EIP-4337
OpenZeppelin reviewed Ethereum.org (EIP-4337) on 19 Apr 2022: 25 findings, 1 critical; 16 marked fixed, 9 open.
Report hosted on blog.openzeppelin.com.
Trustblock does not review code.
Findings25
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 5 |
| Medium | 2 | 0 | 2 |
| Low | 7 | 0 | 8 |
Critical[C01] Deposit manipulation [core]Fixed
The report gives no description here.
High[H01] Incorrect prefund calculation [core]Fixed
The report gives no description here.
High[H02] Duplicate validation gas accounting [core]Fixed
The report gives no description here.
High[H03] Paymasters can spend locked stake [core]Fixed
The report gives no description here.
High[H04] Token transfers may fail silently [sample]Fixed
The report gives no description here.
High[H05] Incorrect gas price [core]Fixed
The report gives no description here.
Medium[M01] Inconsistent behavior between ecrecover2 and ecrecover [sample]Fixed
The report gives no description here.
Medium[M02] Separate stake and prepayment [core]Fixed
The report gives no description here.
Low[L02] Incorrect event parameter [core]Fixed
The report gives no description here.
Low[L04] Inconsistent minimum stake delay [core]Fixed
The report gives no description here.
Show 6 more
Low[L05] Incorrect balance check comparison in TokenPaymaster [sample]Fixed
The report gives no description here.
Low[L06] handleOp function is redundant [core]Fixed
The report gives no description here.
Low[L07] Event misordering possibility [core]Fixed
The report gives no description here.
Low[L08] Paymasters cannot reduce unstaking delay after withdrawal window [core]Fixed
The report gives no description here.
Low[L13] Missing validations [core]Fixed
The report gives no description here.
Low[L14] DepositPaymaster warning [sample]Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (9)
- contracts/EntryPoint.sol
- contracts/samples/SimpleWalletForTokens.sol
- contracts/StakeManager.sol
- contracts/IWallet.sol
- contracts/UserOperation.sol
- contracts/samples/DepositPaymaster.sol
- contracts/samples/VerifyingPaymaster.sol
- contracts/samples/TokenPaymaster.sol
- contracts/samples/SimpleWallet.sol
Part of Ethereum.org’s security record
Ethereum.orgSecurity firm
OpenZeppelin67 projects reviewed · 184 reports · latest Aug 2026
See OpenZeppelin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us