Finding who can attack

Every admin cell in L19, every grant.Severity in L13's admin_risk math, every signer fan-out in L22 — they all start with one upstream question: who actually controls this token? On the EVM there's no single answer. Control hides behind a dozen incompatible patterns. This lesson is the subsystem that hunts them all down and tags each one with a severity — the birthplace of the ADMIN_CTRL edge.

1 · The probe battery (DiscoverFocusTokenAdmins)

For a focus token, focus_token_admin_probes.go fires 17 independent probes, each targeting one admin pattern. The cardinal rule: a revert or network error on one probe never aborts the rest (fail-loop — the same discipline as L24/L8). It mirrors the Python batch pipeline's _discover_admin_controls so the realtime indexer matches batch coverage.

Each probe yields FocusAdminFinding{Account, RoleHash, RoleName, Severity, SeverityWeight, Source}, and a final dedup collapses cross-probe duplicates (e.g. the EIP-1967 admin found by both probe 2 and probe 15). The IsAdminRole filter drops user-status roles so a DEPOSIT_VAULT_ADMIN_ROLE doesn't masquerade as control.

2 · The OZ AccessControl ladder — cheapest first

Probe 1 is itself a four-stage ladder (probeAdminRoles), ordered cheapest → most expensive — because every rung is RPC, and RPC is the budget (L24's central tension):

3 · Severity is assigned at the source

Here's the connection that closes the loop with L13. Each discovered role isn't just an (account, role) pair — discovery classifies its severity right away, via the very same table you met in the risk math:

// admin_roles.go — severity stamped from the shared classifier
name, severity, weight = types.ClassifyRole(roleHash)   // → "MINTER_ROLE", critical, 1.0
// DEFAULT_ADMIN_ROLE (bytes32(0)) and minters classify as CRITICAL

The probed-role list is grouped by exactly the severity tiers from L13:

4 · From finding to edge to cell

The findings become ADMIN_CTRL edges (account → token) carrying role name, capabilities, and severity. Trace the whole arc you've now learned end to end:

discover admins (this lesson)  →  ADMIN_CTRL edge {role, severity}
   →  L19/L20 cell construction reads adminCtrl[target]  (classifyAdminRole → roleClass/outcome)
      →  L13 admin_risk multiplies channel × severityWeight
         →  L22 if the admin is a Safe, fan out to signers
            →  the AT_RISK edge

What you can now do

• Explain why admin discovery is a battery of 17 independent, fail-loop probes — no EVM standard for "admin."
• Walk the OZ AccessControl 4-stage ladder (enumerable → Multicall3 count → RoleGranted event scan → none) and why it's cheapest-first.
• Explain the Multicall3 batching win and the bounded role list as the coverage-vs-RPC-budget answer.
• State that severity is assigned at discovery via types.ClassifyRole — the same source L13's math reads — and recite the four tiers.
• Trace the full arc: discover → ADMIN_CTRL edge → L19/L20 cell → L13 severity weight → L22 signer fan-out → AT_RISK edge, and explain deployer-fallback as the coverage-limit signal.