Role separation: upgrade ≠ fee ≠ oracle
GMX v2 (GMX Synthetics)'s assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
18 distinct roles defined in Role.sol (ROLE_ADMIN, TIMELOCK_ADMIN, CONTROLLER, CONFIG_KEEPER, FEE_KEEPER, ORDER_KEEPER, ORACLE_SIGNER, GOV_TOKEN_CONTROLLER, etc.) — role-level separation exists in design. However, current role holders (which addresses hold ROLE_ADMIN, CONTROLLER, ORACLE_SIGNER on Arbitrum) cannot be confirmed without RoleStore enumeration (Arbiscan 403). Cannot confirm upgrade ≠ fee ≠ oracle at the address level.
Sources #
- GitHubRole.sol — 18 distinct rolesRole.sol — 18 role constants with distinct keccak256 hashes for CONTROLLER, FEE_KEEPER, ORACLE_SIGNER etc.retrieved 2026-05-05
Methodology #
Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.
See the full factor methodology and distribution across all protocols →