Smart Contract Analysis Statement

Contract Analysis

The ATSPaymaster v2 contract is a revision of the previously audited ERC-4337 v0.8 token paymaster that lets users pay their gas in ATS instead of the native coin of the chain. Every operation now carries a 29-byte header in its paymaster data that the account owner signs: a mode byte, a maximum ATS charge (maxAts) and a validity window. Three modes exist. The user mode takes the worst-case fee from the sender's allowance during validation and refunds the excess after execution, at the larger of a minimum charge of roughly one dollar and the gas cost plus a markup. Two backend-signed modes run at cost price without the minimum charge: a prepaid setup mode that also takes the fee during validation, and a bootstrap mode for the very first operation that only checks the sender's balance during validation and takes the fee after execution, because the approval is only granted inside that operation. The re-audit covered the source verified on Sourcify with an exact match on BSC testnet, Arbitrum Sepolia, Base Sepolia and Polygon Amoy; all four deployments share one source tree, and the compiler settings and library versions are unchanged from the first audit.

Ownership Privileges

The ownership is held through a two-step handover. On the four v2 testnet deployments the owner is still the deploying EOA and no transfer is pending; for mainnet the team intends the same 2-of-3 Safe that owns the legacy contracts. The owner retains the following privileges:

• Setting the exchange-rate band, the maximum rate age (60 seconds to 1 day), the markup (at most 200%), the per-operation gas cap and the cap on the minimum charge; the last two have no hard limit in code
• Appointing and removing rate updaters and the backend signer, changing the rate-drift cap, the bootstrap markup (at most 100%) and the post-operation gas allowance (at most 100,000 gas), and pausing sponsorship
• Withdrawing the EntryPoint deposit and any stake, and sweeping collected ATS to any address; the sweep emits an event and always leaves one unit in the contract
• The owner cannot renounce ownership, cannot move ATS out of user wallets outside an operation the user signed, and cannot raise the price of an operation already in flight above the ceiling the user signed
• The rate updater can only set rates inside the owner's band, minimum charges below the owner's cap and, when a drift cap is set, move the rate by at most that cap per call and per one-hour window
• No owner action takes effect with a delay, as no timelock is in place

Security Features

The contract implements several positive security features:

• The declared post-operation gas limit is bounded to 40,000 to 300,000 gas and the EntryPoint's unused-gas penalty for that limit is priced into every fee, so a self-bundling user can no longer drain the deposit
• A user-signed maximum charge is enforced before any ATS moves, and all fee inputs are captured at validation, so later configuration changes or front-running cannot raise the amount a user pays
• The user mode and the prepaid setup mode collect the full worst-case fee during validation, which reliably prevents users from escaping payment by revoking their allowance during execution
• Backend signatures are bound to a version tag, the sender, nonce, call data, all gas fields, the signed header, the chain id and the paymaster address, and invalid signatures return a failed-signature result instead of reverting
• The rate updater is confined by a band, a per-call and per-hour drift cap, and range-checked freshness; setBounds resets an out-of-band rate and clamps the minimum charge
• Configuration is packed into six storage slots, all reverts use custom errors, the pragma is pinned to 0.8.28 and ownership cannot be renounced

Re-audit Outcome

All prior findings were re-tested against the real EntryPoint v0.8 runtime. The high-severity deposit drain through the unused post-operation gas penalty is fixed: out-of-range limits are rejected, and fuzzed operations at cost price never left the deposit under-compensated. The missing user maximum charge, the single-call rate jump limit, the out-of-band rate after setBounds, the reverting signature checks, the unchecked maximum rate age, the missing sweep event, the documentation and the renounce, custom-error and storage-packing items are all fixed. The bootstrap concern is only partially fixed: the new prepaid setup mode takes its fee during validation, but the true first-operation bootstrap mode still collects after execution and can still be made to pay nothing by a same-bundle balance move or a delegate that ignores the approval. The team documents this as a known residual bounded per operation by the gas cap and in number only by the backend's signing policy. The governance item is partially addressed: the unused rate updater was revoked on all ten legacy chains, but there is no timelock, the deployer EOA remains a Safe signer, and the testnet contracts are owned by that EOA and unstaked. No new vulnerability was introduced by the changes. Two properties are worth noting: the fixed one-hour drift windows allow two full caps back to back across a window boundary, and the validity window of a backend-signed operation is not capped on-chain. Slither and Aderyn reported no new valid issue.

Note - This re-audit report consists of a security analysis of the ATSPaymaster v2 smart contract. This analysis did not include economic analysis of the contract's tokenomics. Moreover, we only audited the main contract for the ATSPaymaster team. Other contracts associated with the project were not audited by our team. The legacy paymasters remain deployed on mainnet until the v2 contracts replace them. We recommend investors do their own research before investing.