Vulnerability: EOPBCTemplate - permission documentation inconsistencies
Severity: high

Description:
Undocumented\\nThe template documentation provides an overview of the permissions set with the template. The following permissions are set by the template contract but are not documented in the accompanied `fundraising/templates/externally_owned_presale_bonding_curve/README.md`.\\nTokenManager\\n```\\n\\_createPermissions(\\_acl, grantees, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.MINT\\_ROLE(), \\_owner);\\n\\_acl.createPermission(\\_fundraisingApps.marketMaker, \\_fundraisingApps.bondedTokenManager, \\_fundraisingApps.bondedTokenManager.BURN\\_ROLE(), \\_owner);\\n```\\n\\ncode/fundraising/templates/externally_owned_presale_bonding_curve/eopbc.yaml:L33-L44\\n```\\n- app: anj-token-manager\\n  role: MINT\\_ROLE\\n  grantee: market-maker\\n  manager: owner\\n- app: anj-token-manager\\n  role: MINT\\_ROLE\\n  grantee: presale\\n  manager: owner\\n- app: anj-token-manager\\n  role: BURN\\_ROLE\\n  grantee: market-maker\\n  manager: owner\\n```\\n\\nInconsistent\\nThe following permissions are set by the template but are inconsistent to the outline in the documentation:\\nController\\n`owner` has the following permissions even though they are documented as not being set https://github.com/ConsenSys/aragonone-presale-audit-2019-11/blob/9ddae8c7fde9dea3af3982b965a441239d81f370/code/fundraising/templates/externally_owned_presale_bonding_curve/README.md#controller.\\n```\\n| App        | Permission                            | Grantee | Manager |\\n| ---------- | ------------------------------------- | ------- | ------- |\\n| Controller | UPDATE_BENEFICIARY                    | NULL    | NULL    |\\n| Controller | UPDATE_FEES                           | NULL    | NULL    |\\n| Controller | ADD_COLLATERAL_TOKEN                  | Owner   | Owner   |\\n| Controller | REMOVE_COLLATERAL_TOKEN               | Owner   | Owner   |\\n| Controller | UPDATE_COLLATERAL_TOKEN               | Owner   | Owner   |\\n| Controller | UPDATE_MAXIMUM_TAP_RATE_INCREASE_PCT  | NULL    | NULL    |\\n| Controller | UPDATE_MAXIMUM_TAP_FLOOR_DECREASE_PCT | NULL    | NULL    |\\n| Controller | ADD_TOKEN_TAP                         | NULL    | NULL    |\\n| Controller | UPDATE_TOKEN_TAP                      | NULL    | NULL    |\\n| Controller | OPEN_PRESALE                          | Owner   | Owner   |\\n| Controller | OPEN_TRADING                          | Presale | Owner   |\\n| Controller | CONTRIBUTE                            | Any     | Owner   |\\n| Controller | OPEN_BUY_ORDER                        | Any     | Owner   |\\n| Controller | OPEN_SELL_ORDER                       | Any     | Owner   |\\n| Controller | WITHDRAW                              | NULL    | NULL    |\\n```\\n\\n```\\n\\_acl.createPermission(\\_owner, \\_fundraisingApps.controller, \\_fundraisingApps.controller.UPDATE\\_BENEFICIARY\\_ROLE(), \\_owner);\\n\\_acl.createPermission(\\_owner, \\_fundraisingApps.controller, \\_fundraisingApps.controller.UPDATE\\_FEES\\_ROLE(), \\_owner);\\n```\\n

Impact:

Recommended mitigation:
Resolution\\nFixed with aragonone/[email protected]bafe100 by adding the undocumented and deviating permissions to the documentation.\\nFor transparency, all permissions set-up by the template must be documented.