Access Control

Varla uses OpenZeppelin's AccessManager pattern for role-based access control. All restricted functions across the protocol check permissions through a single central VarlaAccessManager.

contracts/access/VarlaAccessManager.sol — central RBAC contract
contracts/access/VarlaRoles.sol — role ID definitions

VarlaAccessManager

A thin wrapper around OpenZeppelin's AccessManager. Deployed once and shared by all protocol contracts that inherit AccessManaged.

contract VarlaAccessManager is AccessManager {
    constructor(address initialAdmin) AccessManager(initialAdmin) { }
}

All protocol contracts (VarlaCore, VarlaPool, VarlaOracle, VarlaInterestRateStrategy, VarlaLiquidator) are deployed with this manager's address. The manager controls which addresses can call which functions.

VarlaRoles

A library defining role IDs used across the protocol. Each role is a uint64 derived from a deterministic hash.

library VarlaRoles {
    uint64 constant ROLE_ADMIN          = 0;
    uint64 constant ROLE_RISK_MANAGER   = uint64(keccak256("VARLA_ROLE_RISK_MANAGER"));
    uint64 constant ROLE_ORACLE_UPDATER = uint64(keccak256("VARLA_ROLE_ORACLE_UPDATER"));
    uint64 constant ROLE_POOL_MANAGER   = uint64(keccak256("VARLA_ROLE_POOL_MANAGER"));
    uint64 constant ROLE_TREASURY       = uint64(keccak256("VARLA_ROLE_TREASURY"));
    uint64 constant ROLE_GUARDIAN       = uint64(keccak256("VARLA_ROLE_GUARDIAN"));
    uint64 constant ROLE_PAUSER         = uint64(keccak256("VARLA_ROLE_PAUSER"));
}

Role Permissions

Role	What It Controls
ADMIN	Full protocol control — assign roles, upgrade proxies, set contract addresses
RISK_MANAGER	Update LTV configs, liquidation parameters, interest rate params, oracle configs
ORACLE_UPDATER	Push price updates to VarlaOracle via OracleUpdaterRouter
POOL_MANAGER	Configure pool parameters — fees, caps, reserve factor
TREASURY	Withdraw protocol fees and reserves
GUARDIAN	Emergency actions — oracle guard overrides, position-level protections
PAUSER	Pause and unpause protocol operations

How It Works

Every restricted function in Varla contracts uses the restricted modifier from AccessManaged:

// In VarlaCore:
function setLtvConfig(uint256 pid, LtvConfig calldata config) 
    external restricted {
    // Only callable by addresses with RISK_MANAGER role
}

The VarlaAccessManager admin configures which role can call which function on which contract. This is done via OpenZeppelin's setTargetFunctionRole().

✦ Key Takeaways

Single VarlaAccessManager controls all protocol access — deployed once, shared everywhere
Seven roles: Admin, Risk Manager, Oracle Updater, Pool Manager, Treasury, Guardian, Pauser
Built on OpenZeppelin AccessManager — battle-tested, granular function-level permissions
Role IDs are deterministic (keccak256 hashes) — same across all deployments