Allowlists Are Not Spending Caps: Two Different Security Properties, Often Confused

Allowlists and spending caps are two separate security properties that are often confused with each other. While both serve as limitations, they address different failure modes and do not guarantee the same level of security when used together.

A spending cap is a limit on the amount of value that can be moved, and it prevents a compromised or misbehaving key from draining a wallet in one shot. However, it does not restrict the assets that can be touched. On the other hand, an allowlist restricts the scope of interactions, ensuring that the signer can only interact with a predefined set of token contracts.

The two properties complement each other in theory, but each has its own failure modes. One such failure mode is that the token contract behind a proxy can have its logic changed after the allowlist entry is added. Another mode is that the router contract used for swaps can forward calls to arbitrary target contracts with arbitrary calldata. Lastly, the phrase "it can only swap" does not guarantee security unless the function signature and parameters are thoroughly understood.

To ensure proper security, it is crucial to ask the following questions when evaluating an authorization system: at what granularity are assets allowlisted, are transactions capped, where is enforcement enforced, and what happens when a check fails. By addressing these questions, one can better understand the actual limitations of a permission system and avoid conflating allowlists and spending caps.