yearn / yearn-vaults-v3

GNU Affero General Public License v3.0
96 stars 35 forks source link

build: role updates #144

Closed Schlagonia closed 1 year ago

Schlagonia commented 1 year ago

Description

  1. Gives the ability for the role manager to close a previously opened role.
  2. Make each setter function have its own Role to allow for complete control of ownership

This would mean ideally you would not want the following role combinations given to have the same address:

ADD_STRATEGY_MANAGER, MAX_DEBT_MANAGER and DEBT_MANAGER ACCOUNTANT_MANAGER and REPORTING_MANAGER REVOKE_STRATEGY_MANAGER and SWEEPER

If done that would mean any malicious actor would have to get control of at least two different addresses in order to be able to steal any funds.

One potential downside to this current setup is that to get a strategy added and funded now require 3 separate Roles instead of two.

  1. Add strategy
  2. update strategy max debt
  3. send strategy debt

This is the riskiest part of vault ownership, so is likely worth the extra steps.

Fixes # (issue)

Checklist

Schlagonia commented 1 year ago

added to https://github.com/yearn/yearn-vaults-v3/commit/8f1abb2dfb5d3f71cdb561049d5cb68644eff1ba