feat: Add access control pattern analysis rule (CP-116) for privilege escalation vectors

[Nanle-code]

Overview

ChainProof currently has no rule for detecting broken access control patterns — one of the most common and highest-impact vulnerability classes in smart contracts. The existing CP-115 rule only covers tx.origin misuse, but there are many broader patterns that lead to unauthorized privilege escalation.

Vulnerability Patterns to Detect

1. Missing Access Control on Sensitive Functions

// No modifier or msg.sender check — anyone can call
function setOwner(address newOwner) external {
    owner = newOwner;
}

2. Unprotected Initialization Functions

bool initialized;
function initialize(address admin) external {
    owner = admin;
}

3. Role Assignment Without Sender Verification

function grantRole(bytes32 role, address account) external {
    roles[account] = role; // no check that msg.sender has the authority to grant
}

4. Delegatecall to User-Supplied Address

function execute(address target, bytes calldata data) external {
    target.delegatecall(data); // attacker controls target
}

Proposed Rule: CP-116

Detection heuristics via AST analysis:

1. Sensitive function naming heuristic — functions named set*, update*, initialize*, upgrade*, withdraw*, mint*, burn* that have no onlyOwner-style modifier and no require(msg.sender == ...) guard
2. Unchecked role grant — assignment to a mapping that stores roles without verifying caller has the admin role
3. Delegatecall to input address — any delegatecall where the target is a function parameter

Acceptance Criteria

• CP-116 rule implemented in packages/core/src/rules/swc116-access-control.ts
• All 4 patterns above detected with appropriate severity (High or Critical)
• Heuristic-based modifier detection (look for existing onlyOwner, onlyAdmin, onlyRole style modifiers and check if they are applied)
• False positive suppression for OpenZeppelin Ownable pattern (detected via import heuristic)
• VulnerableVault.sol extended with access control examples
• SecureVault.sol extended with corresponding fixes

References

• SWC-105 — Unprotected Ether Withdrawal
• SWC-106 — Unprotected SELFDESTRUCT
• Rekt News — Top Access Control Incidents