Executive brief
The @account-kit/smart-contracts library is used by developers to build secure smart contract wallets and account abstraction systems. A bug in the allowlist module allows session keys to bypass security restrictions intended to limit transaction permissions, potentially enabling unauthorized transactions or contract interactions.
Technical details
The vulnerability is an authentication/authorization bypass (CWE-288) in the allowlist module of Modular Account V2. The allowlist is a security control intended to restrict which functions or addresses session keys can interact with; however, a logic flaw permits session keys to completely bypass this allowlist configuration. The vulnerability affects versions 4.8.0 through 4.28.1 of @account-kit/smart-contracts and is fixed in version 4.28.2. No CVE has been assigned. The attack requires network access to a contract using the vulnerable library, with no authentication or user interaction needed from the account holder.
Affected products
- Alchemy @account-kit/smart-contracts >=4.8.0, <4.28.2
Timeline
- 2025-04-29: disclosed
- 2025-04-29: patched: Fixed in version 4.28.2