Six mistakes in ERC-4337 smart accounts
Summary: Trail of Bits, after auditing dozens of ERC-4337 smart accounts, identified six recurring vulnerability patterns, including execute functions callable by anyone, gas fields omitted from the signed payload, and state written during validateUserOp. The post also covers ERC-1271 signatures not bound to account and chain, paymasters that debit a shared pool during validation but charge users in postOp, and an ERC-7702 initialization race where an attacker can frontrun initialize(owner).
What's compelling: In ERC-4337, a successful validateUserOp commits the account to paying gas even if execution reverts, so a permissive validator lets a malicious bundler drain an account by resubmitting operations that are certain to fail.
Read the original at Trail of Bits Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026