Vfat - Automation

Automation.sol is used to enable protocol-approved accounts, controlled by off-chain infrastructure, to execute privileged actions on a user's Sickle periodically.

Automation.admin may invoke any of the following methods to create an automator for a Sickle:

• setCustomAutomatorForSickle
• setApprovedAutomator
• setApprovedAutomatorWithPermissions

These methods do not require the Sickle owner to have explicitly allowed a given automator to be set for his Sickle.

Informational.

Within the highlighted methods, add a verification step to ensure the owner of the Sickle has approved such automator. This may be achieved, for example, by verifying an ECDSA signature signed by the Sickle owner over the automator's address, the permissions granted, a nonce, and optionally a deadline timestamp.

This is done one layer up, the Sickle user has to enable automation by calling setApproved on their Sickle with the address of the Automation contract.

The Automation.sol contract uses a 256-bit map to track which actions a given automator can execute on a Sickle.

The AutomationPermissions.sol library defines the 7 valid flags settable within a permissions bit map.

The methods used to set custom permissions for an automator, Automation.setCustomAutomatorForSickle and Automation.setApprovedAutomatorWithPermissions fail to verify that the unused bits in the bit map are set to 0.

Informational.

Implement a validatePermissions modifier and apply it to the highlighted methods, to ensure the upper, unused bits in the permissions bit map are all set to 0:

modifier validatePermissions(uint256 permissions) {
    require(permissions <= AutomationPermissions.ALL, "Malformed permissions");
    _;
}

Fixed as recommended in commit b00f831