Indorse

It is highly recommended to have above 95% of code functionality tested before going into production so as to catch bugs that could be introduced from user input as well as return values from function calls.

In a bid to save gas, calldata is preferred over memory, especially in user-supplied arrays that are looped over. Since the array content is not modified, the function parameters can be declared as calldata instead of memory.

The array is totally replaced without noting that the owner array is completely rewritten with every setOwners() call and not appended. [low]

The ECDSAValidator does not emit an event for disabling validators. Monitoring processes would be easier to perform if logs were generated for account deletion.

Custom errors can be used to reduce gas costs for returning long strings. They are usually cheaper than string reverts.

The function validateSignature() tries to recover data using the ECDSA scheme for hashed data and user-inputted data as well. The same happens in validateUserOp within the SessionKeyValidator, MultiECDSAValidator and ECDSAValidator. The repeated code can be reduced and

There are multiple mentions of zerodev.kernel in the codebase. Understandably, this is a fork of the zerodev project but these portions of the codebase can be refactored as there are no hardcoded calculations making strict use of the storagePosition formed by hashing the string “zerodev.kernel”.

When setOwners in MultiECDSAKernelFactory is called, it passes an array of addresses but does not check whether the addresses passed are unique. Non-unique addresses can unnecessarily increase the length of the array thereby increasing the number of times the loop has to run.