ERC-4337 Error AA24: Signature Error UserOp Validation Fix
ERC-4337 error AA24 "signature error" indicates that the smart account contract rejected the cryptographic signature during the validateUserOp execution phase. This error occurs when the recovered signer does not match an authorized owner, when userOpHash was computed using mismatched EntryPoint or chainId values, or when WebAuthn P-256 clientDataJSON hashing had unexpected padding. Verify EIP-712 hashing parameters and gas limits to ensure the signed hash matches on-chain execution.
# Root Cause & Technical Architecture
Inside the EntryPoint validation loop, the contract calls `sender.validateUserOp(userOp, userOpHash, missingAccountFunds)`. The account contract computes the cryptographic hash of `userOpHash` and verifies the signature using ECDSA, ERC-1271, or WebAuthn P-256. If the signature is mathematically invalid or from an unauthorized key, `validateUserOp` returns authorizer status `1` (SIG_VALIDATION_FAILED), causing EntryPoint to revert with `AA24 signature error`.
# 4-Step Actionable Diagnostic Protocol
Step-by-Step ResolutionVerify EntryPoint Address and Chain ID in userOpHash
Confirm that userOpHash was calculated using the exact EntryPoint address (e.g., 0x0000000071727De22E5E9d8BAf0edAc6f37da032 for v0.7) and numeric chainId.
Audit WebAuthn P-256 ClientDataJSON and AuthenticatorData
For passkey smart accounts, ensure the clientDataJSON challenge matches userOpHash and that authenticatorData flags (User Presence / Verification) are valid.
Check Pre-Op Gas Estimation Tampering
If gas limits (callGasLimit, verificationGasLimit) were adjusted after signing, userOpHash changes, invalidating any previously collected signature.
Inspect ERC-1271 Nested Smart Account Signatures
If the owner is a Safe or another smart contract, verify that the owner contract returns magic value 0x1626ba7e for isValidSignature.
# Diagnostic Verification Code / Command
typescript// Compute exact userOpHash per ERC-4337 EntryPoint v0.7
import { keccak256, encodeAbiParameters, parseAbiParameters } from 'viem';
function computeUserOpHash(userOp: any, entryPoint: string, chainId: number) {
const packedUserOp = keccak256(encodeUserOp(userOp));
return keccak256(
encodeAbiParameters(
parseAbiParameters('bytes32, address, uint256'),
[packedUserOp, entryPoint as `0x${string}`, BigInt(chainId)]
)
);
}
// Any difference in chainId or gas fields invalidates the signature!Launch ERC-4337 UserOp Decoder
Execute client-side cryptographic simulation and parameter checks safely in your browser via native WebCrypto without sending private keys or mnemonics over the wire.
Read Full Investigation & Recovery Workflow
Explore complete architectural diagrams, edge-case failure trees, and detailed post-mortem analysis in our verified deep guide.
# Related Diagnostic Codes in ERC-4337 & Safe
Related Hex StatusesERC-4337 Error AA10: Sender Already Constructed UserOp Fix
Fix ERC-4337 error AA10 sender already constructed. Resolve non-empty initCode sent for deployed smart accounts, bundler estimation, and counterfactuals.
ERC-4337 Error AA20: Account Not Deployed EntryPoint Revert
Fix ERC-4337 error AA20 account not deployed. Troubleshoot empty initCode for counterfactual smart accounts, factory calldata, and pre-deployment.
ERC-4337 Error AA25: Invalid Account Nonce 2D Sequence Fix
Fix ERC-4337 error AA25 invalid account nonce. Resolve 2D nonce key and sequence collisions in EntryPoint, parallel bundler queues, and sync lags.
# Frequently Asked Questions
FAQ SchemaWhy does modifying gas limits trigger AA24 signature error?
Gas limits are signed fields inside the UserOperation struct. Modifying any gas value alters the userOpHash, making the existing signature invalid.
What is the difference between AA23 and AA24 in ERC-4337?
AA23 indicates validateUserOp reverted during execution (e.g. out of gas), whereas AA24 indicates validateUserOp returned validation failure status 1.
Can AA24 happen with Safe multi-signature accounts?
Yes. If the threshold of owner signatures is not met, or if owner signatures are not concatenated in ascending order of address, AA24 will trigger.