Threat Modeling

This thread outlines potential attack vectors when using the Paymaster. Attackers can be any entity involved in the operations, and attacks may also stem from unexpected behavior in the Ethereum blockchain state or malicious mempool actors. We categorize these vectors into several states, and where possible, provide test code and attack scenarios like rug-pulls, honeypot scams, and more.

These pages are still in development, and there may be additional vectors due to ERC-4337 updates or newly/currently deployed services. If you discover any new or unknown vectors, please report them to us via GitHub or email. We’re excited to collaborate with you in identifying these issues!