Wallet Security & Protocol Patches
Critical vulnerability disclosures, origin validation, and signature verification fixes.
Fix: ERC-4337 Bundler Error 'AA21 didn't pay prefund' in UserOperations
Resolve ERC-4337 EntryPoint AA21 didn't pay prefund simulation errors. Fix missingAccountFunds transfer logic, maxFeePerGas inflation, and deposit balance checks.
Fix: ERC-7579 Smart Account 'HookPostCheckFailed' Execution Revert
Resolve ERC-7579 modular smart account execution reverts caused by HookPostCheckFailed and PreCheckFailed in Biconomy Nexus, Kernel v3, and Rhinestone modules.
Fix: ERC-7579 Session Key Cross-Chain Signature Replay Exploits
Protect ERC-7579 modular smart accounts from cross-chain session key signature replay attacks across EVM rollups. Fix CREATE2 counterfactual account vulnerabilities.
Fix: ERC-7683 Cross-Chain Intent Replay & Settler Contract Revert (0x54656c6c)
Resolve ERC-7683 cross-chain intent settlement failures. Fix intent order nonce replay across rollups, orderDataType hash mismatches, and deadline expiration in filler relayers.
Fix: Uniswap Permit2 InvalidNonce and SignatureExpired Reverts in High-Throughput Relayers
Resolve Uniswap Permit2 transaction failures caused by nonce bitmap word index collisions, unordered signature invalidation, and L2 sequencer timestamp drift. Complete mitigation guide with Viem and Solidity fixes.
Fix: EIP-7702 Set Code Authorization Replay Attacks & Cross-Chain Delegation Front-Running
Mitigate critical security vulnerabilities in EIP-7702 authorization payloads: cross-chain signature replay, unrevoked smart contract code delegation, and front-running on Prague/Electra hard forks.
Fix: ERC-7739 Smart Account Signature Replay & ERC-1271 Revert
Resolve ERC-1271 isValidSignature reverts (0xffffffff) and cross-chain replay attacks in smart accounts signing nested EIP-712 typed data with Permit2, Seaport, and Safe.
Fix: WalletConnect wc_sessionAuthenticate CACAO Signature Bypass
Mitigate unauthorized session establishment in WalletConnect v2 wc_sessionAuthenticate. Resolve CAIP-74 CACAO signature validation bypasses and forged SIWE approvals.
Fix: WalletConnect postMessage Listener Missing event.origin Validation
Resolve the critical security vulnerability in WalletConnect where postMessage event.origin is not validated. Learn how to secure your iframe communications.