Audit paymaster sponsorship API
Compare ERC-4337 UserOperations with a caller-supplied Paymaster sponsorship policy. EntryPoint versions are 0.6 and 0.7. An omitted paymasterDataFormat is envelope: the EntryPoint address and, on 0.7, the two 16-byte gas limits are read, and later bytes stay opaque. verifying_paymaster also reads validUntil and validAfter as two 6-byte integers; a validUntil of 0 means no upper bound, and the signature is not verified. Call targets and selectors are read only from declared values, raw calldata offsets, or execute(address,uint256,bytes). audit_status is allowed, denied, warnings, invalid, or indeterminate. risk_level is low, medium, high, or critical. Sponsored gas is the EntryPoint required-prefund sum, multiplied by maxFeePerGas for the amount in wei. No Paymaster deposit, balance, reputation, or other chain state is read, and the result does not say whether a bundler will accept the operation.
The Audit paymaster sponsorship operation is part of the Paymaster Sponsorship Audit API on BRAINIAC.software. Compare ERC-4337 UserOperations with a caller-supplied Paymaster sponsorship policy. EntryPoint versions are 0.6 and 0.7. An omitted paymasterDataFormat is envelope: the EntryPoint address and, on 0.7, the two 16-byte gas limits are read, and later bytes stay opaque. verifying_paymaster also reads validUntil and validAfter as two 6-byte integers; a validUntil of 0 means no upper bound, and the signature is not verified. Call targets and selectors are read only from declared values, raw calldata offsets, or execute(address,uint256,bytes). audit_status is allowed, denied, warnings, invalid, or indeterminate. risk_level is low, medium, high, or critical. Sponsored gas is the EntryPoint required-prefund sum, multiplied by maxFeePerGas for the amount in wei. No Paymaster deposit, balance, reputation, or other chain state is read, and the result does not say whether a bundler will accept the operation. It is exposed as POST /api/v1/account-abstraction/paymaster-sponsorship-audit and priced at $0.05 USDC on Base. Payment uses the x402 exact scheme: an unpaid call returns HTTP 402 with payment requirements; after paying the exact USDC amount, retry the same request with a payment-signature header and Idempotency-Key. No account and no API key are required. Data sources for this product: Caller-supplied ERC-4337 UserOperations and paymaster sponsorship policy processed locally Limitations: No Paymaster deposit, balance, reputation, or other chain state is read. The result does not say whether a bundler will accept the UserOperation. Only EntryPoint 0.6 and 0.7 UserOperation layouts are defined. Bytes after the EntryPoint Paymaster envelope are decoded only when paymasterDataFormat is verifying_paymaster. Sponsored gas is the EntryPoint required-prefund sum. It is not measured gas used. UserOperation structure is checked for EntryPoint 0.6 and 0.7 only. Signatures are not recovered, and execution is not simulated. sponsorship-risk multiplies the supplied gas by the supplied max fee and compares that cost with the supplied deposit. user-op-validity checks signature length, nonce, init code size, and calldata length. A 64-byte or 65-byte signature is not recovered. Outputs are compliance prechecks, drafts, or data lookups for human review. They are not official determinations, legal advice, identity confirmation, or certified filings. Related operations in this group include Score paymaster sponsorship risk, Audit user operation, Score UserOperation format. Open the group documentation for the full request schema, field notes, and response examples before integrating.
/api/v1/account-abstraction/paymaster-sponsorship-auditExample request
curl -i -X POST "https://www.brainiac.software/api/v1/account-abstraction/paymaster-sponsorship-audit" \
-H 'content-type: application/json' \
-H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
--data-binary @- <<'JSON'
{
"entryPointVersion": "0.7",
"chainId": 8453,
"paymaster": "0x2222222222222222222222222222222222222222",
"paymasterDataFormat": "envelope",
"userOperations": [
{
"sender": "0x4444444444444444444444444444444444444444",
"nonce": "1",
"initCode": "0x",
"callData": "0xb61d27f60000000000000000000000001111111111111111111111111111111111111111000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000004a9059cbb00000000000000000000000000000000000000000000000000000000",
"accountGasLimits": "0x000000000000000000000000000186a00000000000000000000000000007a120",
"preVerificationGas": "21000",
"gasFees": "0x0000000000000000000000003b9aca0000000000000000000000000077359400",
"paymasterAndData": "0x22222222222222222222222222222222222222220000000000000000000000000001000000000000000000000000000000008000",
"signature": "0x01",
"call": {
"format": "account_execute"
}
}
],
"policy": {
"maxCallGasLimit": "100000",
"maxVerificationGasLimit": "200000",
"maxPreVerificationGas": "50000",
"maxPaymasterVerificationGasLimit": "100000",
"maxPaymasterPostOpGasLimit": "50000",
"maxFeePerGas": "3000000000",
"maxSponsoredGas": "2000000",
"allowedTargets": [
"0x3333333333333333333333333333333333333333"
],
"allowedSelectors": [
"0x095ea7b3"
],
"allowedChainIds": [
8453
],
"allowedSenders": [
"0x4444444444444444444444444444444444444444"
],
"allowInitCode": false
}
}
JSONAn unpaid probe returns HTTP 402 with x402 payment requirements. After paying the exact USDC amount on Base, retry the identical request with a payment-signature header.
FAQ
- Do I need an API key? No. Pay the listed USDC amount with x402.
- What network? Base (eip155:8453), USDC.
- Is this an official determination? No. Results are for human review against the cited sources.
Related operations
- Score paymaster sponsorship risk — $0.04 USDC
- Audit user operation — $0.05 USDC
- Score UserOperation format — $0.04 USDC