Alchemy - LightAccount v2

QuantstampRepository at commit 93f46a2

Audit

Quantstamp reviewed Alchemy ERC (Alchemy - LightAccount v2) on 9 Apr 2024: 4 findings, 0 critical; 3 marked fixed, 1 open.

No open critical findings
Open the reportOpen Alchemy ERC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low103
LowUncleared Upper Bits of Variables in Inline AssemblyOpen

In the `_getCombinedSalt()` function of `LightAccountFactory`, the input parameter `owner` is an address, and hence the upper bits are not guaranteed to be 0 when reading its value in assembly. According to the latest [Solidity Inline Assembly documentation](https://docs.soliditylang.org/en/v0.8.25/assembly.html) at the time of writing: > "If you access variables of a type that spans less than 256 bits (for example uint64, address, or bytes16), you cannot make any assumptions about bits not part of the encoding of the type. Especially, do not assume them to be zero. To be safe, always clear the data properly before you use it in a context where this is important […]" Any dirty upper bit in `owner` may lead to a different result of `_getCombinedSalt()` and, therefore, a different account address.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (77)

  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421614/run-1699550880.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gitignore at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/5/run-1699396605.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/MultiOwnerLightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/CustomSlotInitializable.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/MultiOwnerLightAccount.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84532/run-1700012407.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/5/run-1696378288.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80002/run-1709245761.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/audits/2024-01-09_quantstamp_aa8196b.pdf at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1699396573.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.env.example at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/remappings.txt at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/LightAccount.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/slither.config.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1699398372.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1699396434.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1704923219.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/7777777/run-1710446999.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1704924099.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1704916308.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421614/run-1704922830.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/Deployments.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84531/run-1696380309.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gasestimates.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1696379892.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1696378528.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1696382079.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1704923473.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155420/run-1704923976.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/LightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1704916013.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/EIP712.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1696380977.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/LICENSE-MIT at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/2523/run-1710447252.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/script/Deploy_LightAccountFactory.s.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/LightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1704925372.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1696380432.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/img/light-account.jpg at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/MultiOwnerLightAccountFactory.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1704923603.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1699396019.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/LICENSE-GPL at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1699396097.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/MultiOwnerLightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/foundry.toml at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.github/workflows/test.yml at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1699396674.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1699398298.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1696377842.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84531/run-1699395850.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/LightAccountFactory.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/utils/inspect.sh at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84532/run-1704925784.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/ERC1271.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/BaseLightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/README.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1699396506.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1696379210.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1704906675.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.vscode/settings.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1696378862.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1704916394.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/999999999/run-1710447073.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/BaseLightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/LibClone.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.storagelayout.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/CustomSlotInitializable.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1696379735.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gitmodules at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.github/pull_request_template.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/UUPSUpgradeable.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155420/run-1700011145.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1699396531.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/252/run-1710447162.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2

Part of Alchemy ERC’s security record

Alchemy ERC
Audits6 audits by 1 firmLast audit May 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 6 reports.
Open Alchemy ERC’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us