> ## Documentation Index
> Fetch the complete documentation index at: https://docs.layerzero.network/llms.txt
> Use this file to discover all available pages before exploring further.

# RBAC Reference

> Complete role definitions and function mappings across Nexus, modules, NexusERC20, and NexusERC20Guard.

Multi-Asset OFT distributes roles across four contract boundaries: the Nexus OApp, the external modules, the token (`NexusERC20`), and the guard (`NexusERC20Guard`). All role management uses `AccessControl2StepUpgradeable` with two-step admin transfer.

## Nexus

| Role                             | Source                                | Used For                                                                                                                                                                            |
| -------------------------------- | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `DEFAULT_ADMIN_ROLE`             | `AccessControl2StepUpgradeable`       | `setPeer`, `setEnforcedOptions`, `setMsgInspector`, `setFeeDeposit`, `setPauseModule`, `setFeeConfigModule`, `setRateLimiterModule`, `setCreditRedirectConfig`, delegate operations |
| `TOKEN_REGISTRAR_ROLE`           | `OFTRegistryRBACUpgradeable`          | `registerToken`, `deregisterToken`                                                                                                                                                  |
| `MESSAGING_CHANNEL_MANAGER_ROLE` | `OAppMessagingChannelRBACUpgradeable` | `clear`, `skip`, `burn` (non-reversible channel ops)                                                                                                                                |
| `MESSAGE_NILIFIER_ROLE`          | `OAppMessagingChannelRBACUpgradeable` | `nilify` (reversible; can be re-verified)                                                                                                                                           |

<Info>
  Module roles (`FEE_CONFIG_MANAGER_ROLE`, `PAUSER_ROLE`, `UNPAUSER_ROLE`, `RATE_LIMITER_MANAGER_ROLE`) are also granted on Nexus but consumed by the modules via `onlyNexusRole` / `_checkRole`.
</Info>

<Warning>
  `DEFAULT_ADMIN_ROLE` is synchronized with `delegate`. The `setDelegate` function always reverts.
</Warning>

## NexusOFT

**No roles.** Access is restricted by the `onlyNexus` modifier — only the Nexus contract can call `nexusReceive`.

## Nexus Fee Config Module

| Role                      | Source                                                 | Used For    |
| ------------------------- | ------------------------------------------------------ | ----------- |
| `FEE_CONFIG_MANAGER_ROLE` | Declared locally, checked on Nexus via `onlyNexusRole` | `setFeeBps` |

## Nexus Pause Module

| Role            | Source                                              | Used For                                                   |
| --------------- | --------------------------------------------------- | ---------------------------------------------------------- |
| `PAUSER_ROLE`   | Declared locally, checked on Nexus via `_checkRole` | `setPaused` (when pausing or strengthening a pause config) |
| `UNPAUSER_ROLE` | Declared locally, checked on Nexus via `_checkRole` | `setPaused` (when unpausing, weakening, or no-op)          |

## Nexus Rate Limiter Module

| Role                        | Source                                                 | Used For                                                                                                                                      |
| --------------------------- | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| `RATE_LIMITER_MANAGER_ROLE` | Declared locally, checked on Nexus via `onlyNexusRole` | `setRateLimitGlobalConfig`, `setRateLimitConfigs`, `setRateLimitStates`, `setRateLimitAddressExemptions`, `checkpointRateLimits`, `setScales` |

## NexusERC20

| Role                 | Source                          | Used For                   |
| -------------------- | ------------------------------- | -------------------------- |
| `DEFAULT_ADMIN_ROLE` | `AccessControl2StepUpgradeable` | `setGuard`, `recoverFunds` |
| `MINTER_ROLE`        | Declared locally                | `mint`                     |
| `BURNER_ROLE`        | Declared locally                | `burn`                     |

## NexusERC20Guard

| Role                 | Source                          | Used For                                                                                         |
| -------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------ |
| `DEFAULT_ADMIN_ROLE` | `AccessControl2StepUpgradeable` | Admin transfer, set allowlist mode                                                               |
| `BLACKLISTER_ROLE`   | `AllowlistRBACUpgradeable`      | Blacklist addresses                                                                              |
| `WHITELISTER_ROLE`   | `AllowlistRBACUpgradeable`      | Whitelist addresses                                                                              |
| `PAUSER_ROLE`        | `PauseByIDRBACUpgradeable`      | `setDefaultPaused` (when pausing), `setPaused` (when effectively pausing by token address as ID) |
| `UNPAUSER_ROLE`      | `PauseByIDRBACUpgradeable`      | `setDefaultPaused` (when unpausing), `setPaused` (when effectively unpausing or no-op)           |

## Role Separation Principles

* **Module swapping vs module configuration** — Only `DEFAULT_ADMIN_ROLE` can change which module contract is active. Module-specific roles (`FEE_CONFIG_MANAGER_ROLE`, `PAUSER_ROLE`, etc.) can only configure the current module.
* **Pause / Unpause** — Split across two roles. A compromised pauser key can halt transfers (disruptive, but funds remain safe) but cannot re-enable them.
* **Token registration** — Separate from admin. `TOKEN_REGISTRAR_ROLE` cannot change module addresses or grant other roles.
* **Nexus roles vs guard roles** — Module roles live on the Nexus contract. Guard roles (allowlist, token-level pause) live on the guard contract. These are independent access control hierarchies.
* **Fee configuration vs fee collection** — `FEE_CONFIG_MANAGER_ROLE` sets BPS rates. Fees are pushed to `feeDeposit` automatically — there is no withdrawal function.
* **Messaging channel manager / Message nilifier** — `clear`, `skip`, and `burn` are permanent; `nilify` can be reversed by re-verification. Lets operational wallets unblock or ignore messages without sharing the admin delegate.

## Next Steps

* [NexusERC20](/v2/developers/evm/multi-asset-oft/nexus-erc20) for token-level behavior and guard details
* [Modules](/v2/developers/evm/multi-asset-oft/modules) for fee, pause, and rate limiter configuration
* [Security and Compliance](/v2/developers/evm/multi-asset-oft/security-compliance) for operational security recommendations