Six ways ERC-4337 smart accounts fail in audits

A normal Ethereum wallet has one rule: whoever holds the key controls the account. Blunt, but predictable. ERC-4337 swaps that rule for a function you write, validateUserOp . Whatever logic sits in there is now the account's whole security. The EntryPoint will call it, the bundler will forward whatever passes it, and if it's wrong, nothing downstream saves you. Something that used to be protected…