Skip to content
attack.paths
Sign in
← RegistryDossier · 5 steps · 4 edges

ERC-4337 paymaster sponsor drain

A paymaster sponsors all UserOperations without per-user gas accounting. Spam tiny UserOps from many bundled addresses — paymaster pays the gas until its deposit hits zero.

Filed by AD Knowledge Base
§ Kill-chainDrag · zoom · scroll

§ Context

Assumed environment: target dApp deploys an ERC-4337 paymaster that sponsors any UserOperation matching a permissive validation (e.g. anyone can be sponsored). Paymaster has a real ETH deposit funding sponsorships.

§ Steps

  1. 01
    Generate thousands of UserOperationsInitial Access
    T1078— Valid Accounts
  2. 02
    Identify permissive paymasterReconnaissance
    W-RECON-FINGERPRINT— Tech Stack Fingerprinting
  3. 03
    Paymaster deposit hits zeroImpact
    T1485— Data Destruction
  4. 04
    Confirm validatePaymasterUserOp doesn't rate-limitImpact
    AA-PAYMASTER-DRAIN— Paymaster Sponsor Drain
  5. 05
    Bundler executes — paymaster paysImpact
    AA-4337-ENTRYPOINT— ERC-4337 EntryPoint Abuse

§ References

§ Frequently asked

What is the "ERC-4337 paymaster sponsor drain" attack path?
A paymaster sponsors all UserOperations without per-user gas accounting. Spam tiny UserOps from many bundled addresses — paymaster pays the gas until its deposit hits zero. It chains 5 steps drawn from real-world offensive-security techniques.
What starting position does this attack require?
The first step is Generate thousands of UserOperations (T1078) — a initial access primitive. Assumed environment: target dApp deploys an ERC-4337 paymaster that sponsors any UserOperation matching a permissive validation (e.
What is the final impact of this kill-chain?
The final step lands on Bundler executes — paymaster pays (AA-4337-ENTRYPOINT), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.
How can defenders detect or prevent this attack?
Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers