Submitted by taek
contracts/smart-contract-wallet/paymasters/verifying/singleton/VerifyingSingletonPaymaster.sol#L97-L111
Paymasters signature can be replayed to drain their deposits.
Scenario :
files : Upgrader.sol, MaliciousAccount.sol, test file https://gist.github.com/leekt/d8fb59f448e10aeceafbd2306aceaab2
hardhat test, verified with livingrock
Since validatePaymasterUserOp function is not limited to view function in erc4337 spec, add simple boolean data for mapping if hash is used or not
livingrockrises (Biconomy) confirmed, but commented:
