Root + Impact

Description

• The documented behavior states that the deployer automatically receives both OpenZeppelin’s DEFAULT_ADMIN_ROLE and the custom SIGNING_ROLE, implying that AccessControl is used for administrative governance.

• The actual implementation only grants the SIGNING_ROLE to the deployer and never assigns DEFAULT_ADMIN_ROLE, creating a discrepancy between documentation and code that can lead to incorrect assumptions about role administration and security guarantees.

Risk

Likelihood:

• Documentation is referenced by integrators or auditors when assessing role governance and trust assumptions.

• Future maintainers rely on documentation rather than code when extending or refactoring AccessControl logic.

Impact:

• Incorrect threat modeling due to the assumption that AccessControl admin protections exist.

• Potential misconfiguration or unsafe extensions that rely on a non-existent DEFAULT_ADMIN_ROLE.

Proof of Concept

Explanation

This test demonstrates that despite the documentation claim, the deployer does not possess the DEFAULT_ADMIN_ROLE. Any logic assuming AccessControl-based administration is therefore invalid.

Recommended Mitigation

Documentation and code must be aligned to avoid incorrect assumptions about governance.

Option 1: Update the code to match documentation (constructor)

Option 2: Update documentation to reflect actual behavior (preferred if AccessControl admin is unnecessary)

Either approach should be applied consistently to prevent governance misunderstandings.