# Aave V3 ACL Manager Contract

The Access Control List Manager (`ACLManager`) is the main registry of system roles and permissions.

The Aave Protocol implements an access control list to segregate powers and/or benefits that can be allocated to different entities on the protocol. The `ACL_MANAGER` contract is managed by the [`PoolAddressesProvider`](./pool-addresses-provider) contract.

`ACLManager` keeps track of the individual roles and its holders, and allows a _Role Admin_ to manage roles. _Role Admin_ is itself a role that is managed by the `DEFAULT_ADMIN_ROLE`.

The `DEFAULT_ADMIN_ROLE` is held by the [`ACL_ADMIN`](#acl-admin), and should be initialized in the [`PoolAddressesProvider`](./pool-addresses-provider) beforehand.

The source code is available on [GitHub](https://github.com/aave-dao/aave-v3-origin/blob/main/src/contracts/protocol/configuration/ACLManager.sol).

## Roles

Below we outline the responsibilities/powers of the roles and the specific methods that are only accessible to the holders of these roles.

The [`FLASH_BORROWER`](#flash-borrower) and [`BRIDGE`](#bridge) roles have few direct responsibilities and can primarily access specific features of the protocol, while `ADMIN` roles have the power and responsibility to handle risk or configuration parameters.

### FLASH_BORROWER

Holders of this role will have the premium on flash loans waived (this does not include the simple flash loan).

**Methods Accessible:**

[`Pool`](./pool):

- [`flashLoan()`](./pool#flashloan)

### BRIDGE

Deprecated. Since Aave V3.4 this role grants no access: `mintUnbacked()` and `backUnbacked()` were removed from the `Pool`. `ACLManager` still exposes `BRIDGE_ROLE`, `addBridge()`, `removeBridge()` and `isBridge()`.

### ASSET_LISTING_ADMIN

Holders of this role can:

- Update asset oracle sources and the fallback oracle.
- Add new assets to the Aave market.

**Methods Accessible:**

[`AaveOracle`](./oracles):

- [`setAssetSources()`](./oracles#setassetsources)
- [`setFallbackOracle()`](./oracles#setfallbackoracle)

[`PoolConfigurator`](./pool-configurator):

- [`initReserves()`](./pool-configurator#initreserves)

### RISK_ADMIN

Holders of this role can:

- Update reserve parameters such as reserve factor, caps, E-Mode category, borrowing enabled, freeze/unfreeze, LTV, liquidation threshold, liquidation bonus (cannot pause/unpause or activate/deactivate a reserve).
- Create new and update existing E-Mode categories (not category 0), including their isolated flag.
- Update the liquidation protocol fee.

**Methods Accessible:**

[`PoolConfigurator`](./pool-configurator):

- [`setReserveBorrowing()`](./pool-configurator#setreserveborrowing)
- [`configureReserveAsCollateral()`](./pool-configurator#configurereserveascollateral)
- [`setReserveFreeze()`](./pool-configurator#setreservefreeze)
- [`setReserveFactor()`](./pool-configurator#setreservefactor)
- [`setBorrowCap()`](./pool-configurator#setborrowcap)
- [`setSupplyCap()`](./pool-configurator#setsupplycap)
- [`setLiquidationProtocolFee()`](./pool-configurator#setliquidationprotocolfee)
- [`setEModeCategory()`](./pool-configurator#setemodecategory)
- [`setAssetCollateralInEMode()`](./pool-configurator#setassetcollateralinemode)
- [`setAssetBorrowableInEMode()`](./pool-configurator#setassetborrowableinemode)
- [`setEModeCategoryIsolated()`](./pool-configurator#setemodecategoryisolated)
- `setReserveLtvzero()`
- `setAssetLtvzeroInEMode()`
- [`setReserveInterestRateData()`](./pool-configurator#setreserveinterestratedata)
- [`setReserveFlashLoaning()`](./pool-configurator#setreserveflashloaning)

### ACL_ADMIN

Holders of this role manage the role admins in the `ACLManager`. The `DEFAULT_ADMIN_ROLE` is held by the `ACL_ADMIN`, and should be initialized in the `PoolAddressesProvider` beforehand.

