# Erc4337 Account Abstraction

> Detect ERC-4337 account-abstraction bugs — validateUserOp storage-rule violations, paymaster postOp DoS, session-key scope bypasses, signature aggregation issues, EIP-7702 delegation risks. Activate on `validateUserOp`, `validatePaymasterUserOp`, `postOp`, `UserOperation`, `EntryPoint`, `IAccount`, `IPaymaster`, session-key modules, ERC-7579 modules, EIP-7702 authorization payloads.

- **Type:** Skill
- **Install:** `agentstack add skill-omermaksutii-rugproof-erc4337-account-abstraction`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [omermaksutii](https://agentstack.voostack.com/s/omermaksutii)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [omermaksutii](https://github.com/omermaksutii)
- **Source:** https://github.com/omermaksutii/RugProof/tree/main/skills/erc4337-account-abstraction
- **Website:** https://omermaksutii.github.io/RugProof

## Install

```sh
agentstack add skill-omermaksutii-rugproof-erc4337-account-abstraction
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# ERC-4337 / Account Abstraction detection

## When this applies

- Smart-wallet implementations (SimpleAccount, Safe-AA, Kernel, Biconomy, Light Account, custom)
- Paymaster contracts (verifying, deposit, token-paying, sponsorship)
- Module systems (ERC-7579, ERC-6900) and session-key managers
- Bundler / mempool-side relayer logic (rare in app code, but watch for)
- EIP-7702 delegated EOAs

## Detection patterns

### `validateUserOp` storage-rule violation (HIGH)
ERC-4337 §6 forbids `SLOAD` on storage slots outside the wallet's own contract during validation. Bundlers reject non-compliant UserOps. Beyond compliance, accessing external state during validate is a *banner attack surface* (e.g. reading from an attacker-controlled contract).
```solidity
function validateUserOp(...) external returns (uint256) {
    uint256 x = IExternal(0xabc).read();   // ← violates storage rules + leaks attack surface
    ...
}
```

### Missing `msg.sender == entryPoint()` check (CRITICAL)
```solidity
function validateUserOp(...) external returns (uint256) {
    // ← anyone can call directly, bypass bundler entirely
}
```

### Paymaster `postOp` revert risk (HIGH)
```solidity
function postOp(PostOpMode mode, bytes calldata ctx, uint256 actualGasCost) external {
    require(...);   // ← if this reverts in postOp, bundler is griefed; reputation system penalizes the paymaster
}
```
`postOp` should be revert-free. Use try/catch or never revert.

### Paymaster oracle manipulation for token-paying (HIGH)
Token-paying paymaster converts ERC20 → ETH at validate time. If oracle is spot AMM, sandwichable. See [[oracle-manipulation]].

### Sponsorship-paymaster missing nonce/deadline (HIGH)
Sponsorship sig replayable. See [[signature-replay]].

### Session-key scope bypass (HIGH)
Session keys grant limited authority (allowed selectors, allowed targets, time bounds). Bypass paths:
- Multicall router that the session key approves → key calls arbitrary fns via the router
- Fallback function not scoped
- ERC-7579 module installation while session-key active
- Approval to swap router → token-drain via the approval

### EIP-7702 chainId-less authorization (CRITICAL)
EIP-7702 delegations replayable across chains if `chainId == 0` or missing chainId binding.

### EIP-7702 delegation to attacker (CRITICAL)
User signs an authorization to a contract address. If that contract is upgradeable / attacker-controlled, the EOA's nonce-aware delegated-call grants full control.

### Aggregated sig replay (HIGH)
BLS-aggregated UserOps with `aggregator` field — if aggregator's verifier doesn't include chainId, cross-chain replay possible.

### Nonce-key collision (MEDIUM)
ERC-4337 uses 192-bit "nonce-key" for parallel UserOps. If multiple session keys / dapps share key 0, they serialize unnecessarily. Worse: if key encoding collides with another semantic, a stuck UserOp can DoS.

### Permit2 + AA collision (MEDIUM)
Meta-tx with permit can collide on nonces with regular UserOp.

### Module install with missing auth check (CRITICAL)
ERC-7579 / ERC-6900 module install paths sometimes lack `onlyEntryPointOrOwner`. Install path → arbitrary module → arbitrary execution.

## Severity rubric

| Pattern | Severity |
|---|---|
| `validateUserOp` callable by non-EntryPoint | **Critical** |
| Module install lacks auth check | **Critical** |
| EIP-7702 missing chainId in authorization | **Critical** |
| EIP-7702 delegation to mutable contract | **Critical** |
| Paymaster postOp can revert | **High** |
| Session-key scope bypass via multicall/fallback | **High** |
| Storage-rule violation in validate | **High** |
| Token-paymaster spot-oracle dependency | **High** |
| Sponsorship-paymaster sig without nonce/deadline | **High** |
| Aggregated sig missing chainId | **High** |
| Nonce-key naming collision | **Medium** |

## Remediation patterns

- Wallet: `require(msg.sender == address(entryPoint()), "only EP");`.
- Paymaster: never revert in postOp; use try/catch internally.
- Module install: gate behind `onlyEntryPointOrOwner` and a per-module validation step.
- Session keys: explicit allowlist of (selector, target) tuples; no fallback fallthrough.
- EIP-7702: include chainId in EIP-7702 authorization payload; delegate only to immutable, audited code.
- Storage rules: only `SLOAD` from self during validate; cache external state into self-state before validate.

## False-positive notes

- Canonical SimpleAccount-style impls from eth-infinitism are reference; safe.
- "Account Factory" pre-deployment patterns sometimes look risky but are well-understood.

## Related

- [[signature-replay]]
- [[delegatecall-risks]]
- [[aa-specialist]] (subagent)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [omermaksutii](https://github.com/omermaksutii)
- **Source:** [omermaksutii/RugProof](https://github.com/omermaksutii/RugProof)
- **License:** MIT
- **Homepage:** https://omermaksutii.github.io/RugProof

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-omermaksutii-rugproof-erc4337-account-abstraction
- Seller: https://agentstack.voostack.com/s/omermaksutii
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.