coinbase / coinbase/verifying-paymaster

`precheckBalance` should also verify token allowance, not just balance

Open
#14 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Solidity
Stars
8
Forks
8
PR merge metrics
No merged PRs in 30d

Description

## `precheckBalance` should also verify token allowance, not just balance

### Problem
The current `precheckBalance` only checks the token balance but ignores allowance, causing validation to pass but execution to fail.

**Current code:**

```solidity
if (paymasterData.precheckBalance) {
uint256 balance = SafeTransferLib.balanceOf(paymasterData.token, userOp.sender);
if (balance < maxTokenCost) {
revert SenderTokenBalanceTooLow(paymasterData.token, balance, maxTokenCost);
}
}
```

**Issue**

UserOperations pass validation even when:

- Sender hasn't approved the paymaster
- Allowance is less than maxTokenCost

This creates false positives - operations appear valid but fail during bundling.

**Proposed Solution**

Check both balance and allowance:

```solidity
if (paymasterData.precheckBalance) {
uint256 balance = SafeTransferLib.balanceOf(paymasterData.token, userOp.sender);
uint256 allowance = SafeTransferLib.allowance(paymasterData.token, userOp.sender, address(this));
uint256 available = balance < allowance ? balance : allowance;

if (available < maxTokenCost) {
revert SenderInsufficientTokensOrAllowance(paymasterData.token, balance, allowance, maxTokenCost);
}
}
```

This improves validation accuracy and reduces bundling failures.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.