Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-03·audit-finding

The gas model documents transaction paths the contracts do not have

Fixednfterc-1155marketplace
TL;DR

The gas model documents transaction paths the contracts do not have. Final disposition: Fixed.

Severity
LOW
Method
MManual review
CAT.

Tracker: issue #23 · Status: Fixed · Verified at: audit-v3-rereview-handoff

02Section · Affected files

Affected files

docs/gas_model.md#L3-L21

03Section · Description

Description

docs/gas_model.md is presented as the current Base Sepolia gas guide, but its transaction model does not match the implementation. It describes ERC-4337 UserOperation submission through an EntryPoint and paymaster, names the deleted buySpecial entry point, and instructs users to approve USDC. The current architecture uses MPC EOAs and signed relaying: special-market purchases call buySpecialFor, both payment paths use EIP-3009 receiveWithAuthorization, and neither path reads an allowance.

An integrator following this guide can build a nonexistent UserOperation/paymaster flow, call a selector the market no longer exposes, and request an approval the payment path never consumes. The resulting Special purchase flow is incompatible with the current contracts.

The mismatch can be reproduced from the repository root:

code
set -e
rg -q 'ERC-4337 UserOperation' docs/gas_model.md
! rg -q -i 'entrypoint|useroperation|validateuserop' src
rg -q 'function buySpecialFor\(' src/PlakxioSpecialMarket.sol
! rg -q 'function buySpecial\(' src/PlakxioSpecialMarket.sol
rg -q 'receiveWithAuthorization\(' src/PlakxioSettlement.sol
rg -q 'receiveWithAuthorization\(' src/PlakxioSpecialMarket.sol
! rg -q '\.approve\(|allowance\(' src/PlakxioSettlement.sol src/PlakxioSpecialMarket.sol
printf '%s\n' 'PASS gas_model.md claims ERC-4337' 'PASS src/ has no ERC-4337 integration symbols' 'PASS buySpecial is absent; buySpecialFor is present' 'PASS both payment paths use receiveWithAuthorization' 'PASS neither payment path reads an allowance'

Observed output:

code
PASS gas_model.md claims ERC-4337
PASS src/ has no ERC-4337 integration symbols
PASS buySpecial is absent; buySpecialFor is present
PASS both payment paths use receiveWithAuthorization
PASS neither payment path reads an allowance
04Section · Recommendations

Recommendations

Update the current transaction rows and contract-side requirements to describe MPC EOA signed relaying, buySpecialFor, and EIP-3009 receiveWithAuthorization. Remove the obsolete ERC-4337, EntryPoint, paymaster, USDC approval, and buySpecial instructions. If smart-account support remains planned, label it clearly as future behavior rather than part of the current Base Sepolia flow.

This is a documentation-only change with no bytecode or deployment-size cost.

05Section · Remediation

Remediation

Fixed. The document now describes the transaction paths that exist. The ERC-4337 flow, the EntryPoint, the paymaster, the buySpecial entry point and the USDC approve step are all gone, replaced by a signer/submitter split that matches the contracts, including the EIP-3009 pull on both payment paths.

06Section · Verification provenance

Verification provenance

Final disposition: Fixed. Verified at audit-v3-rereview-handoff, commit f020448976eb7c4895e1626ef3228876cff2b7d2. This earlier remediation disposition is carried forward from the prior re-review, not independently re-verified in the generation-d pass. The report-wide scope and evidence limitations remain applicable; see the final report overview.

Status
Fixed
L-03