Vulnerability Details

Given that rollups such as Optimism and Arbitrum offer methods for forced transaction inclusion, it is important that the aliased sender address is also checked within access control modifiers when verifying the sender holds a permissioned role to allow the functions to which they are applied to be called even in the event of sequencer downtime.

Impact

Failure to consider the aliased sender address prevents the execution of admin or otherwise permissioned functionality on a chain where transactions are batched by a centralized L2 sequencer. Some notable places in the codebase include setNFTDescriptor , Adminable.sol etc

Recommendations

Validation of the sender address in the permissioned functions against access controlled admin roles