ExVul
Back to Blog

research

Account Abstraction Security: ERC-4337 Risks and Mitigations

Security analysis of ERC-4337 account abstraction and potential vulnerabilities in smart contract wallets.

ExVul Research Team

Security Researchers

12 min
  • ERC-4337
  • Account Abstraction
  • Wallet Security
Account Abstraction Security: ERC-4337 Risks and Mitigations

ERC-4337 Overview

Account abstraction enables smart contract wallets with programmable validation logic. While powerful, it introduces new security considerations.

Security Considerations

  • Bundler trust assumptions
  • Paymaster security and griefing
  • Signature validation vulnerabilities
  • Storage access restrictions
  • DoS vectors in validation

Always use battle-tested account abstraction implementations like Safe or established SDK providers.

Validation Logic

Keep validation simple and gas-efficient

Paymaster Trust

Understand who pays for your transactions

Recovery Mechanisms

Implement secure recovery options

Continue reading

Related research

research

Source Says 50. Bytecode Says 0: The Sui Move Compiler Bug That Could Silently Drop Payments

Smart contracts execute bytecode, not the source developers review. We investigate a fixed Sui Move match-lowering bug that could erase a value-flow branch, turning a modeled 50-unit credit into 0 while still producing valid, verifiable bytecode.

12 minRead
research

Sui Mainnet Halt of May 28, 2026: An Address Balance Gas Underflow Post-Mortem

A deep post-mortem of the May 28, 2026 Sui mainnet stall: a single missing case at the seam of Address Balance and coin reservations let a failed transaction emit a poisoned accumulator Split, underflowing the per-checkpoint settlement system transaction and halting every validator.

14 minRead
research

One Line, All Funds: How a Static IV Turned Nightly Wallet's Encryption Into a Two-Time Pad

A single const declaration at module scope reused the same AES-CTR initialization vector for every encryption call, enabling full mnemonic and private key recovery from any Nightly Wallet vault — without ever knowing the user's password.

15 minRead
View the archive