**Methods Accessible:**

[`ACLManager`](./acl-manager):

- [`setRoleAdmin()`](#setroleadmin)
- [`addPoolAdmin()`](#addpooladmin)
- [`removePoolAdmin()`](#removepooladmin)
- [`addEmergencyAdmin()`](#addemergencyadmin)
- [`removeEmergencyAdmin()`](#removeemergencyadmin)
- [`addRiskAdmin()`](#addriskadmin)
- [`removeRiskAdmin()`](#removeriskadmin)
- [`addFlashBorrower()`](#addflashborrower)
- [`removeFlashBorrower()`](#removeflashborrower)
- `addBridge()`
- `removeBridge()`
- [`addAssetListingAdmin()`](#addassetlistingadmin)
- [`removeAssetListingAdmin()`](#removeassetlistingadmin)

### EMERGENCY_ADMIN

Holders of this role can pause and unpause the pool or an individual reserve.

**Methods Accessible:**

[`PoolConfigurator`](./pool-configurator):

- [`setReservePause()`](./pool-configurator#setreservepause)
- [`setPoolPause()`](./pool-configurator#setpoolpause)
- [`setReserveFreeze()`](./pool-configurator#setreservefreeze)
- [`disableLiquidationGracePeriod()`](./pool-configurator#disableliquidationgraceperiod)
- [`setEModeCategoryIsolated()`](./pool-configurator#setemodecategoryisolated)
- `setReserveLtvzero()`
- `setAssetLtvzeroInEMode()`

### POOL_ADMIN

Holders of this role can update token implementations, (un)pause and (de)activate reserves, update premiums along with everything the [`ASSET_LISTING_ADMIN`](#asset-listing-admin) and [`RISK_ADMIN`](#risk-admin) can do.

All deployers have resigned their [`POOL_ADMIN`](#pool-admin) roles. All instances of the [`POOL_ADMIN`](#pool-admin) role, across all V3 networks, are now governed by the [Guardians multisig](/ecosystem/governance#guardians) or by the [Governance Bridge executors](https://github.com/aave/governance-crosschain-bridges).

**Methods Accessible:**

All methods accessible to `ASSET_LISTING_ADMIN`.

All methods accessible to `RISK_ADMIN`.

[`AToken`](./tokenization):

- [`rescueTokens()`](./tokenization#rescuetokens)

[`Pool`](./pool):

- [`rescueTokens()`](./pool#rescuetokens)

[`PoolConfigurator`](./pool-configurator):

- [`updateAToken()`](./pool-configurator#updateatoken)
- [`updateVariableDebtToken()`](./pool-configurator#updatevariabledebttoken)
- [`setReserveActive()`](./pool-configurator#setreserveactive)
- [`updateFlashloanPremium()`](./pool-configurator#updateflashloanpremium)
- [`setReserveInterestRateData()`](./pool-configurator#setreserveinterestratedata)

## Write Methods

### setRoleAdmin

```solidity
function setRoleAdmin(bytes32 role, bytes32 adminRole) external override onlyRole(DEFAULT_ADMIN_ROLE)
```

Sets `adminRole` as the admin of `role`. By default, the `adminRole` for all roles is [`DEFAULT_ADMIN_ROLE`](#acl-admin).

> [!NOTE]
> Only callable by an address with [`DEFAULT_ADMIN_ROLE`](#acl-admin).

**Input Parameters:**

| Name      | Type      | Description                                                                                                                                                                         |
| :-------- | :-------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **role**  | `bytes32` | The role to be managed by the admin role - keccak256 hash of one of the following: `POOL_ADMIN`, `EMERGENCY_ADMIN`, `RISK_ADMIN`, `FLASH_BORROWER`, `BRIDGE`, `ASSET_LISTING_ADMIN` |
| **adminRole** | `bytes32` | The admin role. 0x00 is reserved for the `DEFAULT_ADMIN_ROLE`                                                                                                                       |

### addPoolAdmin

```solidity
function addPoolAdmin(address admin) external override
```

Adds a new `admin` as _Pool Admin_. The address is added to the list of members with the [`POOL_ADMIN`](#pool-admin) role. Holders of this role can update token implementations, (un)pause and (de)activate reserves, update premiums and do everything the [`ASSET_LISTING_ADMIN`](#asset-listing-admin) and [`RISK_ADMIN`](#risk-admin) can do.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`POOL_ADMIN`](#pool-admin) role, set
> by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                             |
| :---- | :-------- | :------------------------------------------------------ |
| **admin** | `address` | The address which will be granted the `POOL_ADMIN` role |

