Standards

ERC-4337

ERC-4337 is an Ethereum account abstraction standard that uses UserOperations, bundlers, paymasters, and an EntryPoint contract without changing Ethereum consensus.

ERC-4337 is the common standard for smart contract wallets that can validate actions in custom ways.

ERC-4337 Explained in Detail

ERC-4337 defines an account abstraction flow outside the normal transaction path. A user sends a UserOperation to a bundler, the bundler simulates it, and then the bundler submits it to the EntryPoint contract.

The standard also supports paymasters, which can sponsor gas under their own rules.

Smart contract example

entryPoint.handleOps(ops, beneficiary);

handleOps validates accounts, validates paymasters when present, executes operations, and pays the bundler beneficiary.

ERC-4337 in Auditing

ERC-4337 moves critical wallet checks into smart contracts. Bugs can allow unauthorized execution, replayed operations, gas griefing, drained paymasters, or accounts that work only under one bundler's assumptions.

Auditors review both on-chain code and the assumptions made by off-chain simulation.

Red flags in code

  • Account or paymaster trusts the wrong EntryPoint address.

  • Signatures do not bind the operation to the correct chain and EntryPoint.

  • Factory initialization lets attackers create accounts with unsafe owners.

  • Paymaster validation is too broad or replayable.

  • Gas fields enable gas griefing.

How to test or review it

  • Run valid and invalid operations through simulation and handleOps.

  • Test account deployment through the factory path.

  • Check sender-funded and paymaster-funded operations.

  • Replay operations with changed nonce, chain, EntryPoint, and calldata.

  • Validate failure behavior for account validation, paymaster validation, and execution reverts.

Account Abstraction

Account abstraction lets smart contract accounts define their own validation rules instead of relying only on externally owned account transaction rules.

UserOperation

A UserOperation is the ERC-4337 data structure that describes a smart account action, including sender, nonce, calldata, gas fields, optional paymaster data, and signature.

Bundler

A bundler is an ERC-4337 actor that receives UserOperations, simulates validation, bundles valid operations, and submits them to the EntryPoint contract.

Paymaster

A paymaster is an ERC-4337 contract that can sponsor gas for a UserOperation when its validation rules pass.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like ERC-4337 into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources