Zaros Part 1

Github
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/external/chainlink/keepers/liquidation/LiquidationKeeper.sol#L44-L88
https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/external/chainlink/interfaces/IAutomationCompatible.sol#L5-L22

Summary

The checkUpkeep function in the LiquidationKeeper contract, which implements the IAutomationCompatible interface, lacks the cannotExecute modifier. This modifier is recommended by the interface documentation to ensure the function is only simulated and not executable directly. The absence of this modifier introduces a potential vulnerability, allowing the function to be called directly and possibly impacting the contract's intended functionality and security.

Vulnerability Details

The IAutomationCompatible interface specifies that the checkUpkeep function is designed for simulation purposes to determine if any upkeep work is required. The interface documentation suggests adding the cannotExecute modifier to prevent this function from being called directly. However, the LiquidationKeeper contract does not implement this modifier, making the function executable.

Impact

The absence of the cannotExecute modifier on the checkUpkeep function allows it to be called directly, rather than being restricted to simulation. Unauthorized invocation of the checkUpkeep function, which could bypass intended access controls or conditions.

Recommendations

Add the cannotExecute modifier to the checkUpkeep function. This ensures that the function is only used for simulation and cannot be called directly.