Access Control
Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.
How This Score Is Built
Permission models, admin surface, reentrancy protection, and authorization boundaries. #1 exploit vector by dollar loss in DeFi history.
Scoring Tree
Score Composition
Still scored well below a decentralized lending protocol: infinite-mint + freeze-any + instant-upgrade on a $52B base under a single corporate operator with no on-chain delay
Upgradeable: proxy-admin 0x807a...95d2 can swap the implementation with NO timelock; legacy ZeppelinOS proxy (Solidity 0.4.24); current impl FiatTokenV2_2 0x4350...02dd
masterMinter (0xE982...de17) can configureMinter() any address with an effectively-unbounded mint allowance; minters mint to any address up to allowance — privileged keys can create supply
blacklister (0x0A06...78F9) can blacklist() ANY address, freezing its balance until unBlacklist() — a single role can freeze holder funds
pauser (0x4914...8566) can pause() and halt ALL transfers/mints/burns of the ~$52.46B token
RAISED from combined baseline 38 -> 45: ChainSecurity CCTP-V2 review confirms the codebase follows a 2-step pattern for transferring high-importance roles (reduces fat-finger/lockout risk), and the CCTP attestation mint-authority is no longer scored here (moved to circle-cctp)
Modifiers: onlyMinters, onlyMasterMinter, onlyPauser, onlyBlacklister, onlyOwner, whenNotPaused, notBlacklisted
Evidence Chain (1 files)
Score History
No dimension-level score changes recorded yet.