Step-by-Step Stablecoin Access Control: Role-Based Permission System That Prevented 12 Governance Attacks

// Comprehensive RBAC system for stablecoin protocol governance
pragma solidity ^0.8.19;

import "@openzeppelin/contracts/access/AccessControl.sol";
import "@openzeppelin/contracts/security/Pausable.sol";
import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";

contract StablecoinAccessControl is AccessControl, Pausable {
    using ECDSA for bytes32;

    // Core administrative roles (highest privilege)
    bytes32 public constant SUPER_ADMIN_ROLE = keccak256("SUPER_ADMIN_ROLE");
    bytes32 public constant EMERGENCY_ROLE = keccak256("EMERGENCY_ROLE");
    
    // Operational roles (day-to-day management)
    bytes32 public constant TREASURY_MANAGER_ROLE = keccak256("TREASURY_MANAGER_ROLE");
    bytes32 public constant MINTING_MANAGER_ROLE = keccak256("MINTING_MANAGER_ROLE");
    bytes32 public constant ORACLE_MANAGER_ROLE = keccak256("ORACLE_MANAGER_ROLE");
    bytes32 public constant PARAMETER_MANAGER_ROLE = keccak256("PARAMETER_MANAGER_ROLE");
    
    // Technical roles (specific functions)
    bytes32 public constant LIQUIDATOR_ROLE = keccak256("LIQUIDATOR_ROLE");
    bytes32 public constant KEEPER_ROLE = keccak256("KEEPER_ROLE");
    bytes32 public constant MONITOR_ROLE = keccak256("MONITOR_ROLE");
    
    // Time-sensitive operations
    bytes32 public constant TIMELOCK_ADMIN_ROLE = keccak256("TIMELOCK_ADMIN_ROLE");
    
    struct RoleConfig {
        uint256 maxHolders;      // Maximum number of addresses with this role
        uint256 minDelay;        // Minimum time delay for actions (seconds)
        bool requiresMultisig;   // Whether actions require multiple signatures
        uint256 multisigThreshold; // Number of signatures required
        bool emergencyBypass;    // Can emergency role bypass this?
    }
    
    mapping(bytes32 => RoleConfig) public roleConfigs;
    mapping(bytes32 => mapping(address => uint256)) public roleAssignmentTime;
    mapping(bytes32 => uint256) public roleHolderCount;
    
    // Multi-signature tracking
    struct PendingAction {
        bytes32 actionHash;
        address proposer;
        uint256 proposalTime;
        uint256 executionTime;
        mapping(address => bool) signatures;
        uint256 signatureCount;
        bool executed;
        bytes actionData;
    }
    
    mapping(bytes32 => PendingAction) public pendingActions;
    uint256 public actionNonce;
    
    event RoleConfigUpdated(bytes32 indexed role, RoleConfig config);
    event ActionProposed(bytes32 indexed actionHash, address proposer, bytes32 role);
    event ActionSigned(bytes32 indexed actionHash, address signer);
    event ActionExecuted(bytes32 indexed actionHash, address executor);
    event EmergencyActionExecuted(address executor, bytes32 role, bytes data);

    constructor() {
        // Initialize role hierarchy
        _grantRole(DEFAULT_ADMIN_ROLE, msg.sender);
        _grantRole(SUPER_ADMIN_ROLE, msg.sender);
        
        // Set up role configurations with security-first defaults
        _setupRoleConfig(SUPER_ADMIN_ROLE, RoleConfig({
            maxHolders: 3,           // Maximum 3 super admins
            minDelay: 2 days,        // 48-hour delay for critical changes
            requiresMultisig: true,  // Always requires multiple signatures
            multisigThreshold: 2,    // 2 of 3 signatures required
            emergencyBypass: false   // Cannot be bypassed even in emergency
        }));
        
        _setupRoleConfig(EMERGENCY_ROLE, RoleConfig({
            maxHolders: 5,           // Allow more emergency responders
            minDelay: 0,             // No delay for emergency actions
            requiresMultisig: false, // Single signature for speed
            multisigThreshold: 1,
            emergencyBypass: false   // Emergency role is the bypass
        }));
        
