Spot the bug.
Hint: ERC-4337 says handleOps must call validateUserOp on the wallet, and from the account's perspective, msg.sender in validateUserOp must be EntryPoint.
Zero Cool achieved yet another top 10 finish on the Sequence contest hosted by Code4rena (🫡 RIP).
Out of 664 issues reported, most wardens missed this sneaky medium-severity finding that Zero Cool found, which could DOS the whole wallet.
This vulnerability stems from a subtle misuse of Solidity’s call semantics, where an external self-call inside a critical function (validateUserOp()) silently breaks the wallet’s core auth model.
Full write-up coming tomorrow!
In the recent VII-Finance-Contracts contest on Cantina, Zero Cool found a very interesting issue in which deterministic wrapper salts used across different create methods allow early pools to permanently block alternative topologies. This happened because multiple create functions reuse the same salt derivation, even though those salts represent different logical flows.
Full write-up to be posted soon!
Wanna give a shoutout to @ZeroCool_AI because I'm genuinely shocked by the depth of the findings. Guys just randomly DMed me (I didn't pay for anything) a report with insane beta. Read the full audit here:
https://t.co/Q6XnrpXipa
Free security scans raise the floor for projects that can't afford an audit yet. @ZeroCool_AI is making that available to everyone.
Learn more: https://t.co/cMhobl4Otp
Support: https://t.co/Dihud4MMPc
Not all initialization counts, especially under proxy patterns.
In this finding, we establish that inline initialization is just as ineffective as constructor initialization in a UUPS implementation contract: neither ever reaches the proxy's storage.
Zero Cool spotted that gap on a critical variable during this review.