ADI Chain / Gasless Paymaster
Hacken reviewed ADI Chain (ADI Chain / Gasless Paymaster) on 24 Feb 2026: 16 findings, 1 critical; all marked fixed.
Report hosted on hacken.io.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 0 | 12 |
CriticalUnsigned preVerificationGas in Paymaster Commitment Hash Enables Full Deposit Drain via a Single Sponsored UserOperationFixed
The report gives no description here.
HighMissing requiredPreFund Validation Allows Uncontrolled Operation CostsFixed
The report gives no description here.
HighWhitelisted Addresses Can Drain Full Deposit Regardless of Configured CapsFixed
The report gives no description here.
MediumSplit Ownership Between Ownable and AccessControl Allows Deployer to Drain Paymaster FundsFixed
The report gives no description here.
LowAtomic Whitelist Configuration Not SupportedFixed
The report gives no description here.
LowDifferent Fee Cap Semantics Between Authorization PathsFixed
The report gives no description here.
LowExcessively Trusted Whitelisted Users Bypass all Transaction ProtectionsFixed
The report gives no description here.
LowImproper Comparison of Packed accountGasLimits Allows Bypass of callGasLimit CapFixed
The report gives no description here.
LowMissing Input Validation on Admin Configuration FunctionsFixed
The report gives no description here.
LowMissing Zero Address Check for Contract OwnerFixed
The report gives no description here.
Show 6 more
LowNo Global Safety Caps for Gas Parameters in Signature Validation PathFixed
The report gives no description here.
LowNo View Function to Validate Signatures Pre-submissionFixed
The report gives no description here.
LowPaused State Does Not Gate Fund Withdrawal FunctionsFixed
The report gives no description here.
LowresetWhitelistTxCount Does Not Reset Per-Block Counter Leading to Inconsistent StateFixed
The report gives no description here.
LowUnused userOpHash ParameterFixed
The report gives no description here.
LowValidated Event Declared but Never EmittedFixed
The report gives no description here.
Contracts in scope1
| Address | Chain | Source code |
|---|---|---|
| 0x8b1484d57abbe239bb280661377363b03c89caea | Chain: Ethereum | Source code: Verified source |
Part of ADI Chain’s security record
ADI ChainSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us