菜单
Missing modifiers, wrong msg.sender checks, default-public functions, missing onlyOwner / onlyRole / onlyDAO authorization.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill access-control命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | access-control |
| description | Missing modifiers, wrong msg.sender checks, default-public functions, missing onlyOwner / onlyRole / onlyDAO authorization. |
| metadata | {"subdomain":"smart-contracts","when_to_use":"smart contract access control onlyowner missing modifier privilege","mitre_attack":["T1190"]} |
Access control bugs are the most boring class — and the most common in production audits. They're cheap to find with grep + LSP. They drain millions when missed (LeetSwap, Audius, Saddle, Akropolis).
# Functions that are NOT view/pure and NOT internal/private
grep -rE 'function [a-zA-Z_]+\(.*\)(public|external)' src/ | grep -v 'view\|pure'
# Or via slither
slither . --print function-summary
onlyOwner, onlyRole, onlyDAO, custom auth)?Common modifier patterns + bugs:
| Pattern | Bug |
|---|---|
require(msg.sender == owner) | owner settable by anyone? unprotected? |
setOwnerrequire(msg.sender == tx.origin) | Wrong — tx.origin breaks meta-transactions, AND it's phishable |
_msgSender() in OZ ERC2771Context | Forwarder trusted but anyone can forward — does the contract validate the forwarder? |
onlyRole(MINTER) | Who can grant MINTER? Is the admin a multisig or single key? |
require(initialized == false) | Initializer can be called twice if initialized writeable elsewhere |
require(block.timestamp > deployTime + 24 hours) | Time-based is often a fake delay — check if deployTime is settable |
require(approvedSigners[msg.sender]) | Approval list managed by single key? |
# Functions accidentally external (default in Solidity <0.5)
grep -rn 'function [a-zA-Z_]*[^ ]* *{' src/ | grep -v 'internal\|private\|public\|external'
# msg.sender == tx.origin (phishable)
grep -rn 'tx.origin' src/
# Reentrancy in access-control checks
grep -rn 'onlyOwner.*nonReentrant' src/ # both? often wrong order
# `delegatecall` without auth gate
grep -rn 'delegatecall' src/
# `selfdestruct` available
grep -rn 'selfdestruct\|suicide(' src/
// VULNERABLE
function initialize(address _owner) external {
owner = _owner;
// missing: require(!initialized); initialized = true;
}
// VULNERABLE (proxy implementation)
contract Impl {
constructor() { ... } // NEVER RUNS in proxy context
// initialize() should set proxy state but doesn't gate
}
// SAFE
function initialize(address _owner) external initializer {
// OZ's initializer modifier enforces single-call
__Ownable_init(_owner);
}
For UUPS/Transparent proxies: check _authorizeUpgrade is overridden
and gated. Default OZ override is empty (revert).
Transparent proxy admin function selectors collide w/ impl function selectors → admin functions become uncallable, OR impl functions are shadowed by admin. Check w/ slither:
slither-check-erc src/Impl.sol --erc ERC1967
For AccessControl:
DEFAULT_ADMIN_ROLE is the admin of all roles by defaultCheck role hierarchy:
grep -rn '_setRoleAdmin\|_setupRole\|grantRole' src/
function test_unauth_call() public {
address attacker = address(0xBEEF);
vm.prank(attacker);
// Call the function that should require auth
target.dangerousFunction(arg1, arg2);
// Assert state change happened
assertEq(target.criticalParam(), expectedManipulatedValue);
// No revert = vulnerable
}
function test_role_takeover() public {
address attacker = address(0xBEEF);
vm.startPrank(attacker);
// If grantRole is callable by anyone
target.grantRole(target.MINTER_ROLE(), attacker);
assertTrue(target.hasRole(target.MINTER_ROLE(), attacker));
// Now exploit MINTER_ROLE
target.mint(attacker, 1_000_000 ether);
}
function test_init_re_entry() public {
// Call initialize twice
target.initialize(address(this));
vm.expectRevert("Initializable: contract is already initialized");
target.initialize(attacker);
}
function test_upgrade_no_auth() public {
address attacker = address(0xBEEF);
address malicious = address(new MaliciousImpl());
vm.prank(attacker);
target.upgradeTo(malicious);
// Now any call goes to malicious — drain
assertEq(target.totalSupply(), 0);
}
| Bug | Severity |
|---|---|
Unauth withdraw / mint / transferOwnership | Critical |
Unauth upgradeTo (proxy) | Critical (escalates to any) |
Unauth setOracle / setFee | High (DoS or value manipulation) |
tx.origin auth + phishable | High |
| Initializer re-entry | High (proxy takeover) |
| Role hierarchy lets non-admin grant admin | High |
| Function defaults to external (Solidity <0.5 only) | High |
| Selector collision in proxy | High (function unreachable) |
// Use OpenZeppelin patterns
import "@openzeppelin/contracts/access/Ownable.sol";
import "@openzeppelin/contracts/access/AccessControl.sol";
contract MyContract is AccessControlUpgradeable, UUPSUpgradeable {
bytes32 public constant MINTER = keccak256("MINTER");
function initialize(address admin) external initializer {
__AccessControl_init();
_grantRole(DEFAULT_ADMIN_ROLE, admin);
}
function mint(address to, uint256 amt) external onlyRole(MINTER) {
_mint(to, amt);
}
function _authorizeUpgrade(address) internal override onlyRole(DEFAULT_ADMIN_ROLE) {}
}