PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Six mistakes in ERC-4337 smart accounts

blog.trailofbits.com | blog | #web3 | #vulnerability-research | #smart-contracts | #vulnerabilities | #audit | #trail-of-bits | #ethereum | #erc-4337 | #account-abstraction | #signature-validation | #erc-1271 | #erc-7702
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Drawing on audits of dozens of ERC-4337 smart accounts, this post catalogs six recurring vulnerability patterns, including access control flaws, incomplete signature validation and ERC-1271 replay.
Published
Collected

Related coverage

blog · osec.io
ERC-4337 paymasters: better UX, hidden risks
OtterSec's guide to ERC-4337 paymasters: how account abstraction enables gasless UX, common pitfalls in real-world implementations, and best practices for production-ready designs.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
Building secure Uniswap v4 hooks
Uniswap v4 hooks can satisfy PoolManager settlement invariants while still violating application-level accounting or authorization assumptions. The seven recurring failure patterns form a practical review checklist for hook developers and auditors.
blog · hackenproof.com
Aptos Move Smart Contract Security: How Object Refs Leak and Global Storage Breaks
Unchecked borrow_global_mut, leaked object refs, and Block-STM races break Aptos protocols. See the $25.5M Thala exploit and an Aptos/Supra audit checklist.
blog · hackenproof.com
Smart Contract Security in 2026: Risks, Best Practices, and Audits
Top smart contract security risks in 2026, best practices that prevent exploits, and when to audit your contracts. A practical guide for founders and CTOs.
blog · hackenproof.com
How to hack everiToken?
An introduction to everiToken, a token-based public chain that replaces smart contracts with 'safe contracts' and BFT-DPOS consensus, plus node setup, API testing, and a node vulnerability.
Back