Guarded delegation pattern (illustrative)

1// Illustrative defensive pattern written by ThreatWire. It is NOT the keeper's code and has not
2// been compiled or audited. It shows the shape of the fix described in the incident record.
3 
4interface IVat {
5    function hope(address usr) external;
6    function nope(address usr) external;
7}
8 
9contract GuardedKeeper {
10    IVat public immutable vat;
11    address public owner;
12    mapping(address => bool) public approvedAdapter;
13 
14    modifier auth() {
15        require(msg.sender == owner, "unauthorized");
16        _;
17    }
18 
19    constructor(IVat _vat) {
20        vat = _vat;
21        owner = msg.sender;
22    }
23 
24    function setAdapter(address adapter, bool ok) external auth {
25        approvedAdapter[adapter] = ok;
26    }
27 
28    // A function that grants rights over this contract's Vat account, or calls back into a
29    // supplied address, is an authority transfer. It needs the same gate as every other
30    // privileged function, an allow-list for the target, and a revocation once the work is done.
31    function runWith(address adapter) external auth {
32        require(approvedAdapter[adapter], "adapter not approved");
33        vat.hope(adapter);
34        // ... perform the intended work with the adapter ...
35        vat.nope(adapter);
36    }
37}