Alchemy - LightAccount v2

QuantstampRepository at commit 93f46a2

Audit

Quantstamp reviewed Alchemy ERC (Alchemy - LightAccount v2) on 9 Apr 2024: 4 findings, 0 critical; 3 marked fixed, 1 open.

No open critical findings
Open the reportOpen Alchemy ERC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low103
Low`SIG_VALIDATION_FAILED` Shouldn't Be Returned in All the Cases of ECDSA FailureFixed

When an EOA signature is submitted, it is decoded via `digest.tryRecover(signature)`. This function call returns the address recovered and an error of type `ECDSA.RecoverError`. There are currently 4 entries in the `ECDSA.RecoverError` enum: ``` 1. NoError, 2. InvalidSignature, 3. InvalidSignatureLength, 4. InvalidSignatureS ``` In the current iteration of the code base, in the case of the 3 invalid errors, `SIG_VALIDATION_FAILED` is returned, which is not entirely correct, as it should only be returned if a signature is correctly formed but the validation fails. The only case where `SIG_VALIDATION_FAILED` should be returned is `NoError`, but the signer does not match the expected `owner`, which means that the signature is correctly formed, but the validation fails. In the case of `InvalidSignatureLength`, `InvalidSignatureS` and `InvalidSignature`, the signature itself is invalid; in the first case, the signature is not of length `65`. In the second error, the `s` value is in the upper range, and in the last error, either `r = 0`, `s = 0`, or `r` is too large.

LowMissing Input ValidationFixed

It is important to validate inputs, even if they only come from trusted addresses, to avoid human error. Specifically, in the following functions: 1. `BaseLightAccount.withdrawDepositTo()` should check that `withdrawAddress` is not `address(0) `. 2. `BaseLightAccountFactory.withdrawStake()` should check that `to` is not `address(0) `. 3. `BaseLightAccountFactory.withdraw()` should check that `to` is not `address(0) `.

LowPotential Gas Griefing by Changing the Signature Verification ModeFixed

The `_validateSignature()` function of `MultiOwnerLightAccount` allows the user operation to be validated in three different modes based on the first byte of `userOp.signature`. The mode `SignatureType.CONTRACT` iterates through the owner list until it finds an owner contract accepting the given signature. On the other hand, the mode `SignatureType.CONTRACT_WITH_ADDR` only checks if one owner contract accepts the signature, which provides potential gas savings as the iteration through the owner list is avoided. However, an adversary who listens to the user operation requests, such as a bundler, can modify the first byte of `userOp.signature` and force the account to use a more gas-expensive signature validation mode by switching from `CONTRACT_WITH_ADDR` to `CONTRACT`. If the specified verification gas limit in the user operation is sufficiently high, the signature validation can still pass since the only-provided signature is correct. Note that the user operation signer is usually not incentivized to set an overly high verification gas limit. Also, the incentive for an adversary to perform such an attack seems low since they do not directly gain profit. Due to the above reasons, this issue is considered Info severity.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (77)

  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421614/run-1699550880.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gitignore at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/5/run-1699396605.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/MultiOwnerLightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/CustomSlotInitializable.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/MultiOwnerLightAccount.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84532/run-1700012407.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/5/run-1696378288.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80002/run-1709245761.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/audits/2024-01-09_quantstamp_aa8196b.pdf at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1699396573.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.env.example at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/remappings.txt at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/LightAccount.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/slither.config.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1699398372.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1699396434.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1704923219.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/7777777/run-1710446999.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1704924099.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1704916308.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421614/run-1704922830.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/Deployments.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84531/run-1696380309.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gasestimates.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1696379892.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1696378528.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1696382079.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1704923473.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155420/run-1704923976.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/LightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1704916013.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/EIP712.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1696380977.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/LICENSE-MIT at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/2523/run-1710447252.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/script/Deploy_LightAccountFactory.s.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/LightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1704925372.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1696380432.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/img/light-account.jpg at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/MultiOwnerLightAccountFactory.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1704923603.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/8453/run-1699396019.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/LICENSE-GPL at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/421613/run-1699396097.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/MultiOwnerLightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/foundry.toml at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.github/workflows/test.yml at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/1/run-1699396674.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/10/run-1699398298.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1696377842.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84531/run-1699395850.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/LightAccountFactory.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/utils/inspect.sh at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/84532/run-1704925784.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/ERC1271.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/BaseLightAccount.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/README.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1699396506.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1696379210.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155111/run-1704906675.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.vscode/settings.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/80001/run-1696378862.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/42161/run-1704916394.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/999999999/run-1710447073.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/common/BaseLightAccountFactory.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/LibClone.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.storagelayout.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/test/CustomSlotInitializable.t.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/420/run-1696379735.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.gitmodules at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/.github/pull_request_template.md at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/src/external/solady/UUPSUpgradeable.sol at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/11155420/run-1700011145.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/137/run-1699396531.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2
  • https://github.com/alchemyplatform/light-account/broadcast/Deploy_LightAccountFactory.s.sol/252/run-1710447162.json at commit 93f46a243c59611118d5bb99df08b42af14b34b2

Part of Alchemy ERC’s security record

Alchemy ERC
Audits6 audits by 1 firmLast audit May 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 6 reports.
Open Alchemy ERC’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us