The auth modifier of AccessControl.sol doesnt work as you would expect.
It checks if you are authorized for msg.sig. However, msg.sig is the signature of the first function you have called (not the current function). So, if you call function A, which calls function B, the auth modifier of function B checks if you are authorized for function A!
There is a difference between external and public functions. For external functions, this works as expected because a fresh call (with a new msg.sig) is always made.
However, with public functions called from within the same contract, this doesnt happen as the problem described above occurs.
See the issue page for proof of concept, which shows the problem. In the code, several functions have public and auth combined; see also in the proof of concept.
In the current codebase, I couldnt find a problem situation; however, this could be accidentally introduced with future changes.
It could also be introduced via the _moduleCall of Ladle.sol, which allows functions to be defined which might call the public functions.
See issue #4 page for proof of concept and a list of occurrences of public auth.
Recommend making sure all auth functions use external (still error-prone)
Or, recommend changing the modifier to something like:
albertocuestacanada (Yield) confirmed:
