QA Report

[c4-submissions]

See the markdown file with the details of this report here.

[bytes032]

5 l 1 r 4 nc

| [L‑01] | Paymaster can spend arbitrary amounts of gas which are subtracted from user gas limit |
l

| [L‑02] | storePaymasterContextAndCheckMagic() does not check offest is exactly 64 |
l

| [L‑03] | ChainID is not verified to match the current chain ID in Legacy EIP-155 transactions |
l

| [L‑04] | Overflow in lengthRoundedByWords() leads in incorrect lengths |
l

| [L‑05] | Overflow in pointer calculations may read pointer from outside memory range |
l

| [NC‑01] | Gas Per PubData is not signed unless using EIP-712 signatures |
nc

| [NC‑02] | ECRecover does not have constraints for s < n and r < n |
nc

| [NC‑03] | ECRecover does not allow x_overflow to be set |
nc

| [NC‑04] | Check _bytecode.length != 0 in publishCompressedBytecode() |
nc

| [NC‑05] | Calling precompile contracts with delegatecall has inconsistent results |
r

[c4-judge]

GalloDaSballo marked the issue as grade-b

[GalloDaSballo]

Exceptionally awarding double duplicate at 25% due to the valid finding that has low info and no POC

Also awarding B for the unique report

Ultimately this warden should have spent more time and sent some findings as Medium after weaponizing them