web3-case-study-role-misconfig

Auditing role-based access control in a yield aggregator smart contract involves identifying missing role grants, such as a DISTRIBUTOR_ROLE, that permanently lock reward tokens. You must verify OpenZeppelin role usage and cross-contract permission patterns to reproduce the issue.

claimFor() reverts because the DISTRIBUTOR_ROLE is never granted, resulting in a getRoleMemberCount of 0. This role misconfiguration permanently locks earned rewards by blocking any address from executing claim transactions within the distributor contract.

To reproduce a role misconfiguration bug using a mainnet fork, run the provided RoleNeverGranted PoC templates. Validation steps confirm that getRoleMemberCount returns 0 and that claimFor() reverts, allowing you to assess the risk in a controlled testnet environment.

Remediate a dust harvest DoS caused by role misconfiguration by applying the provided remediation guidance. The case study includes validation steps to correct the OpenZeppelin role usage and restore reward distribution functionality across the affected contracts.

Yes, you can use this case study to verify PoC findings across 10 bug classes. It delivers complete bug class verdicts and focuses on two live findings, specifically targeting OpenZeppelin role usage and access control patterns in Solidity projects.

A forked mainnet environment is required to accurately audit cross-contract permission patterns in DeFi. This setup validates PoC templates and confirms that role misconfigurations, such as missing DISTRIBUTOR_ROLE grants, permanently lock reward tokens.