Writes

Every state-changing function in the protocol, and the permission required.

Anyone

solidity

// PloutoRevenueRouterfunction claimPonsFees() external returns (uint256 received);function routeUnallocatedRevenue() external returns (uint256 toBuybacks, uint256 toStakers, uint256 toReserve);function claimAndRoute() external returns (uint256 claimed, uint256 toBuybacks, uint256 toStakers, uint256 toReserve);

Permissionless because they can only move ETH toward the protocol along a fixed path. routeUnallocatedRevenue additionally requires the registry to be initialized and the router not to be paused.

Any token holder

solidity

// GravityStakingfunction stake(uint256 amount, uint64 lockDuration) external returns (uint256 positionId);

Requires an ERC-20 allowance, at least 1 PLOUTO, a lock of exactly 7 / 30 / 90 days, an initialized registry, and staking not paused.

Position owner only

solidity

function claim(uint256 positionId) external returns (uint256 amount);function claimMany(uint256[] calldata positionIds) external returns (uint256 amount);function withdraw(uint256 positionId) external returns (uint256 principal, uint256 rewards);function emergencyWithdraw(uint256 positionId) external returns (uint256 principal);

withdraw requires maturity. emergencyWithdraw requires emergencyMode == true and forfeits unclaimed rewards.

KEEPER_ROLE

solidity

// BuybackExecutorfunction executeBuyback(uint256 ethIn, uint256 minTokensOut, uint256 deadline)    external returns (uint256 tokensRetired); // PloutoRevenueRouterfunction sweepDonationsToReserve() external returns (uint256 amount);

That is the entire keeper surface. It cannot withdraw, reconfigure or grant anything.

Protocol-internal

solidity

function fundBuyback()     external payable;   // BuybackExecutor,  router onlyfunction notifyRewardETH() external payable;   // GravityStaking,   router onlyfunction depositRevenue()  external payable;   // PloutoReserve,    router only

Each reverts with NotRouter() for any other caller.

GOVERNOR_ROLE

solidity

// PloutoReservefunction proposeWithdrawal(address token, address recipient, uint256 amount, string calldata purpose)    external returns (uint256 id);function executeWithdrawal(uint256 id) external;

GUARDIAN_ROLE or GOVERNOR_ROLE

solidity

function cancelWithdrawal(uint256 id, string calldata reason) external;

PAUSER_ROLE

solidity

function pause() external;     // GravityStaking, BuybackExecutor, PloutoRevenueRouterfunction unpause() external;

EMERGENCY_ROLE

solidity

function setEmergencyMode(bool enabled) external;   // GravityStaking

Enabling also pauses staking.

DEFAULT_ADMIN_ROLE

solidity

function setRevenueRouter(address router) external;     // one-shot, all threefunction setSafetyParams(uint256 maxEth, uint256 shareBps, uint256 impactBps, uint256 minEth) external;function grantRole(bytes32 role, address account) external;function revokeRole(bytes32 role, address account) external;

Registry owner

solidity

function wireProtocol(address router, address staking, address buyback, address reserve) external;  // oncefunction setPloutoTokenOnce(address token, address curve) external;                                  // once, foreverfunction transferOwnership(address newOwner) external;   // Ownable2Stepfunction acceptOwnership() external;

What no role can do

Change BUYBACK_BPS, STAKER_BPS or RESERVE_BPS.
Withdraw staked principal belonging to someone else.
Move ETH out of the router except through the split or the donation sweep.
Make any contract call an arbitrary address with arbitrary calldata.
Mint PLOUTO.