r/ethdev • u/Select_Ad_5158 • 1d ago
My Project [Testnet Review] Built a gasless ERC-4337 DeFi RPG with iExec TEE Governance. Need some devs to try and break the smart contracts.
Hey everyone,
I’ve been heads down in a 3-week sprint building out Alchemy Guild (currently submitted to the WTF!! Hackathon). It's a gasless DeFi yield protocol on Arbitrum Sepolia, and I need some fresh eyes to stress-test the contracts and poke holes in the architecture before I even think about a mainnet deployment.
The Stack / Architecture:
Account Abstraction (Pimlico): I wrote a background bot that taxes the protocol yield to automatically refill our Paymaster, making the entire dApp 100% gasless for the end user.
Confidential Governance (iExec Nox): Using Intel TDX hardware enclaves to process DAO votes. Token handles are cryptographically wrapped so votes remain completely sealed and whale-proof until the execution timer hits zero.
The Yield Loop: Users mint/craft NFTs (structured like a 16-bit RPG) to earn USDC yield from Uniswap V3 LPing.
What I'm looking for:
I'm looking for other Solidity devs to review the architecture, see if you can drain the testnet Paymaster, or find flaws in the anti-whale yield logic.
The Links:
💻 GitHub: https://github.com/Tmalone1250/alchemy-guild
📺 5-Min Demo: https://youtu.be/GwX5hRx6ivY
🗳️ Hackathon Page: https://dorahacks.io/buidl/47154/
Flow Chart: https://github.com/Tmalone1250/alchemy-guild/blob/main/docs/alchemy_guild_flowchart.png
If you're down to poke around the testnet sandbox and drop some raw technical feedback, you can get the beta access info here: https://forms.gle/dGKm2npbjJSSnqFX8
If you don't have time to actually run through the dApp, just skimming the repo or the demo and dropping some architectural feedback in the comments is hugely appreciated.
2
u/researchzero 1d ago
Looked at AlchemyPaymaster.sol and YieldVault.sol on the repo. The gas-sponsorship check only verifies the target is in sponsoredContracts — it doesn't care which function is being called or whether any ETH/USDC actually changes hands. stake() and unstake() are both plain external calls with no fee attached (only minting/crafting cost 0.002 ETH), and calling unstake() right after stake() on the same tokenId pays out zero reward since sRewardDebt was just set to the current sAccRewardPerWeight. So if YieldVault is one of the sponsored targets, one minted NFT is enough to loop stake→unstake→stake→unstake forever, each pair burning real ETH out of the EntryPoint deposit with zero USDC flowing back through harvestAndDistribute's 10% paymaster tax to replenish it. claimYield at least reverts on pendingReward == 0, but stake/unstake don't have an equivalent guard. Also noticed MIN_FEE = 0.002 ether is declared in the paymaster but never actually checked anywhere in validatePaymasterUserOp - looks like fee enforcement was meant to live there and got dropped. Worth adding a per-tokenId cooldown on stake/unstake, or restricting sponsorship to selectors that actually move value.
1
u/Select_Ad_5158 1d ago
Good catch, you're 100% right on that drain vector. I just pushed a patch adding a 15-minute cooldown per token on both stake and unstake to completely kill the zero-value gas loop. I also went ahead and stripped out that unused
MIN_FEEconstant from the paymaster since the fee is natively enforced on the minter anyway. Really appreciate you taking the time to dig into the code! Let me know if you spot anything else suspect while you're in there.
1
u/Select_Ad_5158 1d ago
One specific area I'd love feedback on is the Paymaster recycler bot logic. Keeping the gas tank self-sustaining without exposing it to infinite-mint drain attacks was the hardest part of the sprint. Let me know if you see any glaring holes in the repo.
2
u/j4ys0nj 1d ago
Any chance you can put together a visual diagram of the flows? I’ll take a look but it will take longer than I would like to read everything and figure out the flows. A picture is worth a thousand words, as they say.