Pimlico ERC20 Paymaster
Summary
In this audit, we reviewed two ERC20-Paymaster implementations and their configurable oracles used for price calculations. As the naming suggests, `ERC20PaymasterV06.sol` is intended for Entrypoint V0.6 implementations and `ERC20PaymasterV07.sol` for Entrypoint V0.7 implementations. Both implementations fetch token prices via a combination of two of the three provided oracles (`ManualOracle.sol`, `FixedOracle.sol` and `TwapOracle.sol`). Three Medium severity issues were uncovered, two of them related to the paymaster possibly not charging a sufficient token amount from the guarantor or user operation signer (PIM-1, PIM-2). Furthermore, in two separate occasions in the user operation validation, the storage restrictions as defined by ERC-7562 are violated, which will cause user operations to be dropped by canonical bundlers and will require whitelisting in bundlers (PIM-3). We deem the codebase to be in very shape, with good documentation and proper test coverage. However, the test coverage execution command currently causes nine tests to fail; tests that for unidentified reasons pass in regular test execution. **Update Fix-Review:** All issues have been fixed or reasonably acknowledged. The paymasters will continue require whitelisting with bundlers due to PIM-3, which however imposes no security risks.
