Ethereum Paymaster: Who Actually Pays Gas?
The paymaster pays. That is the blunt, uncomfortable answer most developers dance around for months before they finally read the EntryPoint contract carefully. But the real question is never who signs the transaction — it is who absorbs the liability when the Ethereum Paymaster runs dry or gets drained by a malicious UserOperation.
Breaking Down the ERC-4337 Gas Flow
In the classic account model, gas comes from the EOA balance. Done. No debate. With account abstraction under ERC-4337, the flow splits into three distinct parties: the bundler, the EntryPoint, and the paymaster. The bundler fronts ETH to the EntryPoint. The EntryPoint validates and executes the UserOperation. The paymaster then either pre-funds a deposit or agrees to cover the post-op gas cost through a gas sponsorship model. Every single layer here is a potential exploit vector. 🎯
Most teams assume the paymaster only handles the premium. Wrong. It covers verification gas, call gas, and the dreaded postOp overhead — which is where the real bleeding happens. If your postOp logic is sloppy, a single malicious calldata can drain the entire deposit in one block.
The Three Paymaster Archetypes and Their Risk Profiles
Verifying paymasters sign off-chain and then submit a signature. Deposit paymasters lock ETH directly into the EntryPoint. Token paymasters accept ERC-20 and swap it internally for gas. Each has a distinct failure mode.
The verifying paymaster is the most abused. If the off-chain signer key leaks, an attacker can forge unlimited sponsorship approvals. We have seen this in production — not theory. The token paymaster is the most dangerous for liquidity. A thin DEX pool plus a large UserOperation equals catastrophic slippage for the paymaster operator. And the deposit paymaster? It is the simplest but also the most capital-inefficient, which is exactly why most gambling dApps and high-frequency betting platforms avoid it unless they are running their own bundler infrastructure.
Where the Money Really Goes: PostOp and Context Abuse
Here is the part nobody wants to publish. The postOp function runs after execution, and it has access to the UserOperation context. A malicious actor can craft a UserOperation that forces the paymaster into a postOp loop, burning gas on every iteration while the paymaster's deposit shrinks. The EntryPoint's penalty mechanism for failed ops adds salt to the wound.
In high-stakes environments — sportsbooks, live dealer platforms, crypto casinos — the gas abstraction layer must be treated as a financial ledger, not a UX feature. Every sponsored transaction is a liability entry. If your paymaster does not have a per-user rate limit and a global circuit breaker, you are one bad block away from insolvency. 💀
Auditors who understand this space do not just check the paymaster contract. They check the bundler's mempool simulation, the EntryPoint's validation rules, and the token swap router's slippage parameters. Three contracts, one exploit chain. Miss any link and the whole sponsorship model collapses.
Who Pays When the Paymaster Is the Victim?
The paymaster operator pays. Not the user. Not the bundler. The EntryPoint will revert the operation, but the gas consumed during validation and the penalty for a failed op still hit the paymaster's deposit. This is the single most misunderstood clause in the entire ERC-4337 spec. Sponsorship is not free — it is a credit facility with asymmetric downside.
Smart operators set deposit caps, use signature expiry windows under 30 seconds, and enforce strict calldata whitelisting. Dumb operators launch a token paymaster with no oracle and get sandwiched into oblivion. The difference between a profitable sponsorship program and a drained treasury is about 200 lines of defensive Solidity and one honest risk assessment.