What problem does it solve? Access control flaws are the leading cause of smart contract exploits, yet they are easy to miss during manual review because visibility keywords like public are often mistaken for permission checks. This Skill gives auditors a systematic method to find missing modifiers, privilege escalation paths, and broken role hierarchies before attackers do. ## Core Features & Use Cases - Permission Matrix Construction: Maps every external/public function to its required role, actual check, and sensitivity level to expose authorization gaps. - Six Detection Patterns: Covers missing access control, privilege escalation, tx.origin phishing, OR/AND logic errors, missing two-step ownership transfer, and OpenZeppelin AccessControl role exploitation. - Centralization Risk Assessment: Flags undocumented admin powers such as unlimited minting, fee manipulation, and upgrade rights that lack timelocks or multisig protection. - Use Case: During a DeFi vault audit, run the provided grep queries to enumerate all state-changing functions, build the Permission Matrix, and discover that withdrawAll() has no modifier, allowing any caller to drain the contract. ## Quick Start Audit the Solidity contracts in this repository for access control vulnerabilities and build a permission matrix of all privileged functions.
