BlackHartBlackHart
Scores/Kinetiq/Provenance/Access Control
D1

Access Control

Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.

Weight 18%88% confidence
55
Moderate
info

How This Score Is Built

Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.

+23Strong positive
+12Positive
+5Slight positive
−15Strong negative
−8Negative
−3Slight negative

Scoring Tree

BRI Formula
300 + 700 × ∏(Dᵢ/100)^wᵢ
688
Current BRI
D1Access Control
Weight 17%
55
(55/100)^0.1674 = 0.9048
Sub-Scores
Modifier Coverage
50
Role Separation
58
Admin Topology
65
Contributing Factors
+14Framework is sound: OZ AccessControlEnumerableUpgradeable across all 6 core contracts, 10 role constants (MANAGER, OPERATOR, ORACLE_MANAGER, PAUSE_ALL, PAUSER, UNPAUSER, SENTINEL, TREASURY, MINTER, BURNER)
+14ON-CHAIN: ORACLE_MANAGER_ROLE on ValidatorManager is held only by the OracleManager CONTRACT (0x1928..049b), so reportRewardEvent/reportSlashingEvent (#2258) are NOT EOA-permissionless on the live deployment — bounds real exploitability of those criticals to oracle/operator compromise (centralization, standard bounty exclusion)
+14ON-CHAIN: OPERATOR_ROLE = single EOA 0x23A4604cDFe8e9e2e9Cf7C10D7492B0F3f4B4038 on both StakingManager and OracleManager — operational single point (drives generatePerformance / L1 ops). MANAGER_ROLE = the same 4/8 Safe.
+14GENUINELY PERMISSIONLESS code defect remains: ValidatorSanityChecker setter functions have ZERO access control (#36/#2551, passing PoC) — any EOA can widen tolerances. This is the real residual D1 risk and caps the score below 60.
-45MIN_VALID_ORACLES = 1 confirmed live (cast) — single-oracle aggregation, weak quorum
0ON-CHAIN (cast, block ~36.45M, chain 999): DEFAULT_ADMIN_ROLE on StakingManager/ValidatorManager/StakingAccountant/OracleManager/kHYPE/PauserRegistry is held by EXACTLY ONE address = 0x18A82c968b992D28D4D812920eB7b4305306f8F1, which is a Gnosis Safe v1.3.0 with 8 owners and a 4-of-8 threshold (getThreshold()=4, nonce 60). This is a material POSITIVE vs the assumed single-key topology — a 4/8 multisig must collude to abuse admin power. Raised D1 from 45 to 55.
Evidence Sources
blackhart_analysisMay 30sha256:80a3139abc1a....

Sub-Score Breakdown

Modifier Coverage
50
Role Separation
58
Admin Topology
65

Score Composition

-45

MIN_VALID_ORACLES = 1 confirmed live (cast) — single-oracle aggregation, weak quorum

Strong negative
0

ON-CHAIN (cast, block ~36.45M, chain 999): DEFAULT_ADMIN_ROLE on StakingManager/ValidatorManager/StakingAccountant/OracleManager/kHYPE/PauserRegistry is held by EXACTLY ONE address = 0x18A82c968b992D28D4D812920eB7b4305306f8F1, which is a Gnosis Safe v1.3.0 with 8 owners and a 4-of-8 threshold (getThreshold()=4, nonce 60). This is a material POSITIVE vs the assumed single-key topology — a 4/8 multisig must collude to abuse admin power. Raised D1 from 45 to 55.

Neutral
+14

Framework is sound: OZ AccessControlEnumerableUpgradeable across all 6 core contracts, 10 role constants (MANAGER, OPERATOR, ORACLE_MANAGER, PAUSE_ALL, PAUSER, UNPAUSER, SENTINEL, TREASURY, MINTER, BURNER)

Strong positive
+14

ON-CHAIN: ORACLE_MANAGER_ROLE on ValidatorManager is held only by the OracleManager CONTRACT (0x1928..049b), so reportRewardEvent/reportSlashingEvent (#2258) are NOT EOA-permissionless on the live deployment — bounds real exploitability of those criticals to oracle/operator compromise (centralization, standard bounty exclusion)

Strong positive
+14

ON-CHAIN: OPERATOR_ROLE = single EOA 0x23A4604cDFe8e9e2e9Cf7C10D7492B0F3f4B4038 on both StakingManager and OracleManager — operational single point (drives generatePerformance / L1 ops). MANAGER_ROLE = the same 4/8 Safe.

Strong positive
+14

GENUINELY PERMISSIONLESS code defect remains: ValidatorSanityChecker setter functions have ZERO access control (#36/#2551, passing PoC) — any EOA can widen tolerances. This is the real residual D1 risk and caps the score below 60.

Strong positive

Evidence Chain (1 files)

BlackHart AnalysisMay 30, 2026, 12:00 AM
sha256:80a3139abc1a...

Score History

No dimension-level score changes recorded yet.

Methodology: 2.1Formula: 1.1Weights: 1.1
How is Access Control scored?← Back to Provenance Ledger