@ancilar

A paymaster we reviewed paid for the transactions that drained it. Sponsor gas so onboarding does not stall at a funding step. Standard. What was missing was the policy layer. The paymaster checked that a user operation was well formed, then paid. It never asked whether the operation was worth paying for. The attacker did not need an exploit. They needed a loop. Thousands of valid, worthless operations, each one sponsored, each one draining the deposit. The quarter's budget was gone before anyone checked the balance. We surfaced it by simulating a hostile user with no interest in the app, only in the gas. The fixes were policy, not rewrites: → sponsor intent, so only calls to your methods qualify → per user and per action caps on a window, not a lifetime → rate limits in validation, before the bundler sees it → a kill switch that pauses sponsorship without redeploying Gas sponsorship runs unattended at machine speed. A paymaster that pays for any valid transaction will pay for the wrong one.

0 reply

0 recast

0 reaction