auditing-smart-contract-access-controllisted

# Auditing smart-contract access control: who is allowed to call the privileged function Access control on a contract is a set of gates: a modifier or a check that says only the owner, only a role, only during initialization. The bug is a privileged action, moving funds, changing configuration, upgrading, self-destructing, whose gate is missing, wrong, or reachable by the wrong caller. This is a crowded audit area, so the discipline is confirming the action is genuinely privileged and the gate is genuinely absent or defeated on a reachable path, not flagging every public function. The dividing line from reentrancy: if the fix is to add or repair an authorization check, it belongs here; if the fix is to reorder effects before interactions or add a mutex, it belongs in the reentrancy skill. Two initialization and delegation shapes, the unprotected initializer and the delegatecall to an attacker-controlled target, are access-control bugs and are audited here. ## When to use - A function changes state, moves funds, upgrades, self-destructs, or grants a role. - You see an authorization modifier, an ownership or role check, an initializer, or a delegatecall. - You want to know whether an attacker can reach a privileged action the contract meant to restrict. ## Scope check Audit only contracts you own or are authorized to assess, and exercise a privileged path only on a test network or a local fork, calling an unguarded privileged function on a live contract can seize or destro