Quick Answer
AI agents operating on-chain introduce a new class of smart contract security problem: the agent is not just code — it's a reasoning system that reads blockchain state, makes decisions, and executes transactions autonomously. The security of that system depends on how tightly the on-chain authority granted to the agent is scoped.
Session keys grant agents limited signing authority. Audit ensures no-allowlist keys, unlimited value grants, or undated expiry can't be exploited if the agent's behavior is compromised.
Paymasters sponsor gas for agent operations. Validation gaps allow attackers to drain the Paymaster's ETH deposit by flooding it with sponsored UserOperations without the intended gatekeeping.
Smart wallet validateUserOp must verify signatures, check nonces, and reject unauthorized operations. Gaps here — empty signature acceptance, cross-chain replay — allow unauthorized execution.
Multi-agent systems use registries to define agent permissions and relationships. Registry admin access, agent enrollment logic, and permission upgrade paths are key attack surfaces.
| Vulnerability | Severity | Description | Example |
|---|---|---|---|
| Paymaster Drain Attack | Critical | ERC-4337 Paymasters sponsor gas fees for UserOperations. A Paymaster that validates sponsorship without strict per-user limits or allowlists can be drained by an attacker who crafts a flood of sponsored UserOperations that consume the Paymaster's deposited ETH without any corresponding value exchange. The Paymaster's stake in the EntryPoint gets consumed, disabling gas sponsorship for all legitimate users. | A token-gated Paymaster that checks ERC-20 balance at validation time but doesn't burn or lock the tokens — an attacker with a flash-loaned balance passes validation for thousands of operations and drains the Paymaster's ETH deposit before the gas sponsorship is revoked. |
| UserOperation Validation Bypass | Critical | Smart contract wallets (ERC-4337 accounts) implement a `validateUserOp` function that must verify the caller's signature before execution. If validation logic has gaps — accepting empty signatures, failing to check nonces correctly, or allowing replay across chains — an attacker can execute arbitrary UserOperations on behalf of the wallet without authorization. | A smart wallet that validates signature length but not signature content, accepting a 65-byte zero-padded byte array as a 'valid' ECDSA signature for any UserOperation targeting the wallet. |
| Autonomous Agent Over-Delegation | High | AI agents operating on-chain via account abstraction are granted execution permissions through session keys or delegation contracts. Over-permissioned delegation — granting an agent scope to call arbitrary contracts, move unlimited token amounts, or act without time bounds — means a compromised agent model or malicious tool-use path can drain the entire wallet. Permission scoping is the primary security control for agentic systems. | An AI agent granted a session key with unlimited USDC approval and no contract allowlist — if the agent's LLM backbone is prompted to call a malicious contract via tool use, the entire wallet balance is accessible. |
| Bundler Frontrunning and Simulation Manipulation | High | ERC-4337 Bundlers simulate UserOperations before including them in blocks. A malicious or compromised Bundler can frontrun profitable operations, selectively exclude operations from users it wants to grief, or manipulate simulation results to cause operations to fail at execution time after validation passed. This is particularly dangerous for AI agent workflows that depend on atomic execution sequences. | A bundler that observes an AI agent's UserOperation to arbitrage a DEX price discrepancy, copies the profitable trade into a separate transaction executed in the same block before the agent's operation, then includes the agent's now-unprofitable operation to consume their gas. |
| Reentrancy via executeUserOp Callback | Medium | ERC-4337 account wallets execute arbitrary calls on behalf of their owner. If the execution path calls an external contract that can re-enter the wallet's execute function before the nonce is incremented, an attacker can reuse the same UserOperation authorization to execute additional operations. This is a chain-of-trust failure specific to the async execution model of smart wallets. | A wallet's execute() function calls an external DeFi protocol that, before returning, calls back into the wallet's execute() function with a different calldata payload — re-entering before the nonce increment that would have prevented the second call. |