search

bugout-dev / dao

Moonstream DAO
Apache License 2.0
17 stars 7 forks source link

`isApprovedForPool` problems and Proposal to replace it. #41

Open Yhtiyar opened 2 years ago

Yhtiyar commented 2 years ago

Problem

In the Terminus contract we have isApprovedForPool(uint256 poolID, address operator) function, which grants operator burning and minting permission (only pool owner can grant this permissions). There are problems with it:

  1. Approval cannot be taken away. (Huge security problem)
  2. When the pool control transfer is done, old approvals will not be reset (which might be ok), but you will not be able to easily remove approvals for all of the operators

Possible solutions

  1. Add the ability for terminus owner to grant roles (minting, burning, control, etc) by giving terminus pools
  2. Since, solution No 1 can make mess inside the terminus contract, make TerminusManager contract that will handle all the access control. (TerminusManager will be the controller of the pool)