Access Control (Smart Contract)
Smart contract code that restricts which addresses are permitted to call specific, generally privileged, functions.
Access control, in the smart contract context, is code that restricts which addresses are permitted to call specific functions — commonly privileged functions like upgrading a contract, pausing it, or withdrawing funds — checking the caller's address against an approved list (such as a single owner, or a role-based set of permitted addresses) before allowing the action to proceed.
Access control is one of the most fundamental smart contract security patterns, and a missing or incorrectly implemented access control check — letting an unintended address call a privileged function — is a well-documented, recurring root cause behind several real exploits. See Kaavon's "How to Verify a Smart Contract Before Interacting" guide for how to check a contract's access control before trusting it.
Examples
- A missing or incorrectly implemented access control check, letting an unintended address call a privileged function, is a well-documented, recurring root cause behind real smart contract exploits.
- Access control typically restricts privileged functions — like pausing a contract or withdrawing funds — to a specific owner address or a defined set of permitted roles.