[gjermundgaraba]

Description

Since #1584, ibc deploy core deploys IBCMulticall behind the core access manager and binds its multicall to PUBLIC_ROLE. Since #1585, the relayer sends every relay batch through it. docs/5-ibc-solidity-contracts/6-permissions-and-upgrades.md still described only the router and ICS27GMP as governed by the manager. This PR adds IBCMulticall to:

• the summary bullet and the "Three contracts defer to it" paragraph;
• the contract and authority table, with a link to IBCMulticall.sol;
• the RELAYER_ROLE row: IBCRolesLib.multicallRelayerSelectors lists multicall on IBCMulticall;
• "What a deployment assigns": its multicall is public. The router reports IBCMulticall as the relayer to applications, because relayer is _msgSender(). The contract's NatSpec describes the locked-down RELAYER_ROLE setup;
• the proxies table and the _authorizeUpgrade sentence: UUPS, and _authorizeUpgrade is restricted.

I checked these facts against IBCMulticall.sol, IBCRolesLib.sol and ICS26Router.sol at the pinned ibc-contracts commit (f564e633), and against ProvisionMulticall in cli/internal/deploy/evm/driver.go. refgen.py all --check is clean.

closes: n/a (follow-up to #1584 and #1585)

---

• Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work. (follow-up to feat(cli): deploy IBCMulticall #1584 and feat(relayer): relay packets through IBCMulticall #1585)
• Include changelog entry when appropriate (e.g. chores should be omitted from changelog). (n/a: docs only)
• Wrote unit and e2e tests if relevant. (n/a: docs only)
• Updated documentation (docs/) if anything is changed.
• Added godoc comments if relevant. (n/a: no Go changes)
• Self-reviewed Files changed in the GitHub PR explorer.
• Provide a conventional commit message to follow the repository standards.

🤖 Generated with Claude Code

[github-actions]

Vulnerable dependencies

0 advisories across 0 libraries need attention, 3 accepted.

Accepted

Listed in .govulncheck-ignore with a reason.

github.com/cosmos/evm

In use: v0.7.3 — reached from e2e

Advisory	CVE	Fixed in	Summary
GO-2025-3684	—	no fix yet	Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

github.com/pion/dtls/v2

In use: v2.2.12 — reached from cli

Advisory	CVE	Fixed in	Summary
GO-2026-4479	CVE-2026-26014	no fix yet	Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

golang.org/x/crypto

In use: v0.57.0 — reached from cli, e2e

Advisory	CVE	Fixed in	Summary
GO-2026-5932	—	no fix yet	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

_{From make vulncheck-json on this run: logs.}

[greptile-apps]

Confidence Score: 5/5

[Low impact] This documentation update appears safe to merge.

Summary

Updates the permissions and upgrades guide to include IBCMulticall.

• The permissions guide now explains IBCMulticall's roles and upgrades.

No actionable issues were found.

_{Reviews (1) · Last reviewed commit: "docs: cover IBCMulticall in permissions ..." · Reviewed by Greptile}