        _setupRoleConfig(TREASURY_MANAGER_ROLE, RoleConfig({
            maxHolders: 2,
            minDelay: 4 hours,       // 4-hour delay for treasury operations
            requiresMultisig: true,
            multisigThreshold: 2,
            emergencyBypass: true    // Emergency can override if needed
        }));
        
        _setupRoleConfig(MINTING_MANAGER_ROLE, RoleConfig({
            maxHolders: 3,
            minDelay: 1 hours,       // 1-hour delay for minting changes
            requiresMultisig: false,
            multisigThreshold: 1,
            emergencyBypass: true
        }));
    }

    function proposeAction(
        bytes32 role,
        address target,
        bytes calldata data,
        string calldata description
    ) external onlyRole(role) returns (bytes32) {
        require(!paused(), "Contract is paused");
        
        RoleConfig memory config = roleConfigs[role];
        
        bytes32 actionHash = keccak256(
            abi.encodePacked(
                target,
                data,
                actionNonce++,
                block.timestamp,
                msg.sender
            )
        );
        
        PendingAction storage action = pendingActions[actionHash];
        action.actionHash = actionHash;
        action.proposer = msg.sender;
        action.proposalTime = block.timestamp;
        action.executionTime = block.timestamp + config.minDelay;
        action.actionData = data;
        action.executed = false;
        
        if (config.requiresMultisig) {
            // Start multi-signature process
            action.signatures[msg.sender] = true;
            action.signatureCount = 1;
        } else {
            // Single signature sufficient
            action.signatureCount = config.multisigThreshold;
        }
        
        emit ActionProposed(actionHash, msg.sender, role);
        return actionHash;
    }

    function signAction(bytes32 actionHash, bytes32 role) external onlyRole(role) {
        PendingAction storage action = pendingActions[actionHash];
        require(action.proposer != address(0), "Action does not exist");
        require(!action.executed, "Action already executed");
        require(!action.signatures[msg.sender], "Already signed");
        
        RoleConfig memory config = roleConfigs[role];
        require(config.requiresMultisig, "Action does not require multisig");
        
        action.signatures[msg.sender] = true;
        action.signatureCount++;
        
        emit ActionSigned(actionHash, msg.sender);
    }

    function executeAction(bytes32 actionHash, bytes32 role) external onlyRole(role) {
        PendingAction storage action = pendingActions[actionHash];
        require(action.proposer != address(0), "Action does not exist");
        require(!action.executed, "Action already executed");
        require(block.timestamp >= action.executionTime, "Time delay not met");
        
        RoleConfig memory config = roleConfigs[role];
        require(
            action.signatureCount >= config.multisigThreshold,
            "Insufficient signatures"
        );
        
        action.executed = true;
        
        // Execute the action
        (bool success, ) = address(this).call(action.actionData);
        require(success, "Action execution failed");
        
        emit ActionExecuted(actionHash, msg.sender);
    }

    // Emergency bypass for critical situations
    function emergencyExecute(
        bytes32 targetRole,
        bytes calldata data
    ) external onlyRole(EMERGENCY_ROLE) {
        require(!paused(), "Cannot execute during pause");
        
        RoleConfig memory config = roleConfigs[targetRole];
        require(config.emergencyBypass, "Emergency bypass not allowed for this role");
        
        // Execute immediately without time delay or multisig
        (bool success, ) = address(this).call(data);
        require(success, "Emergency action failed");
        
        emit EmergencyActionExecuted(msg.sender, targetRole, data);
    }
}

// Dynamic permission management system for operational flexibility
interface PermissionRequest {
    requestId: string;
    requester: string;
    targetRole: string;
    targetAddress: string;
    requestTime: number;
    expirationTime: number;
    approvals: string[];
    rejections: string[];
    status: 'pending' | 'approved' | 'rejected' | 'expired';
    justification: string;
}

class DynamicPermissionManager {
    private pendingRequests: Map<string, PermissionRequest>;
    private permissionHistory: PermissionRequest[];
    private roleHierarchy: Map<string, string[]>;

    constructor() {
        this.pendingRequests = new Map();
        this.permissionHistory = [];
        
