Summary

The KEYCODE is public and defined in module MoneyShelf. It should be permissioned because of Default framework used for this protocol. Only view functions can be called by the user without permission but this one is pure.

Vulnerability Details

According to all the documentation provided:
Modules can only be accessed through whitelisted Policy contracts, and have no dependencies of their own. Modules can only modify their own internal state.

Impact

All the missing benefits of the framework described in the documentation:
This separation of what and why in the protocol allows for greater flexibility in design while retaining some properties of immutability, which dramatically simplifies protocol development.

Tools Used

Manual review

Recommendations

To make the function permissioned.