SecurityToken.addToWhitelist() can only be called by the KYC provider

[pabloruiz55]

According to the docs:

4. (This part can be done by anyone) The investor/issuer calls
   SecurityToken.addToWhitelist() which checks the KYC provider address
   customer datastore in Customers.sol and verifies the customer verifications
   meet the security token compliance template requirements.

But the function specifies:

require(KYC == msg.sender);

@everhusk which is correct?

[satyamakgec]

it is only be called by KYC provider otherwise we can't get the data of the customer from our chain. i think sukh did a mistake in the documentation.
anyways @everhusk please confirm

[pabloruiz55]

Why not? The issuer should be able to consult whether or not an investor has been verified by the KYC provider.

It looks like a problem otherwise, the issuer would have to make, somehow, the KYC provider add investors to the whitelist for their token, which definitively should not be the KYC provider's job.

[everhusk]

I agree with Pablo on this, let's allow only the Issuer or KYC provider to addToWhitelist()