Check the authorization and role model end to end

[hpmaxi]

Priority

High — must be addressed in current sprint

User story / Problem statement

The role model has grown across four contracts and has not been reviewed as a whole. Three things
are known already:

The symbol manager names two different roles. On the vault it closes epochs. On the share token it
covers mint, burn and eight more privileged functions. They live on different contracts and mean
different things.

The vault constructor takes compliance and attester and uses them only for the distinctness
check. Compliance is enforced on the identity verifier and the compliance dispatcher, and attestation
on the oracle, so neither authority is exercised by the vault.

fund and fulfill_epoch are open to any caller. That is deliberate for fulfilment and worth
stating for funding.

Expected outcome

Every entrypoint's authority is stated, checked, and tested, and the naming does not invite a
mistake.

Acceptance criteria

• A table of every entrypoint across the four contracts: who may call it, what is checked, and
  the test that proves a wrong caller is refused.
• Every privileged entrypoint has a test with an unauthorised caller.
• The two manager roles are either renamed or documented as distinct, and the deployment script
  cannot grant one where the other was meant.
• compliance and attester are dropped from the vault constructor, or kept with the reason
  recorded.
• Open entrypoints are listed as open on purpose, each with its reason.
• No entrypoint takes a caller argument it does not authenticate.
• Role membership is checked directly, never by enumerating members.

Technical notes

The pattern worth grepping for: a _caller parameter that a macro authenticates independently, so
the argument is decoration. set_custodian and unpause both take one.

Refs: ARCHITECTURE §4.5, §6 · invariants: I31 · findings: F-049

[pragalli]

This issue depend of: #56