Smart Contract Analysis Statement

Contract Analysis

The Simple7702Account contract implements a minimal smart account that an externally owned address adopts as its own code through an EIP-7702 authorisation, so the same address gains ERC-4337 support, batched calls and ERC-1271 signatures while keeping its private key. It is the eth-infinitism v0.8.0 reference account, deployed by the project through the deterministic deployment proxy at 0x268D193D74D3B9a13a82DA831302cf8DBdC9245A. The contract was not changed for the v2 release: the source is the same and the runtime bytecode on the mainnets we re-checked is identical to the bytecode verified in the first audit. The address holds no code on the four testnets that host the v2 paymasters and collector.

Ownership Privileges

The ownership of the contract has been left without any owner or admin role, because the account has no storage and no privileged functions. The account itself has the following properties:

• Only the account's own address or the canonical EntryPoint v0.8 may trigger execute and executeBatch
• User operations and ERC-1271 signatures are accepted only when signed by the private key of the delegating address
• The account accepts native coins and ERC-721 and ERC-1155 tokens like a normal wallet
• The EntryPoint address is fixed in the code
• The project cannot change the code behind this address, and it has no upgrade or pause function
• The delegating user keeps full control through the private key and can switch to another delegate at any time
• No funds are held by the delegate contract itself, as it operates on each user's own address
• No fees are taken by the account

Security Features

The contract implements several positive security features:

• Stateless design, so there is no risk of storage collisions when users switch between delegates
• Strict caller checks on every execution function
• Signature recovery with protection against malleable signatures
• Logic that is identical to a widely used and independently reviewed reference implementation

Re-audit Outcome

Both informational items are acknowledged and unchanged. Malformed signatures still make validation and ERC-1271 checks revert instead of returning a failure value, which matches the upstream reference and only affects the account owner and integrations that probe signatures. The delegate remains a project-specific deployment of the reference account, so users should confirm this address before signing an EIP-7702 authorisation. The v2 paymaster's bootstrap mode does not bind the delegate address into the backend signature, so the backend cannot rely on users keeping this delegate between signing and inclusion.

Note - This re-audit report consists of a security analysis of the Simple7702Account smart contract. This analysis did not include economic analysis of the contract's tokenomics. Moreover, we only audited the main contract for the Simple7702Account team. Other contracts associated with the project were not audited by our team. We recommend investors do their own research before investing.