---
id: 1293
title: "Six mistakes in ERC-4337 smart accounts"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2026/03/11/six-mistakes-in-erc-4337-smart-accounts/"
published_at: "2026-03-11 11:00"
tags: ["web3", "vulnerability-research", "smart-contracts", "vulnerabilities", "audit", "trail-of-bits", "ethereum", "erc-4337", "account-abstraction", "signature-validation", "erc-1271", "erc-7702"]
phying_url: "https://phying.com/item/1293"
lang: en
---

# Six mistakes in ERC-4337 smart accounts

## Summary

Drawing on audits of dozens of ERC-4337 smart accounts, this post catalogs six recurring vulnerability patterns, including access control flaws, incomplete signature validation and ERC-1271 replay.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2026-03-11 11:00
- **Original:** https://blog.trailofbits.com/2026/03/11/six-mistakes-in-erc-4337-smart-accounts/
- **Phying News:** https://phying.com/item/1293