EOPBCTemplate - permission documentation inconsistencies
Undocumented\\nThe template documentation provides an overview of the permissions set with the template. The following permissions are set by the template contract but are not documented in the accompanied `fundraising/templates/externally_owned_presale_bonding_curve/README.md`.\\nTokenManager\\n```\\n\\_createPermissions(\\_acl, grantees, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.MINT\\_ROLE(), \\_owner);\\n\\_acl.createPermission(\\_fundraisingApps.marketMaker, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.BURN\\_ROLE(), \\_owner);\\n```\\n\\ncode/fundraising/templates/externally_owned_presale_bonding_curve/eopbc.yaml:L33-L44\\n```\\n- app: anj-token-manager\\n  role: MINT\\_ROLE\\n  grantee: market-maker\\n  manager: owner\\n- app: anj-token-manager\\n  role: MINT\\_ROLE\\n  grantee: presale\\n  manager: owner\\n- app: anj-token-manager\\n  role: BURN\\_ROLE\\n  grantee: market-maker\\n  manager: owner\\n```\\n\\nInconsistent\\nThe following permissions are set by the template but are inconsistent to the outline in the documentation:\\nController\\n`owner` has the following permissions even though they are documented as not being set https://github.com/ConsenSys/aragonone-presale-audit-2019-11/blob/9ddae8c7fde9dea3af3982b965a441239d81f370/code/fundraising/templates/externally_owned_presale_bonding_curve/README.md#controller.\\n```\\n| App        | Permission                            | Grantee | Manager |\\n| ---------- | ------------------------------------- | ------- | ------- |\\n| Controller | UPDATE_BENEFICIARY                    | NULL    | NULL    |\\n| Controller | UPDATE_FEES                           | NULL    | NULL    |\\n| Controller | ADD_COLLATERAL_TOKEN                  | Owner   | Owner   |\\n| Controller | REMOVE_COLLATERAL_TOKEN               | Owner   | Owner   |\\n| Controller | UPDATE_COLLATERAL_TOKEN               | Owner   | Owner   |\\n| Controller | UPDATE_MAXIMUM_TAP_RATE_INCREASE_PCT  | NULL    | NULL    |\\n| Controller | UPDATE_MAXIMUM_TAP_FLOOR_DECREASE_PCT | NULL    | NULL    |\\n| Controller | ADD_TOKEN_TAP                         | NULL    | NULL    |\\n| Controller | UPDATE_TOKEN_TAP                      | NULL    | NULL    |\\n| Controller | OPEN_PRESALE                          | Owner   | Owner   |\\n| Controller | OPEN_TRADING                          | Presale | Owner   |\\n| Controller | CONTRIBUTE                            | Any     | Owner   |\\n| Controller | OPEN_BUY_ORDER                        | Any     | Owner   |\\n| Controller | OPEN_SELL_ORDER                       | Any     | Owner   |\\n| Controller | WITHDRAW                              | NULL    | NULL    |\\n```\\n\\n```\\n\\_acl.createPermission(\\_owner, \\_fundraisingApps.controller, \\_fundraisingApps.controller.UPDATE\\_BENEFICIARY\\_ROLE(), \\_owner);\\n\\_acl.createPermission(\\_owner, \\_fundraisingApps.controller, \\_fundraisingApps.controller.UPDATE\\_FEES\\_ROLE(), \\_owner);\\n```\\n
Resolution\\nFixed with aragonone/[email protected]bafe100 by adding the undocumented and deviating permissions to the documentation.\\nFor transparency, all permissions set-up by the template must be documented.
```\\n\\_createPermissions(\\_acl, grantees, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.MINT\\_ROLE(), \\_owner);\\n\\_acl.createPermission(\\_fundraisingApps.marketMaker, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.BURN\\_ROLE(), \\_owner);\\n```\\n