Summary

An Attacker can frontrun the account creation of the User and get the Account on the address the User was expecting.

Vulnerability Details

https://eips.ethereum.org/EIPS/eip-4337

In a ERC4337 transaction flow, a Bundler batches transactions from the Alt mempool and posts them on-chain. So in this case, the tx.origin for all the batched transactions is the address of the Bundler. An attacker can monitor the Alt mempool for createAccount calls and frontrun it by copying the user provided salt and paying a higher gas price.

The Frontrunning can happen in the following way

1. An Attacker monitors the Alt mempool for transactions which create an Arcadia Account

2. User A transmits a transaction to the Alt mempool

3. Once the Attacker finds User A's transaction, he creates an identical transaction with the same user provided salt and pays a higher price to the bundler to be included before the User A's transaction.

4. The Attacker's transaction is included in a block and the User A's transaction fails.

Impact

This vulnerability essentially makes all Account Abstraction wallets susceptible to frontrunning and Denial of Service attacks when creating an Arcadia Account.

Tools Used

Manual Review

Recommendations

To stop the above vulnerability the msg.sender along with the tx.origin can be used to hash the salt of the Proxy creation.

This way the frontrunning attack through the ERC4337 transaction flow is fixed and deployments through thrid party contracts are also possible.