Role-Based Access Control Matrix Auditor

WHAT IT DOES

Role-Based Access Control Matrix Auditor is a read-only security tool that inspects any EVM smart contract's permission structure. It detects standard ownership patterns (Ownable), role-based access control (OpenZeppelin AccessControl), proxy admin slots (EIP-1967), and attempts to enumerate common roles such as DEFAULT_ADMIN_ROLE, MINTER_ROLE, PAUSER_ROLE, and UPGRADER_ROLE. For any contract address you provide, it returns the current owner (if any), the proxy admin (if the contract is a proxy), and a matrix of role assignments for a specific account or across the entire role set. The tool helps you verify who has critical permissions before you interact with a protocol, deploy a dependent contract, or accept a governance proposal.

HOW TO USE

Connect your wallet via the built-in BGWallet bridge — this is required only to provide an RPC endpoint; the tool never initiates transactions. Select the network that matches your target contract (Ethereum, Polygon, Arbitrum, Optimism, BSC, Avalanche, and their testnets are supported). Enter the contract address you want to audit. Optionally, enter a specific account address to check its role memberships — leave it blank to see a summary of detected role structures. Click "Audit roles" and the tool queries the chain using eth_call and displays a clear table of all detected roles and whether the account holds each role. The results card also shows the contract owner and any proxy admin.

ONE TECHNICAL SECTION

The auditor dynamically detects which access control pattern a contract uses by attempting standard function signatures. For Ownable, it calls owner() and returns the result. For AccessControl, it attempts getRoleAdmin(DEFAULT_ADMIN_ROLE) — if this succeeds, it then probes hasRole() for the provided account across DEFAULT_ADMIN_ROLE and several well-known role hashes (MINTER_ROLE, PAUSER_ROLE, UPGRADER_ROLE). It also detects a proxy admin via the EIP-1967 admin slot. All calls are batched via the ethers.js Contract abstraction, and each read is performed sequentially to avoid nonce or concurrency issues. Because this tool is read-only, it uses no gas and requires no transaction signing — it simply views the current on-chain state. The contract address is never stored or cached; you paste the contract you are auditing, so you are always in control of the target.

WHAT IT CANNOT SEE

This tool cannot detect off-chain role assignments, such as permissions stored in a centralized database or off-chain multi-sig coordination. It cannot see time-based permissions that expire or are granted only for a specific block range. It does not interpret the intent behind a multi-sig wallet or a governance proposal outcome — a role may be assigned on-chain, but the tool cannot tell you whether that assignment was part of a legitimate proposal or a malicious action. It also cannot audit custom role systems that do not follow the OpenZeppelin AccessControl interface or the Ownable pattern — if your contract uses a fully custom permission system with non-standard function names or signatures, this tool will not detect those roles. Finally, it cannot verify that the contract code itself is safe or that the role assignments are properly enforced in all code paths — it only reports what the on-chain state claims.

PLEASE NOTE

This tool works exclusively on EVM-compatible chains. Solana, Tron, Starknet, SUI, TON, Aptos, Bitcoin, Cosmos, and XRP are not supported. All reads are performed via the wallet bridge's RPC provider; if your wallet is not connected or the network does not match the contract, the audit will fail. The tool is free and open-source — use it at your own risk and always cross-check critical permissions with a block explorer or a second source.