### removePoolAdmin

```solidity
function removePoolAdmin(address admin) external override
```

Removes an `admin` as _Pool Admin_. The given address is removed from the list of members with the [`POOL_ADMIN`](#pool-admin) role.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`POOL_ADMIN`](#pool-admin) role, set
> by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                             |
| :---- | :-------- | :---------------------------------------------------------------------- |
| **admin** | `address` | The address for which the `POOL_ADMIN` role permissions will be removed |

### addEmergencyAdmin

```solidity
function addEmergencyAdmin(address admin) external override
```

Adds a new `admin` as an _Emergency Admin_. The address is added to the list of members with the [`EMERGENCY_ADMIN`](#emergency-admin) role. Holders of this role can pause and unpause the pool or an individual reserve.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`EMERGENCY_ADMIN`](#emergency-admin)
> role, set by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                  |
| :---- | :-------- | :----------------------------------------------------------- |
| **admin** | `address` | The address which will be granted the `EMERGENCY_ADMIN` role |

### removeEmergencyAdmin

```solidity
function removeEmergencyAdmin(address admin) external override
```

Removes an `admin` as _Emergency Admin_. The given address is removed from the list of members with the [`EMERGENCY_ADMIN`](#emergency-admin) role.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`EMERGENCY_ADMIN`](#emergency-admin)
> role, set by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                                  |
| :---- | :-------- | :--------------------------------------------------------------------------- |
| **admin** | `address` | The address for which the `EMERGENCY_ADMIN` role permissions will be removed |

### addRiskAdmin

```solidity
function addRiskAdmin(address admin) external override
```

Adds a new `admin` as a _Risk Admin_. The address is added to the list of members with the [`RISK_ADMIN`](#risk-admin) role. Holders of this role can update reserve params, liquidation fee and E-Mode categories.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`RISK_ADMIN`](#risk-admin) role, set
> by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                             |
| :---- | :-------- | :------------------------------------------------------ |
| **admin** | `address` | The address which will be granted the `RISK_ADMIN` role |

### removeRiskAdmin

```solidity
function removeRiskAdmin(address admin) external override
```

Removes an `admin` as _Risk Admin_. The given address is removed from the list of members with the [`RISK_ADMIN`](#risk-admin) role.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`RISK_ADMIN`](#risk-admin) role, set
> by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                             |
| :---- | :-------- | :---------------------------------------------------------------------- |
| **admin** | `address` | The address for which the `RISK_ADMIN` role permissions will be removed |

### addFlashBorrower

```solidity
function addFlashBorrower(address borrower) external override
```

Adds a new `borrower` address as _Flash Borrower_. The address is added to the list of members with the [`FLASH_BORROWER`](#flash-borrower) role. Holders of this role do not pay premium for flash loan (does not apply to `flashLoanSimple`).

> [!NOTE]
> Only callable by the _Role Admin_ of the [`FLASH_BORROWER`](#flash-borrower)
> role, set by _Aave Governance_.

**Input Parameters:**

| Name     | Type      | Description                                                 |
| :------- | :-------- | :---------------------------------------------------------- |
| **borrower** | `address` | The address which will be granted the `FLASH_BORROWER` role |

### removeFlashBorrower

```solidity
function removeFlashBorrower(address borrower) external override
```

Removes `borrower` as _Flash Borrower_. The given `borrower` address is removed from the list of members with the [`FLASH_BORROWER`](#flash-borrower) role.

> [!NOTE]
> Only callable by the _Role Admin_ of the [`FLASH_BORROWER`](#flash-borrower)
> role, set by _Aave Governance_.

**Input Parameters:**

| Name     | Type      | Description                                                                 |
| :------- | :-------- | :-------------------------------------------------------------------------- |
| **borrower** | `address` | The address for which the `FLASH_BORROWER` role permissions will be removed |

### addAssetListingAdmin

```solidity
function addAssetListingAdmin(address admin) external override
```

Adds a new `admin` as _Asset Listing Admin_. The address is added to the list of members with the [`ASSET_LISTING_ADMIN`](#asset-listing-admin) role. Holders of this role can update oracles and add new assets to the Aave market.

