Taek Lee

Writing

Notes on account abstraction and smart contract security.

  1. Keys and Accounts: Native AA — EIP-8130 vs EIP-8141

    Why native account abstraction needs both key-originated and account-originated transactions—and why configuration-backed identity is inevitable.

    Account abstraction, Native account abstraction, EIP-8130, EIP-8141, ERC-4337, Session keys, Delegation

  2. ERC4337 Retrospect:

    The EOA Transition: An In-Place Path to Native AA

    An argument for native account abstraction that upgrades existing EOAs in place by replacing root authorization without sacrificing address continuity.

    Part 3 of 3 · Account abstraction, Native account abstraction, EIP-7702

  3. ERC4337 Retrospect:

    Kernel v1-v4: What Production Kept - and What It Left Behind

    A four-version retrospective on how Kernel evolved from EOA-rooted compatibility to replaceable validation, modular permissions, and a production-driven v4 foundation.

    Part 2 of 3 · Account abstraction, Kernel, Smart accounts

  4. ERC4337 Retrospect:

    Final, Not Finished: What ERC-4337 Taught Us

    A production retrospective on how ERC-4337 converged into a shared execution and sponsorship rail while exposing the limits of standalone smart-account migration.

    Part 1 of 3 · Account abstraction, ERC-4337, Smart accounts

  5. EIP-3074 Invoker with Permissions

    Using ERC-7579 policies and signers to bring session keys and passkeys to EIP-3074 EOAs.

    Account abstraction, EIP-3074

  6. Finding a Bug in Safe's ERC-4337 Module

    How ERC-4337 context exposed a paymasterAndData signature flaw that an isolated contract review missed.

    ERC-4337, Security

  7. Why Kernel Is Not Written in Huff

    Why extensibility, auditability, testing, and development speed matter more than marginal gas savings for Kernel.

    Kernel, Engineering

  8. The SimpleAccount Factory Gas Bloat

    How an old Solidity compiler bug added 122,914 gas to every SimpleAccount deployment.

    ERC-4337, Solidity

  9. Breaking ERC-4337 Infrastructure with UserOpHash

    Manipulating ABI offsets to make different UserOperations produce the same userOpHash.

    ERC-4337, Security

  10. How Non-Unique UserOp Hashes Broke ERC-4337 Infrastructure

    A debugging experiment with repeated UserOperations exposed assumptions about userOpHash uniqueness.

    ERC-4337, Infrastructure

  11. Five Account Abstraction Audit Findings

    Signature replay, paymaster draining, policy bypass, and implementation destruction findings from a Biconomy audit.

    ERC-4337, Security

  12. EIP4337Manager Self-Destruct Vulnerability

    An analysis of how an unprotected EIP4337Manager module setup enabled the manager's destruction and signature-free UserOperations in Gnosis Safe-based ERC-4337 wallets.

    ERC-4337, Security

  13. ERC-4337 Sample VerifyingPaymaster Signature Replay Attacks

    An analysis of signature replay flaws in the ERC-4337 sample VerifyingPaymaster that can drain deposits and bypass transaction sponsorship policies.

    ERC-4337, Security