PermissionedProxy

Description

PermissionedProxy is a minimal access-control contract. It defines a single admin, an operator allowlist, and a selector allowlist controlling which functions can be forwarded via proxy(). Meant to be inherited by other contracts.

Constructor

constructor(address _admin, address _operator)

• Description - Sets the initial admin and enables the initial operator by setting operators[_operator] = true. Contracts that inherit PermissionedProxy pass both addresses through from their own constructors.
  • @param _admin - The initial admin address.
  • @param _operator - The initial operator address.
• Reverts
  • With "zero" if _admin == address(0).
  • With "zero" if _operator == address(0).
• Emits - none

Variables

admin

• Description - The address that manages the contract's roles and allowlist: transferring admin ownership, adding or removing operators, and enabling or disabling selectors. The admin role does not include proxy(), which checks the operators mapping only, so the admin can forward calls only if it is also enabled as an operator.
• Type - address
• Visibility - internal
• Used By
  • onlyAdmin
• Updated By
  • The constructor, which sets the initial admin.
  • acceptAdminOwnership()

pendingAdmin

• Description - The first step in a two-step process to transfer admin ownership. The current admin sets a pendingAdmin, then the pendingAdmin must call acceptAdminOwnership() to complete the transfer.
• Type - address
• Used By
  • acceptAdminOwnership()
• Updated By
  • transferAdminOwnerShip(address _newAdmin)
  • acceptAdminOwnership()
• Read By
  • pendingAdmin()

operators

• Description - A mapping of addresses to operator status. Each address in the mapping that maps to true is enabled as an operator.
• Type - mapping(address => bool)
• Visibility - public
• Used By
  • onlyOperator
• Updated By
  • The constructor, which enables the initial operator.
  • setOperator(address _operator, bool value)
• Read By
  • operators(address) - returns true if the address is an enabled operator.

permissionedCalls

• Description - A mapping of function selectors to true/false values. If the mapping of a function selector is true, then the proxied call is allowed for that function. Selectors must be explicitly enabled before they can be forwarded via proxy().
• Type - mapping(bytes4 => bool)
• Visibility - public
• Used By
  • proxy(address vault, bytes memory data)
• Updated By
  • setPermissionedCall(bytes4 sig, bool value)
• Read By
  • permissionedCalls(bytes4) - returns true if the selector may be forwarded.

Modifiers

onlyAdmin

• Description - Restricts function execution to the admin address.
• Reverts
  • With "PD" if msg.sender != admin.

onlyOperator

• Description - Restricts function execution to addresses with operators[msg.sender] == true.
• Reverts
  • With "PD" if operators[msg.sender] != true.

Functions

Admin Actions

transferAdminOwnerShip(address _newAdmin)

• Description - Sets the pending admin to a new address. First step of a two-step admin transfer process. The pending admin must then call acceptAdminOwnership() to complete the transfer.
  • @param _newAdmin - The address to set as the pending admin.
• Visibility Specifier - external
• State Mutability Specifier - nonpayable
• Access Control - onlyAdmin
• Emits - none
• Reverts
  • With "PD" if msg.sender != admin.

acceptAdminOwnership()

• Description - Completes the two-step admin transfer. Can only be called by the current pendingAdmin. Sets admin to the caller and clears pendingAdmin.
• Visibility Specifier - external
• State Mutability Specifier - nonpayable
• Reverts
  • With "PD" if msg.sender != pendingAdmin.
• Emits
  • AdminUpdated(address admin)

setOperator(address _operator, bool value)

• Description - Adds or removes an address from the operator allowlist.
  • @param _operator - Address to update.
  • @param value - true to enable as an operator, false to disable as an operator.
• Visibility Specifier - external
• State Mutability Specifier - nonpayable
• Access Control - onlyAdmin
• Reverts
  • With "zero" if _operator == address(0).
• Emits
  • OperatorUpdated(address operator)

setPermissionedCall(bytes4 sig, bool value)

• Description - Marks a function selector as allowed (true) or disallowed (false) for proxy() forwarding.
  • @param sig - The function selector to modify.
  • @param value - true to allow proxied calls for this selector, false to disallow.
• Visibility Specifier - external
• State Mutability Specifier - nonpayable
• Access Control - onlyAdmin
• Emits
  • AddedPermissionedCall(bytes4 sig)

Operator Actions

proxy(address vault, bytes memory data)

• Description - Forwards a call to the vault with the passed data. The function selector must be explicitly enabled in the permissionedCalls allowlist. ETH is also forwarded.
  • @param vault - The address of the vault contract to call.
  • @param data - ABI-encoded calldata indicating the selector of the function to call on the vault.
• Visibility Specifier - external
• State Mutability Specifier - payable
• Access Control - onlyOperator
• Reverts
  • With "PD" if msg.sender is not an enabled operator. The admin is not exempt.
  • With "SEL" if data.length < 4.
  • With "PD" if the selector is not enabled in the allowlist.
  • With "failed" if the forwarded call returns success == false.
• Emits - none

Events

• AdminUpdated(address indexed admin) - emitted when the admin address is updated via acceptAdminOwnership().
• OperatorUpdated(address indexed operator) - emitted when an operator address is added or removed.
• AddedPermissionedCall(bytes4 indexed sig) - emitted when a function selector’s allowlist status is updated.