> [!NOTE]
> Only callable by the _Role Admin_ of the
> [`ASSET_LISTING_ADMIN`](#asset-listing-admin) role, set by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                  |
| :---- | :-------- | :----------------------------------------------------------- |
| **admin** | `address` | The address which will be granted `ASSET_LISTING_ADMIN` role |

### removeAssetListingAdmin

```solidity
function removeAssetListingAdmin(address admin) external override
```

Removes an `admin` as _Asset Listing Admin_. The given address is removed from the list of members with the [`ASSET_LISTING_ADMIN`](#asset-listing-admin) role.

> [!NOTE]
> Only callable by the _Role Admin_ of the
> [`ASSET_LISTING_ADMIN`](#asset-listing-admin) role, set by _Aave Governance_.

**Input Parameters:**

| Name  | Type      | Description                                                                  |
| :---- | :-------- | :--------------------------------------------------------------------------- |
| **admin** | `address` | The address for which `ASSET_LISTING_ADMIN` role permissions will be removed |

## View Methods

### isPoolAdmin

```solidity
function isPoolAdmin(address admin) external view override returns (bool)
```

Returns `true` if the address has the [`POOL_ADMIN`](#pool-admin) role, `false` otherwise.

**Input Parameters:**

| Name  | Type      | Description          |
| :---- | :-------- | :------------------- |
| **admin** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                    |
| :----- | :------------------------------------------------------------- |
| `bool` | `true` if the given address is `POOL_ADMIN`, `false` otherwise |

### isEmergencyAdmin

```solidity
function isEmergencyAdmin(address admin) external view override returns (bool)
```

Returns `true` if the address has the [`EMERGENCY_ADMIN`](#emergency-admin) role, `false` otherwise.

**Input Parameters:**

| Name  | Type      | Description          |
| :---- | :-------- | :------------------- |
| **admin** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                         |
| :----- | :------------------------------------------------------------------ |
| `bool` | `true` if the given address is `EMERGENCY_ADMIN`, `false` otherwise |

### isRiskAdmin

```solidity
function isRiskAdmin(address admin) external view override returns (bool)
```

Returns `true` if the address has the [`RISK_ADMIN`](#risk-admin) role, `false` otherwise.

**Input Parameters:**

| Name  | Type      | Description          |
| :---- | :-------- | :------------------- |
| **admin** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                    |
| :----- | :------------------------------------------------------------- |
| `bool` | `true` if the given address is `RISK_ADMIN`, `false` otherwise |

### isFlashBorrower

```solidity
function isFlashBorrower(address borrower) external view override returns (bool)
```

Returns `true` if the address has the [`FLASH_BORROWER`](#flash-borrower) role, `false` otherwise.

**Input Parameters:**

| Name     | Type      | Description          |
| :------- | :-------- | :------------------- |
| **borrower** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                        |
| :----- | :----------------------------------------------------------------- |
| `bool` | `true` if the given address is `FLASH_BORROWER`, `false` otherwise |

### isBridge

```solidity
function isBridge(address bridge) external view override returns (bool)
```

Returns `true` if the address has [`BRIDGE`](#bridge) role, `false` otherwise.

**Input Parameters:**

| Name   | Type      | Description          |
| :----- | :-------- | :------------------- |
| **bridge** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                |
| :----- | :--------------------------------------------------------- |
| `bool` | `true` if the given address is `BRIDGE`, `false` otherwise |

### isAssetListingAdmin

```solidity
function isAssetListingAdmin(address admin) external view override returns (bool)
```

Returns `true` if the address has the [`ASSET_LISTING_ADMIN`](#asset-listing-admin) role, `false` otherwise.

**Input Parameters:**

| Name  | Type      | Description          |
| :---- | :-------- | :------------------- |
| **admin** | `address` | The address to check |

**Return Values:**

| Type   | Description                                                             |
| :----- | :---------------------------------------------------------------------- |
| `bool` | `true` if the given address is `ASSET_LISTING_ADMIN`, `false` otherwise |