ERC-4337 Paymasters Found Widely Vulnerable to Exploits Due to Weak Access Controls

A growing number of ERC-4337 paymaster smart contracts contain critical security flaws that expose them to fund theft, spam attacks, and forged transaction sponsorship. Paymasters, which cover gas fees on behalf of users in account abstraction wallets, often lack proper access controls because developers replicate minimal example code from tutorials and SDKs without adding production-grade hardening. Key vulnerabilities include open sponsorship logic that lets anyone drain a paymaster's deposit, missing emergency withdrawal functions, and inadequate signature and nonce validation that enable replay attacks. Security researchers have identified these patterns across live deployments on GitHub and in widely used SDKs, warning that a single unguarded validatePaymasterUserOp function can turn a paymaster into a free gas bank for attackers. Developers are advised to enforce allowlists or owner-only authorization, restrict fund withdrawals, and implement robust signature verification to secure their paymaster contracts.