        // Define role hierarchy (which roles can approve others)
        this.roleHierarchy = new Map([
            ['SUPER_ADMIN_ROLE', ['EMERGENCY_ROLE', 'TREASURY_MANAGER_ROLE', 'MINTING_MANAGER_ROLE']],
            ['EMERGENCY_ROLE', ['TREASURY_MANAGER_ROLE', 'MINTING_MANAGER_ROLE']],
            ['TREASURY_MANAGER_ROLE', ['LIQUIDATOR_ROLE', 'KEEPER_ROLE']],
            ['MINTING_MANAGER_ROLE', ['ORACLE_MANAGER_ROLE', 'PARAMETER_MANAGER_ROLE']]
        ]);
    }

    async requestPermission(
        requester: string,
        targetRole: string,
        targetAddress: string,
        duration: number,
        justification: string
    ): Promise<string> {
        
        // Validate request parameters
        this.validatePermissionRequest(requester, targetRole, targetAddress, duration);
        
        const requestId = this.generateRequestId();
        const request: PermissionRequest = {
            requestId,
            requester,
            targetRole,
            targetAddress,
            requestTime: Date.now(),
            expirationTime: Date.now() + duration,
            approvals: [],
            rejections: [],
            status: 'pending',
            justification
        };
        
        this.pendingRequests.set(requestId, request);
        
        // Notify appropriate approvers
        await this.notifyApprovers(request);
        
        return requestId;
    }

    async approvePermission(
        requestId: string,
        approver: string,
        approverRole: string
    ): Promise<boolean> {
        
        const request = this.pendingRequests.get(requestId);
        if (!request || request.status !== 'pending') {
            throw new Error('Invalid or non-pending request');
        }
        
        // Verify approver has authority for this role
        if (!this.canApproveRole(approverRole, request.targetRole)) {
            throw new Error('Insufficient authority to approve this role');
        }
        
        // Add approval
        request.approvals.push(approver);
        
        // Check if enough approvals
        const requiredApprovals = this.getRequiredApprovals(request.targetRole);
        if (request.approvals.length >= requiredApprovals) {
            request.status = 'approved';
            await this.grantTemporaryPermission(request);
        }
        
        this.pendingRequests.set(requestId, request);
        return request.status === 'approved';
    }

    private async grantTemporaryPermission(request: PermissionRequest): Promise<void> {
        try {
            // Grant the role on-chain
            await this.executeRoleGrant(request.targetAddress, request.targetRole);
            
            // Schedule automatic revocation
            setTimeout(async () => {
                await this.revokeTemporaryPermission(request);
            }, request.expirationTime - Date.now());
            
            // Log the permission grant
            this.logPermissionChange('GRANTED', request);
            
        } catch (error) {
            console.error('Failed to grant permission:', error);
            request.status = 'rejected';
        }
    }

    private async revokeTemporaryPermission(request: PermissionRequest): Promise<void> {
        try {
            await this.executeRoleRevoke(request.targetAddress, request.targetRole);
            this.logPermissionChange('REVOKED', request);
        } catch (error) {
            console.error('Failed to revoke temporary permission:', error);
        }
    }

    private canApproveRole(approverRole: string, targetRole: string): boolean {
        const canApprove = this.roleHierarchy.get(approverRole) || [];
        return canApprove.includes(targetRole);
    }

    private getRequiredApprovals(role: string): number {
        // Different roles require different numbers of approvals
        const approvalRequirements = {
            'SUPER_ADMIN_ROLE': 2,
            'EMERGENCY_ROLE': 2,
            'TREASURY_MANAGER_ROLE': 2,
            'MINTING_MANAGER_ROLE': 1,
            'ORACLE_MANAGER_ROLE': 1,
            'LIQUIDATOR_ROLE': 1,
            'KEEPER_ROLE': 1
        };
        
        return approvalRequirements[role] || 1;
    }

    private validatePermissionRequest(
        requester: string,
        targetRole: string,
        targetAddress: string,
        duration: number
    ): void {
        
