When a safe transaction is executed, what will be the executing address of the contract?

Question

I'm currently writing a smart contract with a vesting component, and basically looking at every possible way to reduce the attack surface due to the value that will be locked into it.

One thing I wanted to do is to add a modifier to all payable functions, to restrict them to a whitelisted set of accounts that we will know before the contract is deployed.

A couple of these accounts are multisigs, which obviously cannot directly execute transactions. It would be great IF the multisig was the whitelisted account, with one of the externally owned accounts executing the final transaction through the multisig.

Looking at SafeApps leads me to believe this is perfect for my use case: the signers will collectively sign the transaction, which will then call the contract. What I would like to confirm:

1. Will the contract be called by the contract address of the Safe/Multisig? Alternative might be some other account managed by the tranaction service.
2. Presumably the final execution of the transaction will require the account to send all gas required for the proxy call?

Answer 1

Regarding 1)

When a Safe interacts with another contract it uses call (see this code). Therefore the msg.sender address will be the Safe contract address.

This is used in many examples. One of them is the OpenZepplin Safe app, where the Safe is used with an ownable contracts, where the owner address is the Safe address.

In a similar way you could use this for an allow list on your vesting contract.

Regarding 2)

The execution costs are always covered by the account that submits the transaction to the chain. In case of a Safe this doesn't have to be an owner. (For more information see this thread).

In general there are some way to specify how much gas is required for the execution of a transaction. Documentation for this will also be added to the safe-contracts repo.