Access Control Admin Facet

Manages roles and their administrative roles

Key Features

• Manages role-to-admin-role mappings in diamond storage.
• Exposes functions for role administration and selector export.
• Reverts with AccessControlUnauthorizedAccount if caller lacks permissions.
• Compatible with ERC-2535 diamond standard.

Overview

This facet provides administrative functions for managing roles within a diamond's access control system. It allows setting administrative roles for specific roles and exporting the facet's selectors. Calls are routed through the diamond proxy, accessing shared storage for role configurations.

Storage

AccessControlStorage

Definition

struct AccessControlStorage {
  mapping(address account => mapping(bytes32 role => bool hasRole)) hasRole;
  mapping(bytes32 role => bytes32 adminRole) adminRole;
}

State Variables

Property	Type	Description
STORAGE_POSITION	bytes32	Diamond storage slot position for this module (Value: keccak256("compose.accesscontrol"))

Functions

setRoleAdmin

Sets the admin role for a role. Emits a RoleAdminChanged event. Reverts with AccessControlUnauthorizedAccount If the caller is not the current admin of the role.

function setRoleAdmin(bytes32 _role, bytes32 _adminRole) external;

Parameters:

Property	Type	Description
_role	bytes32	The role to set the admin for.
_adminRole	bytes32	The new admin role to set.

---

exportSelectors

Exports the selectors that are exposed by the facet.

function exportSelectors() external pure returns (bytes memory);

Returns:

Property	Type	Description
-	bytes	Selectors that are exported by the facet.

Events

Emitted when the admin role for a role is changed.

Signature:

event RoleAdminChanged(bytes32 indexed _role, bytes32 indexed _previousAdminRole, bytes32 indexed _newAdminRole);

Parameters:

Property	Type	Description
_role	bytes32	The role that was changed.
_previousAdminRole	bytes32	The previous admin role.
_newAdminRole	bytes32	The new admin role.

Errors

Thrown when the account does not have a specific role.

Signature:

error AccessControlUnauthorizedAccount(address _account, bytes32 _role);

Best Practices

Best Practice

• Initialize role admin configurations during diamond deployment.
• Ensure the caller has the necessary permissions to set role administrators.
• Verify storage compatibility before upgrading facets to prevent state corruption.

Security Considerations

Security

All state-changing functions, such as setRoleAdmin, are protected by access control checks, reverting with AccessControlUnauthorizedAccount if the caller is not the current admin of the role. Input validation is performed by the underlying access control logic. Follow standard Solidity security practices for external calls and state management.

Was this helpful?

Last updated:March 13, 2026