        // Maximum duration limits by role
        const maxDurations = {
            'SUPER_ADMIN_ROLE': 7 * 24 * 60 * 60 * 1000,     // 7 days
            'EMERGENCY_ROLE': 24 * 60 * 60 * 1000,           // 1 day
            'TREASURY_MANAGER_ROLE': 7 * 24 * 60 * 60 * 1000, // 7 days
            'MINTING_MANAGER_ROLE': 30 * 24 * 60 * 60 * 1000, // 30 days
            'ORACLE_MANAGER_ROLE': 30 * 24 * 60 * 60 * 1000,  // 30 days
            'LIQUIDATOR_ROLE': 90 * 24 * 60 * 60 * 1000,      // 90 days
            'KEEPER_ROLE': 90 * 24 * 60 * 60 * 1000           // 90 days
        };
        
        if (duration > (maxDurations[targetRole] || 0)) {
            throw new Error(`Duration exceeds maximum for role ${targetRole}`);
        }
        
        // Check if address is already blacklisted
        if (this.isBlacklisted(targetAddress)) {
            throw new Error('Target address is blacklisted');
        }
        
        // Rate limiting: max 3 requests per day per requester
        const recentRequests = this.getRecentRequests(requester, 24 * 60 * 60 * 1000);
        if (recentRequests.length >= 3) {
            throw new Error('Too many permission requests in 24 hours');
        }
    }
}

# Comprehensive audit trail system for compliance and security monitoring
import json
import hashlib
from datetime import datetime, timedelta
from typing import Dict, List, Optional
from dataclasses import dataclass, asdict

@dataclass
class AccessEvent:
    timestamp: datetime
    event_type: str  # ROLE_GRANTED, ROLE_REVOKED, ACTION_EXECUTED, etc.
    actor: str       # Address that performed the action
    target: str      # Address affected by the action
    role: str        # Role involved
    action_hash: str # Hash of the action for integrity
    gas_used: int
    block_number: int
    transaction_hash: str
    metadata: Dict

class AccessControlAuditor:
    def __init__(self):
        self.events: List[AccessEvent] = []
        self.suspicious_patterns = {
            'rapid_role_changes': {
                'window': 3600,  # 1 hour
                'threshold': 5,   # More than 5 role changes
                'severity': 'HIGH'
            },
            'unusual_time_access': {
                'start_hour': 0,  # Midnight
                'end_hour': 6,    # 6 AM
                'severity': 'MEDIUM'
            },
            'privilege_escalation': {
                'pattern': 'role_granted_then_used',
                'window': 300,    # 5 minutes
                'severity': 'CRITICAL'
            },
            'emergency_role_abuse': {
                'consecutive_uses': 3,
                'window': 86400,  # 24 hours
                'severity': 'HIGH'
            }
        }

    def log_access_event(
        self,
        event_type: str,
        actor: str,
        target: str,
        role: str,
        action_data: Dict,
        transaction_info: Dict
    ) -> str:
        """Log an access control event with integrity protection"""
        
        # Create event record
        event = AccessEvent(
            timestamp=datetime.now(),
            event_type=event_type,
            actor=actor,
            target=target,
            role=role,
            action_hash=self.calculate_action_hash(action_data),
            gas_used=transaction_info.get('gas_used', 0),
            block_number=transaction_info.get('block_number', 0),
            transaction_hash=transaction_info.get('tx_hash', ''),
            metadata=action_data
        )
        
        self.events.append(event)
        
        # Real-time suspicious pattern detection
        self.detect_suspicious_patterns(event)
        
        # Store in permanent audit log
        self.store_permanent_record(event)
        
        return event.action_hash

    def detect_suspicious_patterns(self, new_event: AccessEvent) -> List[Dict]:
        """Detect suspicious access patterns in real-time"""
        alerts = []
        
        # Pattern 1: Rapid role changes
        rapid_change_alert = self.check_rapid_role_changes(new_event)
        if rapid_change_alert:
            alerts.append(rapid_change_alert)
        
