# Vaultfire — Access Control Matrix (PR1 revised)

**Prepared:** 2026-08-20
**Repo HEAD:** `a80144d1acbbbbf24b9eca7cd91e61daad0c0ad6`
**Scope:** All 134 deployed instances (36 unique contract names × 4 EVM chains) plus the V3 draft contracts staged for release.

This matrix records what admin authority each contract exposes, who holds it today, and what needs to change before any partner pilot.

---

## Wallets used across the protocol

| Label | Address | Role | Status |
|---|---|---|---|
| **ghostkey.base.eth** | `0xfA15Ee28939B222B0448261A22156070f0A7813C` | Canonical deployer + current owner on 53 contracts (via `owner()`) | **ACTIVE** |
| **bpow20.cb.id** | `0xA054f831B562e729F8D268291EBde1B2EDcFb84F` | Legacy deployer; recorded `owner()` value on 16 contracts | **COMPROMISED — REPLACED** (safe by bytecode; see below) |
| **audit-burner** | `0x5a03C962227Dd478B5CD2B9f09E81105096154ad` | Audit payment + ERC-8004 review payments only; no contract authority | ACTIVE for audits only |
| **MultisigGovernanceV3** | *not yet deployed to mainnet* | Threshold governance target (draft in `contracts-root/`) | PENDING |
| **Vaultfire treasuries** (`humanTreasury`, `partnershipFund` withdrawal destinations) | per-contract, EOA today | Fund destinations on bond distributions | Should route to multisig post-pilot |

---

## Owner distribution across 134 deployed instances

| Owner value | Count | Category |
|---|---:|---|
| `ghostkey.base.eth` (`0xfA15Ee28…`) | 53 | Active owner |
| `bpow20.cb.id` (`0xA054f831…`) | 16 | **Inert by bytecode** — owner() is a stale getter with no admin functions gated on it (see verification below) |
| No `owner()` selector | 65 | Uses OZ AccessControl or no admin at all — role holders determined per contract |

Source: `baseline/merged_onchain.json` + `baseline/compromised_owner_selector_scan.json`.

---

## The 16 "compromised-owner" contracts — verified inert

On 2026-08-20 every one of these 16 contracts was bytecode-scanned across all 4 chains. **None expose any of the following selectors:**

`transferOwnership(address)` `0xf2fde38b` · `renounceOwnership()` `0x715018a6` · `grantRole(bytes32,address)` `0x2f2ff15d` · `revokeRole(bytes32,address)` `0xd547741f` · `pause()` `0x8456cb59` · `unpause()` `0x3f4ba83a` · `upgradeTo(address)` `0x3659cfe6` · `upgradeToAndCall(address,bytes)` `0x4f1ef286`.

The only owner-related selector present is `owner()` `0x8da5cb5b` as a pure getter with no functions consuming it as an authority check. **These contracts are effectively immutable and the compromised key cannot use its stale `owner()` label to do anything on chain.**

Remediation is documentation-only (see `P0_FINDINGS.md` §P0-1): annotate `deployments.json`, `/api/contracts`, and any explorer view so partners don't misread the stale wallet as an active admin.

Evidence file: `baseline/compromised_owner_selector_scan.json`.

---

## Admin surface per contract (deployed V2 + V3 draft)

Legend: **⚑** = admin call that must eventually route through `MultisigGovernanceV3` (multisig + timelock). **↩** = 2-step ownership pattern present. **✕** = single-step / risky today.

### Star bonds

| Contract | onlyOwner / admin functions | 2-step? | Notes |
|---|---|---|---|
| `AIAccountabilityBondsV2` (deployed, all 4 chains) | `setMissionEnforcement`, `setMissionEnforcementEnabled`, `setHumanTreasury` | ✕ | Immutable; assignment requires no touch. If treasury change ever needed, only path is a V3 replacement bond. |
| `AIPartnershipBondsV2` (deployed, all 4 chains) | `setMissionEnforcement`, `setMissionEnforcementEnabled`, `pause/unpause` (via inherited Pausable), treasury setters | ✕ | Same as above. |
| `AIAccountabilityBondsV3` (draft) | `setMissionEnforcement`, `setMissionEnforcementEnabled`, `setHumanTreasury`, `setOracleRequiredThreshold`, `setOracleQuorum` ⚑, `setFlourishingOracle` ⚑, `setOracleEnforced` ⚑, `setBridgeNotifier` ⚑ | ✕ | Owner is a single EOA today. All ⚑ must move to multisig before pilot. |
| `AIPartnershipBondsV3_to_push` (draft) | `setMissionEnforcement`, `setMissionEnforcementEnabled`, `withdrawPartnershipFund(address,uint256)` ⚑ | ✕ | `withdrawPartnershipFund` is fund-moving — must be multisig + timelock. |
| `BaseYieldPoolBondV3` (draft) | multiple owner setters for pool params | ✕ | Same. |

