> For the complete documentation index, see [llms.txt](https://reports.immunefi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://reports.immunefi.com/vechain-or-stargate-hayabusa/59411-sc-insight-inconsistency-in-migratetokenmanager-in-terms-of-the-permitted-caller.md).

# 59411 sc insight inconsistency in migratetokenmanager in terms of the permitted caller

* **Submitted on:** Nov 12th 2025 at 05:41:45 UTC by @Oxodus for [Audit Comp | Vechain | Stargate Hayabusa](https://immunefi.com/audit-competition/audit-comp-vechain-stargate-hayabusa)
* **Report ID:** #59411
* **Report Type:** Smart Contract
* **Report severity:** Insight
* **Target:** <https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/tree/main/packages/contracts/contracts/StargateNFT/StargateNFT.sol>

## Description

### Brief / Intro

There is an inconsistency between the NatSpec in `IStargateNFT` and the `StargateNFT` implementation regarding who is allowed to call the `migrateTokenManager` function.

* `IStargateNFT` states that "this function is only callable by the DEFAULT\_ADMIN\_ROLE".
* The implementation in `StargateNFT` instead restricts the call to `TOKEN_MANAGER_MIGRATOR_ROLE`:

```solidity
function migrateTokenManager(
    uint256 _tokenId,
    address _manager
) external onlyRole(TOKEN_MANAGER_MIGRATOR_ROLE) {
    ...
}
```

This mismatch between interface documentation and contract implementation can lead to confusion or incorrect assumptions about access control.

## References

* Implementation: <https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/blob/main/packages/contracts/contracts/StargateNFT/StargateNFT.sol#L660>
* Interface NatSpec: <https://github.com/immunefi-team/audit-comp-vechain-stargate-hayabusa/blob/main/packages/contracts/contracts/interfaces/IStargateNFT.sol#L467>

## Proof of Concept

No additional PoC provided.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://reports.immunefi.com/vechain-or-stargate-hayabusa/59411-sc-insight-inconsistency-in-migratetokenmanager-in-terms-of-the-permitted-caller.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.