Summary

The MondrianWallet2 contract, an implementation of the IAccount interface for zkSync Era, contains an unimplemented prepareForPaymaster function. While this function is required by the interface, its current empty implementation could potentially lead to confusion or misuse.

Vulnerability Details

An external actor could call this function without any effect:

This call would succeed but perform no action, potentially confusing the caller or wasting gas.

Impact

The empty implementation of prepareForPaymaster presents minimal direct security risks but could lead to confusion for developers or auditors unfamiliar with the zkSync Era system. Even though the function does nothing, if called, it will still costs gas, leading to unnecessary gas consumption.

The overall impact is limited due to the function being a required part of the IAccount interface andintended for specific system interactions.

Tools Used

Recommendations

Implement basic Access Control. Even though the severity is low, it's still good practice to add these: