PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

ERC-4337 paymasters: better UX, hidden risks

osec.io | blog | #web3 | #vulnerability-research | #smart-contracts | #ethereum | #erc-4337 | #account-abstraction | #evm | #paymaster
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec's guide to ERC-4337 paymasters: how account abstraction enables gasless UX, common pitfalls in real-world implementations, and best practices for production-ready designs.
Published
Collected

Related coverage

blog · netspi.com
Ethereum Virtual Machine Internals – Part 2
Part two on EVM internals covers persistent contract Storage: how Solidity types map to 32-byte storage slots, SSTORE and SLOAD semantics, and the gas costs that make storage writes expensive.
blog · netspi.com
Ethereum Virtual Machine Internals – Part 1
Part one on EVM internals explains how the Ethereum Virtual Machine executes smart contracts deterministically, covering volatile memory, function selection, and bytecode-level vulnerabilities.
blog · blog.trailofbits.com
Six mistakes in ERC-4337 smart accounts
Drawing on audits of dozens of ERC-4337 smart accounts, this post catalogs six recurring vulnerability patterns, including access control flaws, incomplete signature validation and ERC-1271 replay.
blog · blog.trailofbits.com
State Machine Testing with Echidna
A Trail of Bits engineer adapts Hedgehog-style state machine testing to EVM contracts with Echidna, showing how random call sequences can verify invariants and surface logic bugs in Solidity code.
blog · blog.trailofbits.com
Echidna, a smart fuzzer for Ethereum
Trail of Bits releases Echidna at EthCC, the first fuzzer built for smart contracts, pairing a simple echidna-test runner for Solidity assertions with a library for custom state-machine analyses.
blog · hackenproof.com
Aptos Move Smart Contract Security: How Object Refs Leak and Global Storage Breaks
Unchecked borrow_global_mut, leaked object refs, and Block-STM races break Aptos protocols. See the $25.5M Thala exploit and an Aptos/Supra audit checklist.
Back