Worked example · 2025-09

ERC-4337 EntryPoint griefing-vector responsible disclosure (TrustSec / HackenProof / Ethereum Foundation) — coordinated disclosure 2025-09 → patched in v0.9 — 2025

Loss: $0 realised on-chain extraction; the vulnerability was identified by the TrustSec research team, disclosed via HackenProof's Account-Abstraction-Bugs bug-bounty programme, and coordinated with the Ethereum Foundation under responsible disclosure prior to public release. The defect was a denial-of-service / griefing class affecting paymaster-sponsored UserOperations under specific observable conditions — paymasters could be charged for gas on UserOperations whose inner execution reverted, and bundlers could be forced to pay gas costs on handleOps reverts that the EntryPoint specification did not adequately bound. Because the disclosure path produced a coordinated patch (EntryPoint v0.9) prior to public release, no public victim losses are attributable to this specific defect, although the underlying class — paymaster funds drained without producing useful protocol activity — is the canonical T13.001.004 (Paymaster Griefing) sub-Technique surface and the disclosure is the closest the 2024–2026 cohort has to a confirmed-attribution worked example for that class. HackenProof's case-study disclosure characterises the severity as "high" in the bug-bounty programme's taxonomy.
Recovery: prevented before realisation. The Ethereum Foundation's account-abstraction working group (eth-infinitism/account-abstraction repository) shipped EntryPoint v0.9 incorporating the mitigation: the patched handleOps and handleAggregatedOps enforce that they can only be invoked by an externally-owned-account in a top-level transaction context, which prevents the originally-disclosed attack pathway — execution of a UserOperation within an attacker-controlled call frame that introduces re-entrancy or temporary-state-modification surfaces invisible to the bundler's pre-flight simulation. Project Eleven published the canonical post-patch defender-side analysis ([projecteleven2026v09]); HackenProof published the case-study disclosure with TrustSec attribution; the Ethereum Foundation merged the patch into the canonical EntryPoint reference implementation. Bundler-vendors (Pimlico, Stackup, Alchemy, Biconomy) progressively pinned their reference EntryPoint deployments to v0.9 over the 2025-Q4 / 2026-Q1 timeline.
OAK Techniques observed: OAK-T13.001.004 (Paymaster Griefing) — the defect's primary impact is at the paymaster's deposited-balance-drawdown surface and at the bundler's reputation-budget / gas-cost surface. The disclosed mechanism is sub-case (ii) of T13.001.004: a temporary "must-revert" condition can be created in a target contract by attacker-controlled code earlier in the same call stack; a victim's correctly-signed UserOperation validates normally and the inner execution reverts under the temporary condition, but the paymaster pays for the gas regardless. The patch — restricting handleOps invocation to top-level EOA contexts — closes the "earlier in the same call stack" precondition. OAK-T13.001 (umbrella) applies because the defect surfaces at the paymaster's validation / accounting boundary across the full sub-Technique space, although the specific patched sub-case is (ii). The disclosure also touches OAK-T13.002 (Bundler MEV) at the bundler-revert-cost margin: bundlers were exposed to forced-revert costs that the disclosure characterises explicitly. OAK-T9.005 (Reentrancy) is adjacent but not load-bearing — the disclosed defect's mechanism includes attacker-controlled-state at validation time but the artefact is not a contract-internal reentrancy; the EntryPoint contract is correct against its own specification, the failure is structural to the EntryPoint's interaction with attacker-controlled outer call frames.
Attribution: unattributed at the disclosure-and-fix layer (this is the bar required for confirmed strength under OAK's attribution-strength taxonomy: regulator-published / court-published / protocol-team-published-postmortem). The disclosure and remediation are documented in (a) HackenProof's public case-study blog post naming the TrustSec research team as the discoverers and characterising the disclosure pathway, (b) Project Eleven's defender-side analysis of the EntryPoint v0.9 patch describing the specific griefing class closed, (c) the Ethereum Foundation's eth-infinitism/account-abstraction repository's release notes for v0.9 incorporating the patch into the canonical reference implementation, and (d) HackenProof's Account-Abstraction-Bugs bug-bounty programme's public scope and severity taxonomy. The on-chain attacker-side attribution is N/A — there is no public on-chain attack to attribute, because the disclosure path produced a patch before public realisation. Contributors should record this case as confirmed strength specifically because the disclosure-and-remediation chain is fully public; the absence of on-chain attacker attribution does not regress the strength because there is no on-chain attacker.
Key teaching point: the responsible-disclosure path produced a confirmed-attribution worked-example anchor for T13.001.004 (Paymaster Griefing) without realising any public on-chain loss, which is the cleanest defender-positive outcome shape in the OAK 2024–2026 T13 cohort. The TrustSec / HackenProof / Ethereum Foundation coordination chain is the operational template the OAK Mitigations layer should propagate as the canonical pattern for high-severity protocol-layer disclosures: (a) a security-research team identifies the defect against the canonical reference implementation; (b) a coordination intermediary (HackenProof's bug-bounty platform) provides the disclosure channel between the research team and the protocol-team-equivalent (Ethereum Foundation's account-abstraction working group); (c) the protocol team merges a patch into the canonical reference implementation prior to public disclosure; (d) defender-side analysis (Project Eleven) and the disclosure narrative (HackenProof case study) publish concurrently with or after the patched release. The case is the canonical 2025–2026 worked-example anchor for T13.001.004 sub-case (ii) (temporary-revert griefing), and it instructively shows that the closest the OAK 2024–2026 T13 cohort has to a confirmed-attribution incident is a prevented incident rather than a realised one. Defender practice for the T13 surface should treat coordinated-disclosure outcomes as the operational target shape and should treat realised on-chain-loss outcomes as the defender-failure shape.

