stake.link

Summary

The performUpkeep function is unprotected and does not follow best practices. When using Chainlink Automation it is best practice to check that an upkeep is still needed within the performUpkeep function and require it can only be called by the Forwarder.

From the Chainlink Docs: "If your upkeep performs sensitive functions in your protocol, consider using the Forwarder to lock it down so performUpkeep can only be called by the Forwarder. Add other permissible addresses if you need to call it yourself. Note the forwarder is only determined after registration so make this a mutable variable and ensure you add a setter function with permissions for you to set it."

Tools Used

Manual Review

Recommendations

Create a modifier that only allows performUpkeep to be called by the forwarder

Check that upkeep is still needed within performUpkeep