### Bridge & governance

| Contract | Admin surface | Notes |
|---|---|---|
| `VaultfireTeleporterBridge` (V2, all 4 chains, deployed) | Standard OZ Ownable | Immutable; do not touch. |
| `VaultfireTeleporterBridgeV3` (draft) | `transferOwnership` ✕, `setRequiredGasLimit`, `setTeleporterMessenger`, `setRemoteBridgeSigner` ⚑, `addRelayer`/`removeRelayer` ⚑, `pause`/`unpause` | Single-EOA today. **P0-6:** must move to `MultisigGovernanceV3` before pilot. |
| `TrustPortabilityExtensionV3` (draft) | Same shape + `addTrustedVerifierImageId`/`removeTrustedVerifierImageId` | Same. |
| `MultisigGovernanceV3` (draft, not deployed) | Threshold=N-of-M signers with timelock, guardian override with 2-step transfer | R3 MED-R3-08 flags no `setThreshold` fn; R3 MED-R3-11 flags no guardian rotation. Both must be addressed in PR8. |

### Oracle & identity

| Contract | Admin surface | Notes |
|---|---|---|
| `FlourishingMetricsOracleV3` (draft) | Owner registers sources, sets weights | Owner ⚑ before pilot. |
| `MultiOracleConsensusV3` (draft) | Owner registers/slashes oracles, sets rounds | ⚑ before pilot. R3 HIGH-R3-07: slashed oracle stake permanently locked. |
| `BeliefOracleV3` (draft) | Guardian transfer 2-step ↩ (HIGH-21 fix) | Good. R3 HIGH-R3-08: `queryBelief` has no rate limit. |
| `ERC8004IdentityRegistryV3` (draft) | `pause/unpause` only | Low-authority. R3 MED-R3-19: free registration → Sybil concern. |
| `ERC8004ReputationRegistryV3` (draft) | 2-step ownership ↩ (HIGH-08 fix), rate-limited authorized callers | Good. |
| `ERC8004ValidationRegistryV3` (draft) | Owner slashes; slashed ETH locked (R3 MED-R3-17) | ⚑ + treasury address needed. |
| `VaultfireERC8004AdapterV3` (draft) | `transferOwnership` ✕ single-step (R3 HIGH-R3-09) | Must add 2-step before pilot. |
| `ProductionBeliefAttestationVerifierV3` (draft) | `transferOwnership` ✕ single-step (R3 HIGH-R3-10), owner updates ZK image IDs | Must add 2-step before pilot. |

### Auxiliary contracts (deployed, no R3 audit coverage)

The following 15+ deployed contracts have no documented audit coverage in `reference-docs/`. Their admin surface must be enumerated in PR6:

`AgentInsurancePool`, `AgentSLAEnforcer`, `AgentSafetyManager`, `AntiSurveillance`, `BeliefAttestationVerifier`, `ComplianceRegistry`, `MissionEnforcement`, `PrivacyGuarantees`, `ReputationDecay`, `ScopedDelegation`, `VKPDelegationRegistry`, `VKPFactory`, `VKPSessionKeyManager`, `VaultfireBIPVault` (Base only), `VaultfireBatchOnboarder` (Base only), `VaultfireBondInsurancePool`, `VaultfireCapabilityCredentials`, `VaultfireDisputeResolution`, `VaultfireForumRegistry`, `VaultfireNameService`, `VaultfireReputationStaking`, `VaultfireStreetCred` (Base only), `VaultfireTaskEscrow`, `VaultfireTrustAttestation`, `VaultfireTrustOracle`.

Any admin surface here must be surveyed before partner pilot.

---

## Treasury and fund destinations

| Contract path | Fund destination | Owner-controllable? |
|---|---|---|
| `AIAccountabilityBondsV2/V3` distributions | `humanTreasury` (owner-set), AI company address, bond fund | Yes — `setHumanTreasury` ⚑ |
| `AIPartnershipBondsV3.withdrawPartnershipFund` | Owner-supplied `to` | Yes — must be multisig ⚑ |
| `VaultfireBIPVault` (Base) | Vault holders per ERC-4626 (if compliant) | To be audited |
| `VaultfireTaskEscrow` | Task participants + protocol fees | To be audited |
| `VaultfireBondInsurancePool`, `AgentInsurancePool` | Pool depositors on claims | To be audited (assignment §Insurance requires rename to Mutual Aid Pool unless full insurance semantics exist) |

---

## Access-control changes required before pilot

1. **Deploy `MultisigGovernanceV3` on Base** (draft → mainnet, from ghostkey.base.eth). Address must be recorded in `deployments.json` under `chains.base.governance`.
2. **`transferOwnership(multisig)` on every V3 draft contract** before its production deploy. Bond, bridge, TPE, oracle, adapter, verifier — all currently single-EOA.
3. **Add `setThreshold` and guardian rotation to `MultisigGovernanceV3`** (R3 MED-R3-08, R3 MED-R3-11).
4. **Add 2-step ownership to `VaultfireERC8004AdapterV3` and `ProductionBeliefAttestationVerifierV3`** (R3 HIGH-R3-09, -10) before deploy.
5. **Add `deregisterOracle` mechanism** in `AIAccountabilityBondsV3` (R3 MED-R3-03) so a compromised oracle can be removed without leaving quorum inflated.
6. **Route `withdrawPartnershipFund` and `withdrawToken` through multisig + timelock** with a fund-flow event that indexers can monitor.
7. **Update `deployments.json`** with per-contract `status` field: `active`, `legacy`, `deprecated`, `paused`, `read-only`, per assignment §Backward compatibility.
8. **Annotate 16 stale-owner contracts** per §P0-1 remediation.

No item above is executed by this document. All require explicit owner approval per action.
