coinbase / coinbase/verifying-paymaster
`precheckBalance` should also verify token allowance, not just balance
- Dominant language
- Solidity
- Stars
- 8
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
## `precheckBalance` should also verify token allowance, not just balance
### Problem
The current `precheckBalance` only checks the token balance but ignores allowance, causing validation to pass but execution to fail.
**Current code:**
```solidity
if (paymasterData.precheckBalance) {
uint256 balance = SafeTransferLib.balanceOf(paymasterData.token, userOp.sender);
if (balance < maxTokenCost) {
revert SenderTokenBalanceTooLow(paymasterData.token, balance, maxTokenCost);
}
}
```
**Issue**
UserOperations pass validation even when:
- Sender hasn't approved the paymaster
- Allowance is less than maxTokenCost
This creates false positives - operations appear valid but fail during bundling.
**Proposed Solution**
Check both balance and allowance:
```solidity
if (paymasterData.precheckBalance) {
uint256 balance = SafeTransferLib.balanceOf(paymasterData.token, userOp.sender);
uint256 allowance = SafeTransferLib.allowance(paymasterData.token, userOp.sender, address(this));
uint256 available = balance < allowance ? balance : allowance;
if (available < maxTokenCost) {
revert SenderInsufficientTokensOrAllowance(paymasterData.token, balance, allowance, maxTokenCost);
}
}
```
This improves validation accuracy and reduces bundling failures.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.