After auditing dozens of ERC-4337 smart accounts, Trail of Bits identified six recurring vulnerability patterns: (1) incorrect access control on execute functions allowing anyone to drain wallets; (2) incomplete signature validation that omits gas fields, enabling bundlers or frontrunners to inflate fees; (3) state modification during validateUserOp that can be overwritten by other ops in a bundle; (4) ERC-1271 replay attacks when signatures aren't domain-separated by account address and chainId; (5) over-reliance on reverts as a safety net when validateUserOp success already commits gas payment; and (6) ERC-7702 initialization race conditions allowing frontrunning. Each vulnerability is explained with unsafe vs. safe code examples and mitigation guidance, plus a pre-ship security checklist.