Summary

ERC-4337's EntryPoint contract is the canonical singleton intermediary between bundlers and smart accounts: bundlers submit batches of UserOperations to the EntryPoint via handleOps and handleAggregatedOps, the EntryPoint runs validation (validateUserOp on the smart account, validatePaymasterUserOp on the paymaster), executes the UserOps, and runs post-execution accounting (postOp on the paymaster). The EntryPoint's specification, since v0.6 (2023), has incrementally hardened the validation / accounting boundary against griefing surfaces: v0.7 added the "unused gas penalty" mechanism specifically to address paymaster-DoS griefing where attackers submitted artificially-high-gas-limit UserOps to drain paymaster deposits, and v0.9 (2025–2026) closes the most recent disclosed griefing class.

In 2025, the TrustSec research team identified a structural defect in the EntryPoint's interaction with attacker-controlled outer call frames. The defect's mechanism: when handleOps or handleAggregatedOps could be invoked from inside another contract's call frame (rather than being restricted to top-level EOA-initiated transactions), an attacker could create a temporary "must-revert" condition in a target contract earlier in the same call stack — the condition would force a victim's correctly-signed UserOperation to revert on inner execution, but the EntryPoint would still charge the paymaster for the gas, and the bundler would still incur the gas cost of the reverted handleOps call. The disclosed defect was characterised as high-severity within HackenProof's bug-bounty programme taxonomy because it enabled denial-of-service and griefing scenarios against paymasters and bundlers under observable conditions — UserOperations propagated through the public alt-mempool, or UserOperations whose target contract used reentrancy protection or temporary-state-modification patterns (DeFi withdrawals, liquidity-related operations).

The disclosure pathway is the analytically distinctive feature of the case at v0.1 freeze. TrustSec disclosed the defect via HackenProof's Account-Abstraction-Bugs bug-bounty programme, which functioned as the coordination channel between the research team and the Ethereum Foundation's account-abstraction working group (eth-infinitism/account-abstraction). The Foundation merged a patch into the canonical EntryPoint reference implementation as EntryPoint v0.9: the patched handleOps and handleAggregatedOps enforce that they can only be invoked by an externally-owned-account in a top-level transaction context. This closes the specific precondition the TrustSec disclosure documented — execution of a UserOperation within an attacker-controlled call frame.

