Paymaster Sponsorship Audit API
Audit ERC-4337 UserOperations supplied in the request. Sponsorship policies and structural checks cover gas, Paymaster fields, factory data, and calldata. No network calls are made.
Compare ERC-4337 UserOperations with a caller-supplied Paymaster sponsorship policy. EntryPoint versions are 0.6 and 0.7. An omitted paymasterDataFormat is envelope: the EntryPoint address and, on 0.7, the two 16-byte gas limits are read, and later bytes stay opaque. verifying_paymaster also reads validUntil and validAfter as two 6-byte integers; a validUntil of 0 means no upper bound, and the signature is not verified. Call targets and selectors are read only from declared values, raw calldata offsets, or execute(address,uint256,bytes). audit_status is allowed, denied, warnings, invalid, or indeterminate. risk_level is low, medium, high, or critical. Sponsored gas is the EntryPoint required-prefund sum, multiplied by maxFeePerGas for the amount in wei. No Paymaster deposit, balance, reputation, or other chain state is read, and the result does not say whether a bundler will accept the operation.
Add the caller-supplied call gas and verification gas, multiply by the max fee, and compare that cost with the paymaster deposit. Gas above the stated ceilings, and init code when it is not allowed, raise the risk score. The safety index is how far each gas field sits inside its ceiling. No deposit is read from a chain.
Check the structure of one ERC-4337 UserOperation before it is submitted to a bundler. EntryPoint 0.6 uses initCode and paymasterAndData. EntryPoint 0.7 uses factory, factoryData, and separate Paymaster fields. On 0.7, callGasLimit, verificationGasLimit, the fee fields, and Paymaster gas limits must fit in uint128. Calldata is decoded only with the supplied ABI. Expected targets are compared only with decoded address parameters named dest, target, or to. validation_status is valid, invalid, warnings, or indeterminate. risk_level is low, medium, high, or critical. The signature is not recovered. No chain state is read, execution is not simulated, and the result does not say whether a bundler will accept the operation.
Check a caller-supplied nonce, signature length, init code, and calldata length. A signature of 64 or 65 bytes passes the length check and is not recovered. init code of at least 20 bytes is a factory deployment and is not simulated. The rejection index counts format problems. It does not say whether a bundler will accept the operation.