This is a summary of the internal review of the gas-less feature.

We suggest some improvements to the contracts. And suggest a mechanism to mitigate the DOS risk, which can be implemented on the Godwoken.

• commit https://github.com/godwokenrises/gasless-contract/tree/7d08449d4bec99d39bc4697139114bd3a58f03b9

Repository

Repository License

• The original solidity contracts in eth-infinitism/account-abstraction are licensed under GPL-3.0 (BasePaymaster.sol), but this repo relicensed source code in MIT, which is violent the GPL-3.0 license.

Test coverage

• Low test coverage. The original repo contains many ERC-4337 tests. We should modify and migrate the tests into this repo https://github.com/eth-infinitism/account-abstraction/tree/develop/test

Documentation

• Need to describe the difference from ERC-4337 and eth-infinitism/account-abstraction in the document or README.
• The original repo https://github.com/eth-infinitism/account-abstraction has lots of updates after our fork. We should declare the commitID of our fork in the document.

Contracts

EntryPoint

1. Godwoken block producer node plays the role of bundler. But the full node's beneficial address isn't fixed. It may be changed. We should pay compensation to block.coinbase instead of GW_FULL_NODE, GW_FULLNODE should be removed.
2. The calculation of outOpInfo.preOpGas differs from the original code. We should add a comment to explain it.
   • ours outOpInfo.preOpGas = preGas - gasleft();
   • origin outOpInfo.preOpGas = preGas - gasleft() + userOp.preVerificationGas;
3. Compares paymasterDeadline with uninitialized deadline in L265
4. Godwoken gasless feature use block producer as the bundler, so we do not simulate the user's operation. The simulateValidation can be removed.
5. Consider including actualGasUsed instead of gasPrice in the UserOperationEvent https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/interfaces/IEntryPoint.sol#L25
6. Should limit revert reason length of user operation AA-114 Prevent revert reason bombing of innerHandleOp() eth-infinitism/account-abstraction#178
7. The comment is wrong. HandlePostOp is always executed whether the userOps is successful or failure https://github.com/godwokenrises/gasless-contract/blob/main/contracts/gasless/core/EntryPoint.sol#L81

BasePayMaster

• BasePayMaster has an interval variable admin, duplicated to the Owner. We should remove the admin variable, use onlyOwner modifier to check permission.
• Mixed uses admin and onlyOwner. Should remove admin.
• AvailAddr should be implemented as an interface. Please move the availAddrs into a standalone interface, and add an example to demonstrate how to use it.
• The name of availAddrs isn't clear. Rename it to whitelistContracts

PayMaster reputation

In ERC-4337, we don't know whether the paymaster or the user causes a failed tx. The bundler takes the risk by simulating the tx before submitting the tx to the miner.

In Godwoken gasless, the block producer is also a bundler. We must control the risk of being attacked by malicious users and paymasters.
The basic idea is to use a tiny gas to check the validity of user operation. The paymaster must decide whether the tx is valid - the paymaster takes the risk of being banned, or the tx is invalid - the block producer will simply reject the tx.

So we have these situations when a gas-less fails:

1. Paymaster rejects the tx
   1. Tx doesn't pass the IPaymaster(paymaster).validatePaymasterUserOp
   2. Then the block producer should just reject the tx if the gas cost is less than PAY_MASTER_VALIDATE_GAS_LIMIT (PAY_MASTER_VALIDATE_GAS_LIMIT is a very small value)
   3. Ban pay master address if gas cost is greater than PAY_MASTER_VALIDATE_GAS_LIMIT
2. PayMaster failure
   1. We should simply ban PayMaster if it raises unexpected errors, such as failing to process handlePostOp
3. User operation failure
   1. The block producer should record each paymaster's total invalid gas.
   2. If a user passes validatePaymasterUserOp and still fails, the used gas should be accumulated to paymaster's total invalid gas
   3. The paymaster should be banned once total invalid gas reach a limit.
   4. This incentivize paymaster to check users' behavior before sponsoring.
4. The block producer should be able to disable gas-less txs during DOS. We should add a config option to enable/disable the gas-less feature.