Return to site
Return to site

Bug Deep Dive #31

Static signatures bound to caller revert under ERC-4337, causing DoS - $1416

· Bug Deep Dive
Section image

Sequence wallets support ERC‑4337 by validating signatures inside validateUserOp() in ERC4337v07. The function enforces that msg.sender is the entrypoint and then performs signature verification via an external self‑call: this.isValidSignature(userOpHash, userOp.signature).

Because of this external call, the msg.sender observed inside isValidSignature() (implemented in BaseAuth) becomes the wallet itself, not the entrypoint. As a result, the static signature validation in BaseAuth.signatureValidation()—which enforces a caller binding—fails whenever a non‑zero “expected caller” is set to the entrypoint.

Section image

Alpha: when using "this" the msg.sender becomes address(this), so make sure this is intended!

Conclusion

This finding would earn you $1416, verify the msg.sender is the expected one.

Full Report
Codebase

Subscribe
Previous
Bug Deep Dive #30
Next
Bug Deep Dive #32
 Return to site
Cookie Use
We use cookies to improve browsing experience, security, and data collection. By accepting, you agree to the use of cookies for advertising and analytics. You can change your cookie settings at any time. Learn More
Accept all
Settings
Decline All
Cookie Settings
Necessary Cookies
These cookies enable core functionality such as security, network management, and accessibility. These cookies can’t be switched off.
Analytics Cookies
These cookies help us better understand how visitors interact with our website and help us discover errors.
Preferences Cookies
These cookies allow the website to remember choices you've made to provide enhanced functionality and personalization.
Save