Defender-side analysis followed in two convergent publications. Project Eleven published the canonical post-patch analysis ("ERC-4337 EntryPoint v0.9: Fixing a Griefing Vector in Account Abstraction") describing the specific griefing class closed and the patched primitives. HackenProof published the bug-bounty case-study disclosure ("High-Severity ERC-4337 Account Abstraction Vulnerability: A TrustSec Case Study") naming the research team, characterising the disclosure pathway, and documenting the coordinated remediation. Together these two publications constitute the public record of the defect's technical mechanism, the disclosure pathway, the patch, and the attribution chain.

For OAK's purposes the case is the canonical 2025–2026 worked-example anchor for T13.001.004 sub-case (ii) (temporary-revert griefing) and the closest the v0.1 T13 cohort has to a confirmed-strength attribution-anchored incident. The disclosure-and-fix chain is fully public; the protocol-team-published-postmortem-equivalent is the EntryPoint v0.9 release plus the Project Eleven analysis; the research-team and disclosure-pathway are both publicly named. The attribution-strength taxonomy permits confirmed strength for protocol-team-published-postmortems, and the EntryPoint-v0.9-patch chain meets that bar. The case is the single highest-quality T13 attribution-anchor at v0.1.

Timeline (UTC)

When	Event	OAK ref
2023-03	ERC-4337 EntryPoint v0.6 ships on Ethereum mainnet; canonical specification of `handleOps` / `validatePaymasterUserOp` / `postOp` semantics established	(specification baseline)
2024-Q3 (approx.)	EntryPoint v0.7 ships; introduces the "unused gas penalty" mechanism specifically to address paymaster-DoS griefing of the artificially-high-gas-limit class (T13.001.004 sub-case (i))	T13.001.004 sub-case (i) anchor
2025 (mid-year)	TrustSec research team identifies the temporary-revert griefing class against the canonical EntryPoint reference implementation; disclosure submitted via HackenProof's Account-Abstraction-Bugs bug-bounty programme	T13.001.004 sub-case (ii) disclosure (private)
2025 (coordinated-disclosure window)	HackenProof acts as coordination channel; Ethereum Foundation's account-abstraction working group merges patch into the canonical `eth-infinitism/account-abstraction` reference implementation	(protocol-team-coordinated remediation)
2025-Q4–2026-Q1	EntryPoint v0.9 ships; bundler-vendors (Pimlico, Stackup, Alchemy, Biconomy) progressively pin reference deployments to v0.9	(deployment cohort)
2026-03 (or earlier)	Project Eleven publishes the post-patch defender-side analysis "ERC-4337 EntryPoint v0.9: Fixing a Griefing Vector in Account Abstraction" describing the specific class closed	(post-patch transparency anchor; T13.001.004 sub-case (ii) public-disclosure narrative)
2025–2026	HackenProof publishes the case-study disclosure naming the TrustSec research team and characterising the disclosure pathway	(attribution-anchor publication)
Continuing	No public on-chain attacker-side activity attributable to this specific class — the patch landed prior to public realisation; bundler-side and paymaster-side deployments at v0.9 close the disclosed precondition	(defender-positive outcome)

