Permission Model Inconsistency: Documentation Claims Use of DEFAULT_ADMIN_ROLE, but Actual Access Control Relies Entirely on Ownable

Description

The contract documentation states that the deployer receives both the DEFAULT_ADMIN_ROLE in AccessControl and the custom SIGNING_ROLE, implying that administrative permissions are managed by the Role-Based Access Control (RBAC) mechanism.
However, all administrative functions (e.g., grantSigningRole) actually perform permission checks only via the onlyOwner modifier provided by Ownable, and there is no logic in the contract that checks the DEFAULT_ADMIN_ROLE. The inheritance of AccessControl is not practically used in governance, leading to misleading documentation and potential misunderstandings of the real permission model.

Risk

Likelihood:

• Developers or integrators reading the documentation will mistakenly believe that administrative permissions are controlled by AccessControl, especially since the documentation explicitly mentions the DEFAULT_ADMIN_ROLE.

• Future maintainers may attempt to add new features based on AccessControl when extending the contract, but since actual permissions are controlled by Ownable, this can easily introduce permission logic conflicts or unexpected bypasses.

Impact:

• Misunderstanding of the real ownership and permission mechanisms may lead to incorrect judgments during audits, upgrades, or third-party integrations.

• The introduction of an unused AccessControl mechanism adds unnecessary code complexity and cognitive burden without providing any security or functional benefits.

Proof of Concept

• Add the test_Without_DEFAULT_ADMIN_ROLE function to test/unit/MultiSigTimelockTest.t.sol as follows:

• Run in the console: forge test --mt test_Without_DEFAULT_ADMIN_ROLE -vv

Recommended Mitigation

• Standardize on using AccessControl and remove Ownable from the contract inheritance.

• Replace the onlyOwner modifier with hasRole(DEFAULT_ADMIN_ROLE, msg.sender) for all administrative function permission checks.

• Ensure full consistency between documentation and implementation (update documentation to reflect the actual permission model if retaining Ownable).