Skip to main content
Tokenized RWAs OFT distributes roles across four contract boundaries: the Nexus OApp, the external modules, the token (NexusERC20), and the guard (NexusERC20Guard). All role management uses AccessControl2StepUpgradeable with two-step admin transfer.

​
Nexus

Module roles (FEE_CONFIG_MANAGER_ROLE, PAUSER_ROLE, UNPAUSER_ROLE, RATE_LIMITER_MANAGER_ROLE) are also granted on Nexus but consumed by the modules via onlyNexusRole / _checkRole.
DEFAULT_ADMIN_ROLE is synchronized with delegate. The setDelegate function always reverts.

​
NexusOFT

No roles. Access is restricted by the onlyNexus modifier — only the Nexus contract can call nexusReceive.

​
Nexus Fee Config Module

​
Nexus Pause Module

​
Nexus Rate Limiter Module

​
NexusERC20

​
NexusERC20Guard

​
Role Separation Principles

  • Module swapping vs module configuration — Only DEFAULT_ADMIN_ROLE can change which module contract is active. Module-specific roles (FEE_CONFIG_MANAGER_ROLE, PAUSER_ROLE, etc.) can only configure the current module.
  • Pause / Unpause — Split across two roles. A compromised pauser key can halt transfers (disruptive, but funds remain safe) but cannot re-enable them.
  • Token registration — Separate from admin. TOKEN_REGISTRAR_ROLE cannot change module addresses or grant other roles.
  • Nexus roles vs guard roles — Module roles live on the Nexus contract. Guard roles (allowlist, token-level pause) live on the guard contract. These are independent access control hierarchies.
  • Fee configuration vs fee collection — FEE_CONFIG_MANAGER_ROLE sets BPS rates. Fees are pushed to feeDeposit automatically — there is no withdrawal function.

​
Next Steps