What defenders observed

The closest the OAK 2024–2026 T13 cohort has to a confirmed-strength attribution-anchored incident is a prevented incident, not a realised one. The TrustSec / HackenProof / Ethereum Foundation coordination chain produced a public attribution chain (research-team named, disclosure-pathway named, protocol-team merged the patch, defender analysis published) without any realised on-chain loss. Within OAK's attribution-strength taxonomy, this meets the confirmed bar specifically because protocol-team-published-postmortem-equivalent material is publicly available. Contributors should not treat the absence of on-chain attacker-side attribution as a downgrade — there is no on-chain attacker to attribute, because the disclosure path produced a patch before public realisation. The confirmed strength applies to the disclosure-and-fix narrative, not to a hypothetical on-chain attribution that would only exist had the patch failed to land in time.
The patch's structural shape — restrict handleOps to top-level EOA contexts — closes the entire class of "earlier-in-the-same-call-stack" attacker-state-modification surfaces, not only the specific TrustSec disclosure. Once handleOps and handleAggregatedOps cannot be invoked from inside another contract's call frame, the attacker no longer has the precondition that enables temporary-revert griefing, reentrancy-against-target-contract-state surfaces, or the broader class of UserOp-execution-inside-attacker-controlled-call-frames. This is the v0.1-OAK-corpus's strongest evidence that protocol-layer mitigations can be structural rather than enumerative — the v0.9 patch closes a class of preconditions, not merely the specific disclosed instance.
The EntryPoint version-pinning discipline is the load-bearing operational control. A paymaster running on EntryPoint v0.6 inherits all class griefing exposure; a paymaster running on v0.7 closes sub-case (i) but remains exposed to sub-case (ii); a paymaster running on v0.9 closes sub-case (ii). Defender practice for paymaster operators must treat EntryPoint version-pinning as a recurring task tied to ERC-4337 protocol evolution, not as a one-time deployment decision. The Project Eleven analysis at [projecteleven2026v09] provides the canonical defender-side checklist for the v0.9 upgrade transition.
Coordinated disclosure outcomes should be treated as first-class T13 worked-example anchors, not as "non-incidents." The OAK worked-example layer is incident-loss-aggregation-biased by structure (the cleanest documentation of an attack class is typically the highest-loss realised incident). The TrustSec / EntryPoint v0.9 case demonstrates that for emerging Tactics with substantial protocol-layer disclosure activity, prevented-incident worked-example anchors can be the highest-quality evidence of the surface's operational reality. Contributors writing future T13 / T14 / emerging-Tactic worked examples should treat protocol-team-coordinated-disclosure cases as worked-example-quality material on the same standing as realised-loss incidents. The case is a precedent for that documentation pattern.
HackenProof's role as the coordination intermediary between research teams and protocol teams is a structural ecosystem feature, not a one-off. HackenProof operates the Account-Abstraction-Bugs bug-bounty programme as an ongoing infrastructure layer, not a one-time campaign. Defender practice for the T13 ecosystem should treat the platform's existence as a load-bearing piece of the disclosure-coordination layer alongside the Ethereum Foundation's account-abstraction working group, audit-firm specialist practices (OpenZeppelin, Trail of Bits, Quantstamp, OSEC), and bundler-vendor reputation systems. The coordination layer's maturity is one of the v0.1 T13 cohort's strongest defender-positive signals.
Bundler-cost exposure is part of the T13.001.004 surface and should be tracked as a first-class metric. The TrustSec disclosure characterises bundler-side gas costs (handleOps reverts with bundler paying for gas) as part of the class's impact, alongside the paymaster-deposit-drawdown surface. Defender practice for bundler operators should treat per-bundler handleOps-revert-cost as a runtime metric and should investigate sustained anomalies as candidate T13.001.004 (or the closely-related T13.002 Bundler MEV) signals.

