Robo woofy diff tool to check strategy code against diff git commit

[vany365]

Elevator Pitch:

Robowoofy is a great tool that has eased the operations on doing msig complex transactions and adding new strategies. At the same time it poses an additional risk that anyone that can add a PR to robo woofy could potential attach a malicious strategy or a transferFrom operation if the msig signers are not careful.

The current mitigations are that PRs are restricted to trusted members and we have peer reviews.

an automated tool that runs as a github action would help have an additional layer of security.

Customer Value:

Avoid potential attack vectors in the msig and ensure validity of actions in PR.

Agreed upon Acceptance Criteria (definition of Done)👍

Create a short spec of the tool.

POC of a tool/script that runs on robo woofy PR and alerts if diff of attached strategy code in etherscan matches the linked reviewed commit code and adds a diff checker link for review in the PR.

Task List:

• Service that grabs the PR and detects if it attaches a strategy. (can detect other operations in contract like transferFrom)
• Grab the strategy code from etherscan (shows alert if code is not verified)
• Grab the commit link from github and execute a build and flattening of the strategy file
• compare build output with etherscan code.
• Using flattening plugins and tools already built for verification may be useful

Estimation/Estimated Completion date:

a few weeks when task has been started.

[storming0x]

i built a cli tool that shows a diff output from a local file, maybe this can be completed using a github action to checkout the repo and run the tool to show the diff ?

https://github.com/storming0x/ethlift-rs

There are still some things to improve it , but currently supports brownie and foundry projects which covers the strategy mixes we use.

command failed, first check your syntax
/robowoofy network=[eth|bsc] fn=[valid_brownie_function_name] send=[true|false] delete-branch-after-send=[true|false]
If that looks good, make sure you have write access on this repository.
Also, make sure you are not running this from a repository fork. Robowoofy must be ran from branch on the repo.