# Auditing Karpatkey PURv5

:::info

**Reference:** [EP5.x Roles Modifier V2 Migration & Endowment Permissions Updates](https://discuss.ens.domains/t/ep-5-x-roles-modifier-v2-migration-updates-to-endowment-permissions/19173)

:::

## Audit Step 1: Current Permissions Policy

### Addresses without reference:

- **0x5550d13389bb70f45fcef58f19f6b6e87f6e747d**
- Comment: Signature listed as ‘processRoute’ in V1 module, but does not appear in V2 module.

### Addresses with missing reference:

- **0x5c0f23a5c1be65fa710d385814a7fd1bda480b1c**
- Comment: Signature listed as ‘withdraw’, ‘deposit’, and ‘claim rewards’ in V2 module, but does not appear in V1 module.

### Addresses with missing function:

- **0xc874b064f465bdd6411d45734b56fac750cda29a**
- Comment:
- Function not found in ABI ‘no condition set’ in either module version.
- Preset Permissions v5 lists it as stake() 'Sender stakes ETH in exchange for sETH2'
- Revoked in updated policy

## Audit Step 2: Comparison of Current Permissions Policy vs New Proposed Policy

No comments.

## Audit Step 3: Enabling Roles v2 by the Endowment

### Tokens:

- **Spark: spWETH**
- Address: 0x59cD1C87501baa753d0B5B5Ab5D8416A45cD71DB
- Comment: In the new permissions policy deployed in the Roles v2 module, spWETH function signature is listed as ‘0x095ea7b3’ and its parameter is ‘[0]’, type ‘static’, and its value is ‘0x000000000000000000000000bd7d6a9ad7865463de44b05f04559f65e3b11704’. Whereas in V1, the permission lists the function signature as ‘approve’, the parameter is ‘spender’ its type is ‘address’ and its value is ‘0xBD7D6a9ad7865463DE44B05F04559f65e3B11704’.

- **wstETH Token**
- Address: 0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0
- Comment: In the v2 module, 2 parameters are listed, whereas in the v1 module, there are three additional parameters listed.

- **USDC Token**
- Address: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48
- Comment: The v2 module lists 4 parameters, the v1 module has an additional one.

- **ETHx Token**
- Address: 0xA35b1B31Ce002FBF2058D22F30f95D405200A15b
- Comment: The v2 module lists 4 parameters, the v1 module has an additional one.

- **rETH Token**
- Address: 0xae78736Cd615f374D3085123A210448E74Fc6393
- Comment: The v2 module lists 2 parameters, the v1 module lists an additional three.

- **stETH Token**
- Address: 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84
- Comment: The v2 module lists 5 parameters, the v1 module lists an additional two.

- **WETH Token**
- Address: 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2
- Comment: The v2 module lists 3 parameters under its function signature listed as ‘approve’; meanwhile in v1, there are an additional 4 parameters listed under this function signature.

- **ankrETH Token**
- Address: 0xE95A203B1a91a908F9B9CE46459d101078c2c3cb
- Comment: The v2 module lists four parameters, the v1 module lists an additional parameter.