The SimpleAccount Factory Gas Bloat
How an old Solidity compiler bug added 122,914 gas to every SimpleAccount deployment.
I found an issue in the ERC-4337 SimpleAccountFactory from eth-infinitism’s repository. It is not a vulnerability, so funds are safe. The issue is that every account deployment costs around 122,914 more gas than it should.
Finding the bytecode difference
A few weeks earlier, @FudgyDRS approached me about the difference between the aa-benchmark gas results and the results from his environment. The difference was around 100,000 gas.
I first thought it was related to the optimizer settings, but the difference was much larger than expected. After investigating, we found that the core difference was the bytecode size. That reminded me of an issue I had underestimated when I first found it: the Solidity bloat issue.
@dedaub discovered the bloat issue in February. Using a Solidity version older than 0.8.18 - I do not know how far back it goes - while using a library in a constructor can produce contract bytecode that is larger than it should be.
For SimpleAccount, the bytecode size was 845 instead of 231. That added 122,914 gas to every account deployment.
As a result, 214,251 accounts each used an extra 122,914 gas during deployment. Applying the average gas cost per UserOperation, this cost around 2.6 ETH more in total than it should have.
Migration
If a project uses SimpleAccountFactory and can migrate without much trouble, it would be better to deploy a new factory with Solidity 0.8.19 instead of using the factory deployed with 0.8.15 at 0x9406Cc6185a346906296840746125a0E44976454.
The issue is tracked in eth-infinitism/account-abstraction#348.