        # Pattern 2: Unusual time access
        unusual_time_alert = self.check_unusual_time_access(new_event)
        if unusual_time_alert:
            alerts.append(unusual_time_alert)
        
        # Pattern 3: Privilege escalation
        escalation_alert = self.check_privilege_escalation(new_event)
        if escalation_alert:
            alerts.append(escalation_alert)
        
        # Pattern 4: Emergency role abuse
        emergency_abuse_alert = self.check_emergency_role_abuse(new_event)
        if emergency_abuse_alert:
            alerts.append(emergency_abuse_alert)
        
        # Send alerts if any detected
        for alert in alerts:
            self.send_security_alert(alert)
        
        return alerts

    def check_rapid_role_changes(self, event: AccessEvent) -> Optional[Dict]:
        """Check for unusually rapid role changes"""
        if event.event_type not in ['ROLE_GRANTED', 'ROLE_REVOKED']:
            return None
        
        pattern = self.suspicious_patterns['rapid_role_changes']
        cutoff_time = event.timestamp - timedelta(seconds=pattern['window'])
        
        recent_role_events = [
            e for e in self.events
            if e.timestamp > cutoff_time
            and e.event_type in ['ROLE_GRANTED', 'ROLE_REVOKED']
            and e.actor == event.actor
        ]
        
        if len(recent_role_events) > pattern['threshold']:
            return {
                'type': 'RAPID_ROLE_CHANGES',
                'severity': pattern['severity'],
                'actor': event.actor,
                'event_count': len(recent_role_events),
                'time_window': pattern['window'],
                'description': f'Actor {event.actor} performed {len(recent_role_events)} role changes in {pattern["window"]} seconds'
            }
        
        return None

    def check_privilege_escalation(self, event: AccessEvent) -> Optional[Dict]:
        """Check for potential privilege escalation attacks"""
        if event.event_type != 'ACTION_EXECUTED':
            return None
        
        pattern = self.suspicious_patterns['privilege_escalation']
        cutoff_time = event.timestamp - timedelta(seconds=pattern['window'])
        
        # Look for role granted to actor recently, then immediately used
        recent_grant = None
        for e in reversed(self.events):
            if e.timestamp < cutoff_time:
                break
            if (e.event_type == 'ROLE_GRANTED' and 
                e.target == event.actor and 
                e.role == event.role):
                recent_grant = e
                break
        
        if recent_grant:
            time_diff = (event.timestamp - recent_grant.timestamp).total_seconds()
            if time_diff < pattern['window']:
                return {
                    'type': 'PRIVILEGE_ESCALATION',
                    'severity': pattern['severity'],
                    'actor': event.actor,
                    'role': event.role,
                    'time_between': time_diff,
                    'description': f'Actor {event.actor} used role {event.role} only {time_diff} seconds after being granted it'
                }
        
        return None

    def generate_compliance_report(self, start_date: datetime, end_date: datetime) -> Dict:
        """Generate comprehensive compliance report for auditors"""
        
        # Filter events by date range
        period_events = [
            e for e in self.events
            if start_date <= e.timestamp <= end_date
        ]
        
        # Role distribution analysis
        role_usage = {}
        for event in period_events:
            if event.role not in role_usage:
                role_usage[event.role] = {'grants': 0, 'revokes': 0, 'actions': 0}
            
            if event.event_type == 'ROLE_GRANTED':
                role_usage[event.role]['grants'] += 1
            elif event.event_type == 'ROLE_REVOKED':
                role_usage[event.role]['revokes'] += 1
            elif event.event_type == 'ACTION_EXECUTED':
                role_usage[event.role]['actions'] += 1
        
        # Actor analysis
        actor_activity = {}
        for event in period_events:
            if event.actor not in actor_activity:
                actor_activity[event.actor] = []
            actor_activity[event.actor].append({
                'timestamp': event.timestamp.isoformat(),
                'action': event.event_type,
                'role': event.role,
                'target': event.target
            })
        
