Triaged by Account Abstraction Team

smart contract

Solidity

Ethereum Account Abstraction

Active now

up to $250,000

Started date16 Sep 2024

Last updated08 Jan 2025

Submitted reports69

Total rewards$12,000

First response3 days

Triage time14 days

Reward time14 days

Resolution time90 days

Severity

Critical$100,000 - $250,000

High$25,000 - $50,000

Medium$5,000 - $10,000

Low$1,000 - $2,000

Supported by

What is Account Abstraction?

Account abstraction moves crypto from the current approach of a simple EOA account, where one can lose everything with a small mistake, to a future where an account can be tailored to their needs using smart contracts. The shift from EOAs to smart contract wallets with arbitrary verification logic paves the way for a series of improvements to wallet designs, as well as reducing complexity for end users. Thanks to the ERC-4337 protocol, account abstraction is made possible without having to compromise on the core principles of the Ethereum blockchain such as decentralization, censorship resistance, security, etc.

Use Cases

Streamlined Actions

Smart accounts revolutionize transaction security with multi-signature capabilities. Require approvals from multiple parties before execution, ensuring precise control over critical operations. Perfect for managing shared resources or securing high-value transactions.

Social Recovery Made Easy

Losing access no longer means losing funds. With social recovery, you can designate trusted guardians—friends, family, or devices—to help regain account access through multi-signature verification. This blend of community and technology ensures peace of mind in every situation.

Enhanced Security

Protect your interactions with trusted smart contracts through whitelisting. Whether dealing with decentralized apps or personal wallets, this feature minimizes exposure to malicious actors, creating a secure environment for your digital activities.

Temporary Access with Session Keys

Need to grant short-term or restricted access? Session keys are the answer. These keys allow limited permissions, such as temporary wallet access or specific dApp usage, ensuring your primary account remains protected, even if a session key is compromised.

Subsidized Gas Fees

Lower barriers for new users and improve engagement with sponsored gas fees. Smart accounts let projects cover transaction costs, simplifying onboarding and enabling seamless participation in NFT launches, token swaps, or airdrops without upfront fees.

Transaction Batching

Streamline complex processes by combining multiple steps into a single transaction. For instance, swap tokens on a decentralized exchange without executing multiple actions, reducing costs and enhancing user experience. Efficiency meets convenience.

1. Introduction to AA

1.1 Introduction to AAGuides, references and resources that will help you build with ERC-4337

5 min read

1.2 AA ArchitectureThere are several main components to ERC-4337: UserOperation, Bundler, EntryPoint Contract, Account Contract, Account Factory Contract and Paymaster Contract

5 min read

1.3 ERC-4337 ComponentsAll components of ERC-4337 revolve around a pseudo-transaction object called a UserOperation which is used to execute actions through a smart contract account. This isn't to be mistaken for a regular transaction type.

5 min read

1.4 What is the EntryPoint ContractThe EntryPoint contract (which also includes a couple of others, such as StakeManager) is a singleton. There should only be one implementation because only one instance should exist on each chain.

5 min read

1.5 Account ContractWith EOAs, the address is consistent across all EVM networks. As long as the user has access to the private key they can access the same address on any network. Ideally, we would like to create the same user experience with contract accounts.

5 min read

2. What are AA Bundlers

2.1 What are AA BundlersA bundler is the core infrastructure component that allows account abstraction to work on any EVM network without requiring any changes to the protocol. Its purpose is to work with a new mempool of UserOperations and get the transaction included on-chain.

5 min read

2.2 How to build with AA BundlersIf you want to build your own bundler, it's crucial that it passes all the tests covered in our test suite. More on this in the testing a bundler section. A good reference point to start with is our basic implementations of a bundler. This bundler focuses on being compliant, not on being fast.

5 min read

2.3 How to run AA Bundlers

5 min read

3. What are AA Paymasters

3.1 What are AA PaymastersOne of the main reasons why the user experience of using EOAs is so difficult is because the wallet owner needs to find a way to get some ETH before they can perform any actions on-chain. With paymasters, ERC-4337 allows abstracting gas payments altogether, meaning someone other than the wallet owner can pay for the gas instead.

5 min read

3.2 Build and Deploy a Paymaster in SolidityIn Account Abstraction, a Paymaster gives you the ability to have someone pay for the gas on a transaction on behalf of a smart account. For your production applications using account abstraction, we recommend you use the Account Kit, which has everything you need to provide audited, production-ready smart contract accounts for your users. If you're looking to become more effective with account abstraction by learning it deeply, you're in the right spot!

19 min watch

4. Running AA

4.1 How to run AAThis series "Smart Accounts From Scratch" is intended to help you learn ERC 4337 by working directly with the relevant smart contracts and calldata objects. For your production applications using account abstraction, we recommend you use the Account Kit, which has everything you need to provide audited, production-ready smart contract accounts for your users. If you're looking to become more effective with account abstraction by learning it deeply, you're in the right spot!

49 min watch

Mark your name in

Ethereum History