What this example tells contributors writing future Technique pages

OAK-T13.001.004 (Paymaster Griefing) sub-case (ii) (temporary-revert griefing) has a confirmed-strength worked-example anchor in the EntryPoint v0.9 disclosure-and-fix chain. Future T13.001.004 worked examples that exercise sub-case (ii) should cross-reference this case for the canonical class characterisation: temporary attacker-controlled-state in a target contract earlier in the same call stack, inner-call revert under the temporary condition, paymaster paying for the gas regardless, bundler exposed to revert costs. The patched primitive (top-level-EOA-only handleOps / handleAggregatedOps) is the structural class-closure.
Coordinated-disclosure outcomes warrant confirmed attribution strength under OAK's taxonomy when the disclosure-and-remediation chain is fully public and protocol-team-merged. This case sets the precedent: TrustSec named, HackenProof disclosure-pathway named, Ethereum Foundation patch merged, Project Eleven defender-analysis published. Future T13 / T14 / emerging-Tactic coordinated-disclosure worked examples should record the disclosure chain as the attribution surface and should record confirmed strength when the chain is fully public.
Protocol-layer mitigations can be structural rather than enumerative; defender practice should look for class-closure mitigations. The v0.9 patch closes the "earlier-in-the-same-call-stack" precondition, which closes a class of attack pathways, not merely the specific disclosed instance. Contributors writing the OAK Mitigations layer should explicitly evaluate mitigation candidates against the structural-vs-enumerative dimension and should prefer structural mitigations (precondition-closure) over enumerative ones (case-by-case rejection lists) where both are available.
EntryPoint version-pinning is the recurring operational discipline that the T13.001.004 surface requires; v0.6 → v0.7 → v0.9 is the canonical version-progression cohort. Each version closes a specific griefing surface; a paymaster pinned to an outdated version inherits the prior version's griefing exposure. Defender practice for paymaster operators is therefore a recurring task tied to ERC-4337 protocol evolution, not a one-time deployment-time decision. Contributors writing the OAK Mitigations layer should encode "EntryPoint version pinning + v0.9+ upgrade plan" as a first-class operational-mitigation entry, with this case as the canonical anchor.
HackenProof / TrustSec / Ethereum Foundation as a coordinated-disclosure tripod is the canonical 2025–2026 T13 disclosure-coordination shape. Contributors writing future T13 worked examples should expect to encounter similar tripod shapes (research team / disclosure platform / protocol team) for high-severity defects in the EntryPoint, paymaster reference implementations, bundler vendors, or smart-account vendor reference modules. The OAK Mitigations layer should document this coordination shape as a first-class operational-mitigation entry.

Public references

[hackenproof4337trustsec2025] — HackenProof case-study disclosure: "High-Severity ERC-4337 Account Abstraction Vulnerability: A TrustSec Case Study"; canonical attribution and disclosure-pathway anchor.
[projecteleven2026v09] — Project Eleven analysis: "ERC-4337 EntryPoint v0.9: Fixing a Griefing Vector in Account Abstraction"; canonical post-patch defender-side analysis (already cited at T13.001.004 page).
[ethinfinitismaa] — eth-infinitism/account-abstraction GitHub repository; canonical reference implementation for the EntryPoint contract; v0.9 release notes incorporating the TrustSec-disclosed mitigation.
[hackenproof4337program] — HackenProof Account-Abstraction-Bugs bug-bounty programme; ongoing coordination-channel infrastructure for ERC-4337 protocol-layer disclosures.
[erc4337spec] — ERC-4337 specification (canonical handleOps / validatePaymasterUserOp / postOp semantics).
[osecpaymasters2025] — OSEC / OtterSec paymaster security review; covers the broader paymaster-griefing class and the gas-token-mechanic surface.
[tobsixmistakes2026] — Trail of Bits "Six mistakes in ERC-4337 smart accounts"; defender-oriented enumeration including griefing-class items.
[ozaa4337audit] — OpenZeppelin's Ethereum-Foundation EIP-4337 audit cohort; surfaced bundler-throttling griefing among the 7+ high-severity findings.

