Roles & Access Control

Every role in the Kasu system, system-wide and per pool, what each one may call, and how KasuController grants and revokes them.

All roles are managed through the KasuController contract using OpenZeppelin's AccessControl. Each address can hold multiple roles, and a single address may fill several roles for a given lending pool.

System Roles#

Role	Scope	Description
Kasu Contract Upgrader	System	Owner of per-proxy ProxyAdmin contracts. Can upgrade all contract implementations.
Kasu Admin	System	`DEFAULT_ADMIN_ROLE`. Manages system-wide settings, grants/revokes all roles, manages allowlist, pauses the system.
Pool Creator	System	`ROLE_LENDING_POOL_CREATOR`. Creates new lending pools via `LendingPoolManager.createPool()`. Acts as Pool Admin at creation time.
Protocol Fee Claimer	System	`ROLE_PROTOCOL_FEE_CLAIMER`. Claims accrued protocol fees from the Fee Manager.

Lending Pool Roles#

These roles are granted per lending pool by the Pool Admin via KasuController.grantLendingPoolRole().

Role	Hash	Description
Pool Admin	`0xa1ae6eec...`	Grants pool-specific roles (Pool Manager, Pool Funds Manager, Pool Clearing Manager). Sets Draw Recipient.
Pool Manager	`0x3e891da8...`	Manages pool parameters: tranche ratios, interest rates, draw amounts, deposit limits, excess liquidity. Can force withdrawals, cancel requests, and stop the pool.
Pool Funds Manager	`0x3329bd6c...`	Manages pool finances: repays owed funds, reports/repays losses, deposits/withdraws First Loss Capital.
Pool Clearing Manager	`0xe9bdd900...`	Executes clearing for the lending pool each epoch via `LendingPoolManager.doClearing()`.

User Roles#

Role	Requirements	Functions
Liquidity Provider	Must pass KYC or be manually allowlisted	`requestDeposit`, `cancelDepositRequest`, `requestWithdrawal`, `cancelWithdrawalRequest`, `claimLoss`, `requestFixedTermDepositWithdrawal`
KSU Locker	No KYC required. Must hold KSU tokens	`KSULocking.lock`, `lockWithPermit`, `unlock`, `claimFees`

Public Functions#

Anyone can call these functions:

Function	Contract	Purpose
`updateKsuEpochTokenPrice()`	`SystemVariables`	Update KSU token price for the current epoch from oracle
`batchCalculateUserLoyaltyLevels()`	`UserManager`	Calculate loyalty levels for all users for the current epoch
`batchMintLossTokens()`	`LendingPoolTranche`	Mint unrealized loss tokens to affected LPs after a loss is reported
`emitFees()`	`KSULocking`	Distribute accrued ecosystem fees to KSU lockers

Kasu Admin Functions#

Function	Contract	Purpose
`grantRole()` / `revokeRole()`	`KasuController`	Grant or revoke system roles
`pause()` / `unpause()`	`KasuController`	Pause or unpause the entire Kasu system
`allowUser()` / `disallowUser()`	`KasuAllowList`	Manually add/remove addresses from the KYC allowlist
`blockUser()` / `unblockUser()`	`KasuAllowList`	Block/unblock addresses (overrides allowlist)
`setPerformanceFee()`	`SystemVariables`	Set the performance fee percentage
`setFeeRates()`	`SystemVariables`	Set the ecosystem/protocol fee split
`setLoyaltyThresholds()`	`SystemVariables`	Set loyalty level thresholds
`setMaxTrancheInterestRate()`	`SystemVariables`	Set maximum allowed tranche interest rate
`setDefaultTrancheInterestChangeEpochDelay()`	`SystemVariables`	Set default delay for interest rate changes
`setUserCanOnlyDepositToJuniorTrancheWhenHeHasRKSU()`	`SystemVariables`	Require rKSU for Junior tranche deposits
`updateTrancheInterestRateChangeEpochDelay()`	`LendingPoolManager`	Override interest rate change delay for a pool
`addLockPeriod()`	`KSULocking`	Add new lock period with multipliers
`setKSULockBonus()`	`KSULocking`	Set the bonus KSU wallet for the locking program
`emergencyWithdraw()`	`KSULocking`	Forcibly unlock all users' KSU positions