Alchemy Modular Account

Quantstamp30 Jan 2024Files named in the report

Quantstamp reviewed Alchemy ERC (Alchemy Modular Account) on 30 Jan 2024: 33 findings, 0 critical; 21 marked fixed, 11 acknowledged, 1 open.

No open critical findings

Open the report Open Alchemy ERC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings33

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	2
Medium	1	2	3
Low	0	9	16

MediumOther Plugins May Enable Runtime Execution of Session KeysOpen

As mentioned in the code comments at L245-L247, session keys are only expected to be used in the user operation context. Therefore, `SessionKeyPlugin` does not define the runtime validation function for `executeWithSessionKey()`, with the assumption that any function call in runtime to `executeWithSessionKey()` will revert due to the lack of validation function. In usual cases, such design should work as expected since `UpgradeableModularAccount` reverts with a `RuntimeValidationFunctionMissing()` error if the validation function corresponding to a runtime call does not exist, except the cases for self-calls to `installPlugin()` or `upgradeToAndCall()`. However, any other installed plugin can add a runtime validation function to `executeWithSessionKey()`, enabling and allowing session keys in runtime. Also, during the runtime call, the session key validation implemented in `userOpValidationFunction()` will be bypassed and not enforced.