Who Can Call What? (Reachability Analysis)

Why this matters

Half of access-control bugs are not 'the modifier is wrong' but 'the function is public when nobody noticed'. Reachability analysis enumerates: for every state-changing function in the contract, which addresses can call it, under what conditions, with what arguments. Done systematically, it catches the 'I thought this was internal' class on the first pass.

Demo

Tools: Slither's function-summary printer dumps callers + permissions. Manual: grep -E 'function .* (public|external)' then for each, ask 'what's the gate?'. Most production bugs live in functions where the answer to that question is 'nothing'.

Try it yourself

1. REPRODUCE — pick a small Solidity contract. Run slither <repo> --print function-summary. Inspect the access matrix.
2. PATCH — find one function that should have been internal/restricted but isn't. Tighten access. Test that the previous caller still works for the intended path and fails for the unintended.
3. VERIFY — add an access-control invariant: 'only addresses with role X can decrement balanceOf(victim)'.

References

• Slither — function-summary printer
• OpenZeppelin AccessControl