Skip to content

Lack of extcodesize validation on implementation in ERC4337Factory

Moderate
Vectorized published GHSA-8xvx-4mvg-m9v8 Jul 17, 2025

Package

npm solady (npm)

Affected versions

>=0.0.125 <0.1.24

Patched versions

0.1.24

Description

Impact

When an account is deployed via a proxy, using regular Solidity to call their initialization function may result in a silent failure, if the initialization function does not return a bool or some other return data.

This is because regular Solidity use extcodesize(proxy) to decide if call succeeds. This is insufficient in the case when the proxy points to an empty implementation.

Patches

Upgrade to Solady v0.1.24 or later.

Workarounds

Deploy any affected implementations and their factories on new EVM chains as soon as possible.

Severity

Moderate

CVE ID

CVE-2025-53638

Weaknesses

No CWEs

Credits