ERC-4337

The Smart Contract Wallet is the user's on-chain account, replacing the traditional Externally Owned Account (EOA). It is a smart contract that holds assets and executes logic defined by its owner. Key capabilities include:

• Social Recovery: Designate guardians to recover access.
• Transaction Batching: Execute multiple actions in one call.
• Spending Limits & Session Keys: Set rules for dApp interactions.
• Gas Sponsorship: Allow third parties to pay for transaction fees.

A UserOperation is a pseudo-transaction object that represents a user's intent. It is not a native Ethereum transaction but is submitted to a dedicated mempool. It contains:

• Sender: The smart contract wallet address.
• Nonce: Prevents replay attacks.
• CallData: The actions for the wallet to execute.
• Signature: Cryptographic proof of intent, which can be flexible (e.g., multisig, passkey).
• Paymaster Data: Instructions for gas payment sponsorship.

The Bundler is a network node (often a searcher or validator) that listens for UserOperations from a peer-to-peer mempool. Its primary functions are:

• Aggregation: Collects multiple UserOperations.
• Validation: Simulates each operation to ensure it will pay fees.
• Submission: Packages valid operations into a single standard Ethereum transaction and submits it to the base layer. Bundlers earn fees for this service, similar to block builders.

A Paymaster is a smart contract that can sponsor gas fees for users, enabling key use cases like:

• Gasless Transactions: DApps or companies pay fees for their users.
• Pay with ERC-20 Tokens: Users pay fees in tokens like USDC instead of ETH.
• Subscription Models: Sponsored transactions for subscribed users. The Paymaster contract validates sponsorship conditions and reimburses the Bundler, abstracting gas complexity from the end-user.

The EntryPoint is a singleton, audited system-level smart contract that acts as the central orchestrator. All Bundlers send their bundled transactions to this single contract. It is responsible for:

• Orchestrating Flow: Calling each user's Smart Contract Wallet and Paymaster in the correct order.
• Enforcing Security: Ensuring atomic execution—if any part of the bundled operations fails, the entire bundle reverts.
• Handling Deposits: Managing staked funds from Paymasters and wallets for fee payment.

ERC-4337 creates a separate, parallel UserOperation mempool distinct from the standard Ethereum transaction mempool. This dedicated space is for:

• Structured Data: Holding UserOperation objects, not raw transactions.
• P2P Network: Bundlers and clients gossip UserOperations among themselves.
• Different Rules: Operations are validated against higher-level rules (e.g., signature type, paymaster sponsorship) before being considered for bundling.

Applications can pay for their users' transaction fees, creating a seamless onboarding experience. This gas sponsorship can be implemented via:

• Paymasters: Smart contracts that pay fees on a user's behalf, potentially accepting payment in any ERC-20 token.
• Example: A dApp offers free minting by covering gas costs, or a company pays for employee onboarding transactions.

Users can approve multiple operations in a single signature, enabling complex interactions. This is critical for:

• DeFi Swaps: Approve token spend and execute a trade in one click.
• Gaming: Perform multiple in-game actions (move, attack, loot) as a single atomic transaction.
• Session Keys: Grant a dApp temporary, limited permissions (e.g., for a gaming session) without constant wallet pop-ups.

Bundlers are a new actor in the network, responsible for collecting UserOperations from the mempool, bundling them, and submitting them to the blockchain. They act like miners/validators for account abstraction.

• Function: They ensure UserOperations are valid and profitable to include.
• Ecosystem: Services like Stackup, Alchemy, and Pimlico operate bundler infrastructure, creating a decentralized relay network.

ERC-4337 is the foundation for removing key UX barriers to mainstream adoption:

• Seedless Wallets: Create a wallet using just an email or social login (via secure MPC technology).
• Subscription Payments: Set up recurring payments for services without manual approvals.
• Enterprise Use: Companies can implement complex treasury management rules (approval workflows, daily limits) directly in their smart account logic.

A Paymaster is an entity that can sponsor transaction gas fees. This creates a centralization and censorship risk, as a Paymaster can refuse to sponsor transactions for certain users or specific operations. Key risks include:

• Censorship: A Paymaster could block interactions with specific dApps or smart contracts.
• Rug Pulls: A malicious Paymaster could front-run and change its sponsorship policy.
• Dependency: User operations fail if the designated Paymaster is offline or insolvent.

Decentralized Paymaster networks and permissionless sponsorship models are active areas of research to mitigate these risks.