Citations

[hackenproof4337trustsec2025] — HackenProof; primary source for TrustSec attribution, disclosure pathway, and coordinated-disclosure narrative.
[projecteleven2026v09] — Project Eleven; primary source for the post-patch class-closure analysis and the v0.9 patched-primitive characterisation.
[ethinfinitismaa] — Ethereum Foundation eth-infinitism/account-abstraction; primary source for the v0.9 release-and-mitigation merge.
[hackenproof4337program] — HackenProof; primary source for the ongoing coordination-channel infrastructure layer.
[erc4337spec] — Ethereum Foundation; canonical reference for the EntryPoint specification.
[osecpaymasters2025] — OSEC / OtterSec; secondary source for the broader paymaster-griefing class.
[tobsixmistakes2026] — Trail of Bits; secondary source for defender-oriented griefing-class enumeration.
[ozaa4337audit] — OpenZeppelin; secondary source for the prior audit-cohort griefing findings.

Discussion

The TrustSec / EntryPoint v0.9 disclosure-and-fix chain is OAK's canonical 2025–2026 worked-example anchor for T13.001.004 sub-case (ii) (temporary-revert griefing) and the highest-quality attribution-anchored T13 incident at v0.1 freeze. The case is structurally distinctive in three dimensions at the corpus level.

First, the case demonstrates that the closest the OAK 2024–2026 T13 cohort has to a confirmed-strength attribution-anchored incident is a prevented incident rather than a realised one. The TrustSec research team identified the defect, the HackenProof disclosure pathway coordinated remediation, the Ethereum Foundation merged the patch into the canonical reference implementation, and Project Eleven published the post-patch analysis — all before any public on-chain realisation. Contributors should treat this outcome shape as the operational target for high-severity protocol-layer disclosures and should not regress the attribution strength simply because no on-chain attacker exists to attribute.

Second, the patch's structural shape — restricting handleOps and handleAggregatedOps to top-level EOA contexts — closes a class of preconditions, not merely the specific disclosed instance. Any attacker-state-modification surface that depends on UserOp execution within an attacker-controlled outer call frame is closed by this patch. This is the v0.1 OAK corpus's strongest evidence that protocol-layer mitigations can be structural rather than enumerative, and the case should be referenced from the OAK Mitigations layer as a precedent for prefer-structural-mitigations operational guidance.

Third, the disclosure tripod (TrustSec research team / HackenProof coordination platform / Ethereum Foundation account-abstraction working group) is the canonical 2025–2026 T13 disclosure-coordination shape. The platform's role as ongoing infrastructure (HackenProof's Account-Abstraction-Bugs bug-bounty programme is not a one-off campaign) is itself a load-bearing ecosystem-maturity signal. Contributors writing future T13 worked examples should expect similar tripod shapes for high-severity defects in the EntryPoint, paymaster reference implementations, bundler vendors, or smart-account vendor reference modules.

The case is structurally complementary to the April 2025 paymaster-drain anchor at examples/2025-04-erc4337-paymaster.md. The April 2025 case is OAK's canonical worked example for the broader T13.001 (Paymaster Compromise) umbrella in a realised-loss-via-cohort-framing shape, where the public forensic record is distributed across audit-firm advisories rather than a single named-individual indictment. The TrustSec / EntryPoint v0.9 case is the canonical worked example for T13.001.004 sub-case (ii) specifically, in a prevented-incident-via-confirmed-disclosure-chain shape. Together the two cases anchor the T13.001 surface across both outcome shapes: realised-loss-via-cohort-framing and prevented-via-coordinated-disclosure. The pair is the strongest single-Tactic worked-example coverage in the v0.1 T13 corpus.

For OAK's broader credibility, including the TrustSec / EntryPoint v0.9 case in v0.1 closes two structural gaps. It documents the highest-quality confirmed-strength attribution-anchored T13 incident at v0.1 (no other T13 case meets the confirmed bar at v0.1 freeze). It demonstrates that prevented-incident worked-example anchors are first-class corpus material for emerging Tactics where protocol-layer-disclosure activity is the dominant defender-positive signal, and provides contributors writing future T13 / T14 / emerging-Tactic worked examples with a tone-and-structure precedent for that documentation shape.