Auto-pay
The Tamias subscription paid from your Safe on payday, after one signature, to Tamias and nobody else.
What it does
The Tamias subscription is paid from one of your Safes, once a month. Without auto-pay, each month is a payment your owners sign on the TO DO, like any other. With auto-pay on, the payment happens on payday without anyone signing, and your owners have signed exactly once: to turn it on.
It is offered in two places: on the Billing page, inside the subscription it pays, and on the TO DO row you sign each month.
What could go wrong without it
A month nobody signs is a month the subscription is not paid, and an unpaid subscription goes read-only. That is a bad trade for a team whose owners are travelling, on leave, or simply busy the week the payment is due.
What you see in the app
On Billing, auto-pay sits under the monthly payment it replaces, with the cap and the recipient stated on the row itself.
The same offer appears on the TO DO row that asks you to sign the month's payment, as a line under it. It is not shown once auto-pay is on.
Turning it on opens the one transaction your owners sign. It states what Tamias can take, lists the calls, and names each contract involved with a link to check it: Safe's Allowance Module and its source, and TamiasCollector with its verified source. The simulation runs before anyone signs.
What the one signature does
"Turn on" proposes one batch to the Safe the subscription is billed from. The owners sign it like any other transaction, and nothing changes until it executes. It makes at most three calls, and the modal lists them before anyone signs:
- Enable Safe's Allowance Module, if the Safe does not have it on already. This is Safe's own module for spending limits, written and audited by Safe, not by us. Its source is on GitHub.
- Add TamiasCollector as a delegate on that module. TamiasCollector is
our contract,
0x8b5d2A4d4e53A2EdF8F1605282153E4b77473c24, the same address on every chain. See Our contracts for its source. - Set an allowance for the collector: the subscription price, in the stablecoin the subscription is billed in on that chain, once every 28 days.
The module has two official deployments, and not every chain has both.
Tamias uses v0.1.1 (0xAA46724893dedD72658219405185Fb0Fc91e091C) wherever
the chain has it, and v0.1.0 (0xCFbFaC74C26F8647cBDb8c5caf80BB5b32E43134)
where it does not. The modal names the one it is about to enable, with a
link to it on the chain's explorer.
What the collector can and cannot do
The allowance is enforced by Safe's module. What the collector does with it is fixed in its code, which has no owner and cannot be upgraded.
- It can only pay Tamias. The recipient, the Tamias treasury Safe, is written into the contract. No setting changes it, and nobody could.
- It takes the whole allowance or nothing. It refuses an allowance that is partly spent, so it cannot be used to chip at your balance in small pulls.
- At most once every 28 days. The module refills the allowance every 28 days and not before, so a second pull in the same period fails.
- It never charges for gas. The module can pay a caller back for gas out of the allowance. The collector always asks for zero.
- It takes one token. The allowance is for the billing stablecoin, and the module refuses any other.
Anyone can call the collector, not only Tamias. The most a stranger can do with it is make you pay this period's subscription early, to us, which is credited like any other payment.
When it pulls
On the payday of your subscription, not every 28 days from when you turned it on. The 28 days are the module's refill period, chosen so a monthly payday always finds the allowance full.
Tamias checks every 15 minutes for subscriptions that are due. A Safe is pulled only when all three are true: auto-pay is on, this period's allowance is untouched, and the Safe holds enough of the stablecoin to pay it. Every due Safe on one chain is pulled in a single transaction, and Tamias pays its gas. The payment is then credited exactly as a signed one would be.
If the Safe is short
Nothing is pulled, and nothing fails on your Safe. The month's payment stays on the TO DO as the ordinary payment your owners can sign, as it would without auto-pay. Top the Safe up before anyone signs it and the next check, within 15 minutes, pulls it. Once your owners propose the signed payment themselves, auto-pay leaves that month alone, so it is never paid twice.
Turning it off
In Tamias. "Turn off" on the Billing page proposes one call to the module: remove TamiasCollector as a delegate, together with its allowance. After your owners sign it, the collector can take nothing.
In Safe, without Tamias. The permission lives on your Safe, not with us, so you do not need Tamias to take it away. Either:
- In the Safe app, open Settings → Setup and remove the spending limit
given to
0x8b5d2A4d4e53A2EdF8F1605282153E4b77473c24. That sets the allowance to zero, and the collector has nothing to take. - Or, to remove the delegate itself, use the Transaction Builder in the Safe
app to call
removeDelegateon the Allowance Module, with the collector's address andremoveAllowancesset to true. This is the same call Billing proposes.
Either way, Billing reads the answer from the chain, so it shows auto-pay as off once the transaction executes.
When the subscription moves to another chain
The allowance is on one chain's module, so it does not move with the subscription. After a move, the TO DO shows "Move auto-pay to" the new chain, and Billing offers both halves: turn it on where the subscription now bills, and turn it off on the old chain. Tamias stops pulling on the old chain, but the permission stands there until your owners remove it, so do both.
What it does not do
- It does not pay anything but the Tamias subscription, and it does not pay anyone but Tamias.
- It does not pay early on its own. Tamias pulls on payday.
- It does not top the Safe up, swap into the stablecoin, or move money between chains. If the Safe is short, the signed payment is the fallback.