Bundlers are the nodes that package and submit UserOperations to the blockchain. Their economic incentives introduce security considerations:

• Maximal Extractable Value (MEV): Bundlers can reorder, censor, or insert their own transactions into the bundle to extract value, similar to block builders in traditional Ethereum.
• Staked Bundlers: The protocol may evolve to require staking, creating a potential attack surface for slashing conditions.
• Resource Exhaustion: A Bundler must validate UserOperations off-chain before submitting them, making it vulnerable to DoS attacks via complex validation logic.

The user's Smart Contract Account is now a programmable contract, expanding the attack surface beyond Externally Owned Accounts (EOAs). Critical risks include:

• Upgrade Logic: A malicious or buggy account upgrade could drain all funds.
• Signature Verification: Custom signature schemes (e.g., multisig, social recovery) must be implemented correctly to prevent forgery.
• EntryPoint Reentrancy: The canonical EntryPoint contract must be protected against reentrancy, as it handles funds from multiple accounts.
• Gas Limits: validateUserOp must have strict gas limits to prevent Bundler DoS.

ERC-4337 decouples transaction authorization from the ECDSA signature, enabling signature abstraction. This flexibility introduces new phishing risks:

• Malicious Sessions: A signed UserOperation could grant a dApp unlimited spending power for a session, unlike a one-time transaction approval.
• Opaque UserOperations: Users may sign complex calldata they don't fully understand, leading to unintended asset approvals or transfers.
• UI Deception: Wallets must clearly visualize the full intent of a UserOperation, not just a hash, to prevent sophisticated phishing.

All UserOperations flow through a single, global EntryPoint smart contract. This creates systemic risk:

• Protocol Upgrade: A critical bug in the EntryPoint could affect all ERC-4337 accounts. A secure upgrade mechanism is essential.
• Congestion: If the EntryPoint becomes a target for spam or a gas-guzzling contract, it could degrade the entire system's performance.
• Centralization: While the contract is immutable and permissionless, network effects could lead to a single dominant implementation, reducing client diversity.

A primary benefit of smart accounts is programmable social recovery, but its security depends on the guardian model:

• Guardian Collusion: A majority of guardians could conspire to steal the account.
• Guardian Compromise: If guardians use insecure keys or wallets, they become attack vectors.
• Recruitment Delay: A malicious actor who gains temporary access could set a long delay for recovery, then compromise the account after the window.

Secure designs use decentralized guardians, multi-sig schemes for recovery, and carefully tuned time locks.

The EntryPoint is a singleton, audited smart contract that acts as the system's orchestrator. It validates and executes UserOperations (user intents) in batches, ensuring atomicity and managing gas payments. This contract is the primary on-chain component that bundlers interact with, providing a standardized and secure execution layer for all ERC-4337 accounts.

New off-chain actors enable flexible transaction sponsorship and relay.

• Bundlers: Special nodes that package UserOperations from the mempool into a standard Ethereum transaction, paying gas fees and submitting them to the EntryPoint. They earn fees via priority gas auctions.
• Paymasters: Smart contracts that can sponsor transaction fees for users, enabling gasless UX or payment in ERC-20 tokens instead of ETH.

ERC-4337's primary user-facing component is the smart account (or smart contract wallet). Unlike Externally Owned Accounts (EOAs), these accounts are programmable, enabling features like:

• Social recovery and multi-signature security.
• Session keys for limited permissions.
• Batch transactions executed atomically.
• Gas abstraction via paymasters. Examples include Safe{Wallet}, ZeroDev, and Biconomy Smart Accounts.

ERC-4337 introduces a new UserOperation mempool, separate from the standard Ethereum transaction mempool. This dedicated space is for pending user intents, which are objects containing the transaction details, signature, and gas parameters for a smart account. Bundlers monitor this mempool, competing to include UserOperations in the next block based on fee incentives.

Rapid adoption is driven by comprehensive developer tooling that abstracts the protocol's complexity.

• Account Abstraction SDKs: Libraries like ZeroDev, Biconomy, and Alchemy's Account Kit provide APIs to create, manage, and interact with smart accounts.
• Bundler & Paymaster APIs: Services like Stackup, Pimlico, and Alchemy offer hosted bundler infrastructure and paymaster services, allowing developers to integrate ERC-4337 without running their own nodes.

ERC-4337 is becoming the standard for account abstraction across the EVM ecosystem, accelerating adoption on Layer 2 networks. Its protocol-level design allows for:

• Portable user experience: A smart account's logic can be deployed and used identically on Ethereum mainnet, Arbitrum, Optimism, Polygon, and other EVM chains.
• Unified infrastructure: Bundler and paymaster services are being deployed across multiple chains, providing consistent developer and user experiences.