Access control

Every state-changing function in the protocol and who may call it. Generated from the per-contract references; the per-function pages carry the full behavior.

PermanentCollection

Function	Access
recordAcquisition	patron-only (msg.sender must equal the wired patron address, else NotPatron)
markCustody	returnAuctionModule-only (msg.sender must equal the wired returnAuctionModule address, else NotReturnAuction)
setWiring	deployer one-shot (OneTimeSetup gate: caller must be the constructor-time deployer, callable exactly once)

Patron

Function	Access
acceptBid	permissionless (owner pre-condition: the Punk must be listed
acceptListing	permissionless (listing pre-condition: the seller must be allowlisted
skimSurplus	permissionless
addAllowedSeller	admin-only (raw ProtocolAdmin.admin(); a lifetime carve-out that
removeAllowedSeller	admin-only (raw ProtocolAdmin.admin(); same lifetime carve-out as
setWiring	deployer one-shot (gated by OneTimeSetup; permanently closed after
receive	adapter-only (msg.sender must be liveBidAdapter)

ReturnAuctionModule

Function	Access
placeBid	permissionless
placeBidWithReferral	permissionless
settle	permissionless
withdrawRefund	permissionless
startSale	patron-only (msg.sender == patron, else NotPatron)
setLiveBidAdapter	deployer one-shot (msg.sender == deployer, once, else
setVaultBurnPool	deployer one-shot (msg.sender == deployer, once, else
receive	escrow-only (msg.sender == address(escrow), else TransferFailed)

ReturnAuctionEscrow

Function	Access
listForSettlement	module-only (MODULE, the deploying ReturnAuctionModule; any other caller reverts NotModule)
sweepProceeds	module-only (any other caller reverts NotModule)
receive	market-only (only the CryptoPunks market; any other sender reverts UnexpectedEtherSender)

PunkVault

Function	Access
receivePunk	returnAuctionModule-only (NotReturnAuction for any other caller)
mintProofs	returnAuctionModule-only (NotReturnAuction for any other caller)
mintToAuction	titleAuction-only (NotTitleAuction for any other caller)
setTitleAuction	deployer one-shot (NotDeployer for others; TitleAuctionAlreadySet
setRendererRegistry	deployer one-shot (NotDeployer for others;
renounceOwnership	owner-only (NotOwner for any other caller)
approve	permissionless (token owner or an isApprovedForAll operator; solmate
setApprovalForAll	permissionless (sets the caller's own operator flag)
transferFrom	permissionless (owner, approved spender, or operator of id)
safeTransferFrom	permissionless (owner, approved spender, or operator of id)
safeTransferFrom	permissionless (owner, approved spender, or operator of id)

LiveBidAdapter

Function	Access
sweep	permissionless
streamForward	permissionless (implements IPreSwapStream; designed to be called by the official pool's hook in _beforeSwap, but anyone may call)
contribute	permissionless, payable
poolReplenish	module-only (msg.sender must equal returnAuctionModule; anyone else reverts NotReturnAuction)
setMaxSweepWei	admin-only (ProtocolAdmin.checkAdmin; subject to the 1-year auto-lock, no carve-out)
setMinBlocksBetweenSweeps	admin-only (ProtocolAdmin.checkAdmin; subject to the 1-year auto-lock, no carve-out)
setActivationThreshold	admin-only carve-out (raw ProtocolAdmin.admin(), ignoring the 1-year timer; live until the role is burned via transferAdmin(address(0)))
receive	permissionless

BuybackBurner

Function	Access
executeStep	permissionless
setup	deployer one-shot, gated by OneTimeSetup (original deployer only, before finalization)
setMinBlocksBetweenSteps	admin-only, ProtocolAdmin.checkAdmin(msg.sender); locks at the 1-year admin expiry
setMaxStepWei	admin-only, ProtocolAdmin.checkAdmin(msg.sender); locks at the 1-year admin expiry
unlockCallback	PoolManager-only, reverts NotPoolManager for any other caller
receive	permissionless, accepts ETH from any sender

VaultBurnPool

Function	Access
sweep	returnAuctionModule-only (any other caller reverts NotReturnAuctionModule)
setup	deployer one-shot (onlySetup: deployer-only until finalized, then closed forever)
receive	permissionless

ProtocolFeePhaseAdapter

Function	Access
sweep	permissionless
receive	permissionless

ReferralPayout

Function	Access
claim	permissionless
claimFor	permissionless
notify	hook-only (the immutable hook address set at construction; every other caller reverts Unauthorized)
receive	permissionless

PunkVaultTitleAuction

Function	Access
bid	permissionless (payable)
settle	permissionless
kickoff	permissionless, gated on the collected-trait threshold
mintTitle	permissionless, idempotent
withdrawRefund	permissionless, pays msg.sender's own queued refund
withdrawProceeds	permissionless, funds always go to the credited recipient
withdrawProceeds	permissionless, pays msg.sender's own credit

PCSwapContext

Function	Access
enterSwap	extension-only (msg.sender must equal the current authorizedExtension, which must be non-zero; otherwise reverts NotAuthorizedExtension)
exitSwap	extension-only (same gate as enterSwap)
setAuthorizedExtension	owner-only (reverts NotOwner otherwise; reverts AuthorizedExtensionAlreadyLocked after the lock)
lockAuthorizedExtension	owner-only (reverts NotOwner otherwise; reverts AuthorizedExtensionAlreadyLocked if already locked)
transferOwnership	owner-only (reverts NotOwner otherwise)

TokenAdminPoker

Function	Access
setup	owner-only, one-shot (reverts AlreadySetup on a second call)
bindExtension	owner-only (reverts NotOwner otherwise; reverts NotSetup before setup)
lockExtension	owner-only (reverts NotOwner otherwise; reverts NotSetup before setup)
setHookMaxReferralBps	two-key (either owner or the current ProtocolAdmin.admin() EOA; all other callers revert NotAuthorized; reverts NotSetup before setup)
setTokenTaxBps	two-key (either owner or the current ProtocolAdmin.admin() EOA; all other callers revert NotAuthorized; reverts NotSetup if the token isn't pinned yet)
transferOwnership	owner-only (reverts NotOwner otherwise)

ProtocolAdmin

Function	Access
transferAdmin	admin-only (msg.sender must equal the current admin; any other caller reverts NotAdmin)

RendererRegistry

Function	Access
setImplementation	admin-only (ProtocolAdmin.checkAdmin(msg.sender) must be true, so the caller must hold the admin role with its 1-year timer unexpired)
freeze	admin-only (ProtocolAdmin.checkAdmin(msg.sender)), one-way

PermanentCollectionMosaicRenderer

Function	Access
cacheTrait	permissionless

PunkSvgFragmentCache

Function	Access
cachePunk	permissionless

TraitIconCache

Function	Access
cacheTrait	permissionless