|
+ }
|
|
|
}
|
Hadrien Croubois