{"id":642,"date":"2024-05-15T14:00:03","date_gmt":"2024-05-15T12:00:03","guid":{"rendered":"https:\/\/ackee.xyz\/blog\/?p=642"},"modified":"2024-07-04T12:27:32","modified_gmt":"2024-07-04T10:27:32","slug":"wake-erc-4337-detector","status":"publish","type":"post","link":"https:\/\/ackee.xyz\/blog\/wake-erc-4337-detector\/","title":{"rendered":"Wake ERC-4337 Detector"},"content":{"rendered":"

Ackee is finalizing an ERC-4337 detector to identify the use of forbidden opcodes and storage access, turning a very labor-intensive manual review into an automated process that reduces the chance of human error.<\/span><\/p>\n

Let Wake detect ERC-4337 related vulnerabilities in your code. Want to get your code tested for free by our Wake ERC-4337 detector? Submit this deform!<\/a><\/p>\n

The detector already found an issue in the Rhinestone\u00a0modulekit examples<\/a>\u00a0project. The discovered finding shows that even when accessing a mapping using the correct key, the mapping may contain nested dynamic data structures that may trigger reading from forbidden storage slots. This example clearly shows the need of an automated tool that can discover such issues otherwise leading to denial-of-service for a smart account.<\/p>\n

\"bytes<\/p>\n

About Wake Framework<\/span><\/h2>\n

Wake<\/span><\/a> is a Python-based framework for development and testing of Solidity smart contracts. It includes a static analysis engine to explore and report issues in Solidity code. Wake is developed and used by the Ackee Blockchain Security to perform smart contract audits – and it helped to discover a number of medium, high and critical <\/span>vulnerabilities<\/span><\/a>.<\/span><\/p>\n

Develop, test, and write secure code using Wake inside VS Code via our extension: <\/span>Tools for Solidity<\/span><\/a>.<\/span><\/p>\n

\"\"<\/p>\n

ERC-4337 forbidden opcodes and storage access<\/span><\/h2>\n

ERC-4337<\/span><\/a> defines a set of restrictions in the user operation validation phase that must be followed to protect user operation bundlers from denial of service attacks. The restrictions are fully described in <\/span>ERC-7562<\/span><\/a>.<\/span><\/p>\n

The restrictions include:<\/span><\/p>\n