How Does the Entry Point Contract Validate a Paymaster Signature?

06 October 2026

The entry point contract validates a paymaster signature by checking that the paymaster contract has authorized the UserOperation using ERC-1271 contract signature verification, performed during the validation phase of the ERC-4337 execution cycle.

The Role of the Paymaster in ERC-4337

In the ERC-4337 standard, a paymaster is a smart contract that agrees to pay the gas fees for a user's transaction. The user's wallet constructs a UserOperation that includes a paymasterAndData field. This field contains the paymaster contract address and a signature from the paymaster authorizing the operation. The entry point contract must verify this signature before allowing the UserOperation to proceed, ensuring the paymaster has consented to cover the costs.

Step-by-Step Validation Process

The entry point contract validates the paymaster signature during the handleOps function execution. Here is how it works in order:

1. Extraction of Paymaster Data

When the entry point processes a UserOperation, it parses the paymasterAndData field. The first 20 bytes of this field are the paymaster contract address. The remaining bytes are the paymaster-specific data, which includes the signature and any additional parameters the paymaster requires for validation.

2. Call to validatePaymasterUserOp

The entry point calls the validatePaymasterUserOp function on the paymaster contract. This function receives: - The UserOperation object (or a hash of it) - The maxCost that the paymaster is expected to cover - The paymaster-specific data from paymasterAndData

The paymaster contract must implement this function according to the ERC-4337 specification. It returns a context byte array and a validationData value.

3. signature verification using ERC-1271

Inside validatePaymasterUserOp, the paymaster contract performs signature verification. Because the paymaster is itself a smart contract, it cannot use standard ECDSA signatures like an externally owned account. Instead, it uses ERC-1271 contract signature verification.

The paymaster contract: - Computes a hash of the UserOperation (or a relevant subset of it) - Passes that hash and the signature (extracted from the paymaster data) to its own isValidSignature function - The isValidSignature function returns the ERC-1271 magic value (0x1626ba7e) if the signature is valid, or an error if it is not

This is the same mechanism used by smart contract wallets to verify signatures, but here it is applied to the paymaster contract itself.

4. validation data return

The validatePaymasterUserOp function returns a validationData value that encodes three pieces of information: - Whether the signature is valid (a zero value means valid, non-zero means invalid) - The timestamp after which the paymaster's authorization expires (validAfter) - The timestamp before which the paymaster's authorization expires (validUntil)

The entry point contract checks this return value. If the signature is invalid, the entry point reverts with an error code such as "AA30 paymaster signature error".

5. Prefund Verification

After signature validation, the entry point checks that the paymaster has deposited enough ETH into the entry point contract to cover the maximum cost of the UserOperation. This is the "AA21 didn't pay prefund" check. The paymaster must have deposited funds before the operation is submitted. The signature validation happens before the entry point deducts the prefund, so the signature must be valid before any funds are taken.

What the paymaster signature authorizes

The paymaster signature does not authorize a specific gas price or exact fee amount. Instead, it authorizes the paymaster to cover the costs of the UserOperation up to the maxFeePerGas and maxPriorityFeePerGas specified in the operation. The paymaster can impose its own limits or conditions inside validatePaymasterUserOp, such as checking that the user is whitelisted or that the operation does not exceed a certain gas limit.

Security Implications

The entry point contract does not care how the paymaster verifies the signature internally. It only cares that the validatePaymasterUserOp function returns a valid result. This means:

• The paymaster can use any signature scheme it wants, as long as it implements ERC-1271
• The paymaster can also choose not to verify a signature at all, effectively allowing anyone to use it (this is rare in practice)
• The paymaster must be careful about replay attacks: if the same signature can be used multiple times, a user could submit the same UserOperation repeatedly, draining the paymaster's deposit

Common Failure Points

If the paymaster signature validation fails, the entry point will reject the UserOperation. Common causes include:

• The paymaster contract address in paymasterAndData does not match the contract that actually validates the signature
• The signature bytes are malformed or missing
• The paymaster's isValidSignature function returns an incorrect value
• The paymaster has not implemented ERC-1271 correctly

In all these cases, the entry point will revert with a specific error code that helps debug the issue. The most common is "AA30 paymaster signature error", which indicates the signature validation itself failed.

Summary

The entry point contract validates a paymaster signature by delegating the actual verification to the paymaster contract through the validatePaymasterUserOp function. The paymaster uses ERC-1271 to check that the signature in the UserOperation matches the hash of the operation. If the signature is valid and the paymaster has sufficient funds, the operation proceeds. If not, the entry point reverts.

Back to smart wallets