Indorse

The check (msg.sender == entrypoint) is used multiple times and can be converted into a modifier.

A number of externally facing functions in the codebase are declared public but are not called internally or cross-contract. If there is no chance to reuse these functions in an internal contract call (because external functions cannot be called within the same contract), as external functions are cheaper than public functions it would be beneficial to adjust the function visibility. In KillSwitchValidator.sol, ECDSAValidator.sol, ERC165SessionKeyValidator, MultiECDSAValidator, SessionKeyOwnedValidator, the functions (i) getAccountAddress() and (ii) validateSignature() can be declared external instead of public.

In Kernel, it is expected that the execute() function is called with the target contract `to` being an external contract. The risk here is that an EOA can be delegatecalled or called and returns true as though it were a successful contract call. The execution fails to happen and there would be no reverts to show why.

There is no validation of the `to` addresses in the executeBatch() as well as the `tokenAddress` array of approveAndTransfer20Batch() of BatchActions.sol. If there is no check, transfers can go to address(0), value and data could also be zero values.

In the validateUserOp function in Kernel.sol, there is a redundancy found in variable assignment and declaration. It is unnecessary to initialize variables to the default value (e.g. uint256 i = 0), or to reassign the same variable to itself (unchanged) in the same function execution.In the Kernel.sol file, `op` is assigned the same value twice.

There is a slight discrepancy between the OpenZeppelin implementation and the EIP1967Proxy implementation, as msg.value is not checked. The check for msg.value is because when the data length passed is 0, it does not initiate the delegatecall to the logic contract and the value passed can get stuck in the contract.

The MultiECDSAKernelFactory utilizes the onlyOwner modifier inherited from the Ownable library. Functions in this contract with this modifier adjust key parameters in the entrypoint’s stake and the owners array. If the owner (from onlyOwner) is compromised, stake can be unlocked and withdrawn, or malicious users can be added to the `owners` array.

The Kernel smart wallets are expected to be deployed on multiple EVM-based chains, some of which are Optimism, Arbitrum, Scroll, Linea, Polygon and Base) however solidity pramga versions above 0.8.19 may prove incompatible on chains like Arbitrum which do not support the PUSH0 opcode. To ensure the same deterministic bytecode is available across all chains, consider locking the pragma versions to 0.8.19.

The logic address passed in to the EIP1967 proxy is used to deploy new kernel accounts. Although this happens only once, when the proxy is deployed there is no check for address validity. An EOA can be passed into the constructor which will pass the delegatecall without reverting.

IKernel is an empty interface declared and not used within the contract.