Bot System

Gearbox features a granular bot permission system that allows automated management of Credit Accounts. Bots can execute operations on behalf of account owners with specific, revocable permissions.

Architecture

Permission Model

Permissions are stored as a uint192 bitmask. Account owners grant specific permissions to specific bots:

Granting Permissions

Account owners grant permissions via a multicall operation:

const calls = [
  service.setBotPermissions(
    creditAccount,
    botAddress,
    ADD_COLLATERAL_PERMISSION | EXTERNAL_CALLS_PERMISSION
  ),
];

await facade.multicall(creditAccount, calls);

Bot Execution

Bots execute via botMulticall on the Credit Facade:

// Bot calls botMulticall with the account and operations
await facade.botMulticall(creditAccount, [
  service.addCollateral(creditAccount, tokenAddress, amount),
  // ... other permitted operations
]);

The Facade checks the bot's permissions before each operation. If a bot attempts an unpermitted action, the transaction reverts.

Safety Model

• Isolation — each permission grant is scoped to a specific (bot, creditManager, creditAccount) tuple
• Immutability — bots cannot modify their own permissions
• DAO forbid list — the DAO can globally forbid malicious bots
• Collateral check — bot multicalls undergo the same solvency check as user multicalls

Revoking Permissions

// Revoke all permissions for a bot
await facade.multicall(creditAccount, [
  service.setBotPermissions(creditAccount, botAddress, 0),
]);

Learn More

• Liquidation Bots Guide — Building a complete liquidation bot
• Credit Accounts — Account lifecycle and operations
• Multicalls — Building multicall transactions