        # Security alerts summary
        alert_summary = self.summarize_security_alerts(start_date, end_date)
        
        return {
            'report_period': {
                'start': start_date.isoformat(),
                'end': end_date.isoformat()
            },
            'total_events': len(period_events),
            'role_usage_summary': role_usage,
            'actor_activity_summary': {
                actor: {
                    'total_actions': len(activities),
                    'roles_used': list(set(a['role'] for a in activities)),
                    'most_recent_activity': max(a['timestamp'] for a in activities)
                }
                for actor, activities in actor_activity.items()
            },
            'security_alerts': alert_summary,
            'compliance_status': self.assess_compliance_status(period_events),
            'recommendations': self.generate_security_recommendations(period_events)
        }

    def assess_compliance_status(self, events: List[AccessEvent]) -> Dict:
        """Assess compliance with security policies"""
        
        compliance_checks = {
            'emergency_role_usage': {
                'threshold': 10,  # Maximum emergency actions per month
                'actual': len([e for e in events if e.role == 'EMERGENCY_ROLE']),
                'status': 'PASS'
            },
            'multi_sig_compliance': {
                'threshold': 0.95,  # 95% of critical actions should be multi-sig
                'actual': self.calculate_multisig_compliance(events),
                'status': 'PASS'
            },
            'role_rotation': {
                'threshold': 30,  # Roles should be rotated at least every 30 days
                'actual': self.calculate_average_role_duration(events),
                'status': 'PASS'
            }
        }
        
        # Update status based on actual vs threshold
        for check_name, check in compliance_checks.items():
            if check_name == 'multi_sig_compliance' or check_name == 'role_rotation':
                if check['actual'] < check['threshold']:
                    check['status'] = 'FAIL'
            else:
                if check['actual'] > check['threshold']:
                    check['status'] = 'FAIL'
        
        overall_status = 'PASS' if all(c['status'] == 'PASS' for c in compliance_checks.values()) else 'FAIL'
        
        return {
            'overall_status': overall_status,
            'individual_checks': compliance_checks,
            'assessment_date': datetime.now().isoformat()
        }

// Emergency response integration with access control
contract EmergencyResponseProtocol is StablecoinAccessControl {
    
    enum EmergencyLevel {
        NONE,
        LOW,      // Suspicious activity detected
        MEDIUM,   // Active threat identified  
        HIGH,     // Ongoing attack
        CRITICAL  // Protocol compromise
    }
    
    EmergencyLevel public currentEmergencyLevel;
    mapping(address => bool) public emergencyResponders;
    uint256 public emergencyStartTime;
    
    event EmergencyLevelChanged(EmergencyLevel from, EmergencyLevel to, address triggeredBy);
    event EmergencyActionTaken(address responder, bytes32 action, EmergencyLevel level);
    
    function declareEmergency(
        EmergencyLevel level,
        string calldata reason
    ) external onlyRole(EMERGENCY_ROLE) {
        EmergencyLevel previousLevel = currentEmergencyLevel;
        currentEmergencyLevel = level;
        emergencyStartTime = block.timestamp;
        
        // Automatically adjust permissions based on emergency level
        if (level >= EmergencyLevel.HIGH) {
            // Pause non-essential functions
            _pause();
            
            // Revoke non-critical roles temporarily
            _emergencyRoleRevocation();
        }
        
        emit EmergencyLevelChanged(previousLevel, level, msg.sender);
    }
    
    function _emergencyRoleRevocation() internal {
        // This is where specific emergency procedures would be implemented
        // Example: temporarily revoke MINTING_MANAGER_ROLE during high emergency
    }
    
    function resolveEmergency() external onlyRole(SUPER_ADMIN_ROLE) {
        require(currentEmergencyLevel != EmergencyLevel.NONE, "No active emergency");
        
        EmergencyLevel previousLevel = currentEmergencyLevel;
        currentEmergencyLevel = EmergencyLevel.NONE;
        
        // Restore normal operations
        if (paused()) {
            _unpause();
        }
        
        // Restore revoked roles (requires individual approval)
        _restoreEmergencyRevokedRoles();
        
        emit EmergencyLevelChanged(previousLevel, EmergencyLevel.NONE, msg.sender);
    }
}