diff --git a/contracts/prototypes/evm/ERC20CustodyNew.sol b/contracts/prototypes/evm/ERC20CustodyNew.sol
index 2a4adbb4..4d2147a4 100644
--- a/contracts/prototypes/evm/ERC20CustodyNew.sol
+++ b/contracts/prototypes/evm/ERC20CustodyNew.sol
@@ -22,6 +22,8 @@ contract ERC20CustodyNew is ReentrancyGuard{
     }
     
     // Withdraw is called by TSS address, it directly transfers the tokens to the destination address without contract call
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function withdraw(address token, address to, uint256 amount) external nonReentrant {
         IERC20(token).safeTransfer(to, amount);
 
@@ -30,6 +32,8 @@ contract ERC20CustodyNew is ReentrancyGuard{
 
     // WithdrawAndCall is called by TSS address, it transfers the tokens and call a contract
     // For this, it passes through the Gateway contract, it transfers the tokens to the Gateway contract and then calls the contract
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function withdrawAndCall(address token, address to, uint256 amount, bytes calldata data) external nonReentrant {
         // Transfer the tokens to the Gateway contract
         IERC20(token).transfer(address(gateway), amount);
diff --git a/contracts/prototypes/zevm/GatewayZEVM.sol b/contracts/prototypes/zevm/GatewayZEVM.sol
index c4a97011..388c8658 100644
--- a/contracts/prototypes/zevm/GatewayZEVM.sol
+++ b/contracts/prototypes/zevm/GatewayZEVM.sol
@@ -63,6 +63,8 @@ contract GatewayZEVM is Initializable, OwnableUpgradeable, UUPSUpgradeable {
     }
 
     // Deposit foreign coins into ZRC20
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function deposit(
         address zrc20,
         uint256 amount,
@@ -75,6 +77,8 @@ contract GatewayZEVM is Initializable, OwnableUpgradeable, UUPSUpgradeable {
     }
 
     // Execute user specified contract on ZEVM
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function execute(
         zContext calldata context,
         address zrc20,
@@ -88,6 +92,8 @@ contract GatewayZEVM is Initializable, OwnableUpgradeable, UUPSUpgradeable {
     }
 
     // Deposit foreign coins into ZRC20 and call user specified contract on ZEVM
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function depositAndCall(
         zContext calldata context,
         address zrc20,
diff --git a/contracts/prototypes/zevm/ZRC20New.sol b/contracts/prototypes/zevm/ZRC20New.sol
index d9b6ad37..83fda59d 100644
--- a/contracts/prototypes/zevm/ZRC20New.sol
+++ b/contracts/prototypes/zevm/ZRC20New.sol
@@ -228,6 +228,8 @@ contract ZRC20New is IZRC20, IZRC20Metadata, ZRC20Errors {
      * @param amount, amount to deposit.
      * @return true/false if succeeded/failed.
      */
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function deposit(address to, uint256 amount) external override returns (bool) {
         if (msg.sender != FUNGIBLE_MODULE_ADDRESS && msg.sender != SYSTEM_CONTRACT_ADDRESS && msg.sender != GATEWAY_CONTRACT_ADDRESS) revert InvalidSender();
         _mint(to, amount);
@@ -273,6 +275,8 @@ contract ZRC20New is IZRC20, IZRC20Metadata, ZRC20Errors {
      * @dev Updates system contract address. Can only be updated by the fungible module.
      * @param addr, new system contract address.
      */
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function updateSystemContractAddress(address addr) external onlyFungible {
         SYSTEM_CONTRACT_ADDRESS = addr;
         emit UpdatedSystemContract(addr);
@@ -282,6 +286,8 @@ contract ZRC20New is IZRC20, IZRC20Metadata, ZRC20Errors {
      * @dev Updates gas limit. Can only be updated by the fungible module.
      * @param gasLimit, new gas limit.
      */
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function updateGasLimit(uint256 gasLimit) external onlyFungible {
         GAS_LIMIT = gasLimit;
         emit UpdatedGasLimit(gasLimit);
@@ -291,6 +297,8 @@ contract ZRC20New is IZRC20, IZRC20Metadata, ZRC20Errors {
      * @dev Updates protocol flat fee. Can only be updated by the fungible module.
      * @param protocolFlatFee, new protocol flat fee.
      */
+    // TODO: Finalize access control
+    // https://github.com/zeta-chain/protocol-contracts/issues/204
     function updateProtocolFlatFee(uint256 protocolFlatFee) external onlyFungible {
         PROTOCOL_FLAT_FEE = protocolFlatFee;
         emit UpdatedProtocolFlatFee(protocolFlatFee);