# exit 255 # stdout # stderr 'forge clean' running (wd: /tmp/audits/2026-03-intuition) 'forge config --json' running 'forge build --build-info src/protocol/wallet/AtomWallet.sol' running (wd: /tmp/audits/2026-03-intuition) INFO:Detectors: Detector: arbitrary-send-eth BaseAccount._payPrefund(uint256) (lib/account-abstraction/contracts/core/BaseAccount.sol#152-160) sends eth to arbitrary user Dangerous calls: - (success,None) = address(msg.sender).call{value: missingAccountFunds}() (lib/account-abstraction/contracts/core/BaseAccount.sol#154-156) AtomWallet._call(address,uint256,bytes) (src/protocol/wallet/AtomWallet.sol#319-326) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/protocol/wallet/AtomWallet.sol#320) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#functions-that-send-ether-to-arbitrary-destinations INFO:Detectors: Detector: calls-loop AtomWallet._call(address,uint256,bytes) (src/protocol/wallet/AtomWallet.sol#319-326) has external calls inside a loop: (success,result) = target.call{value: value}(data) (src/protocol/wallet/AtomWallet.sol#320) Calls stack containing the loop: AtomWallet.executeBatch(address[],uint256[],bytes[]) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation/#calls-inside-a-loop INFO:Detectors: Detector: assembly Exec.call(address,uint256,bytes,uint256) (lib/account-abstraction/contracts/utils/Exec.sol#11-20) uses assembly - INLINE ASM (lib/account-abstraction/contracts/utils/Exec.sol#17-19) Exec.staticcall(address,bytes,uint256) (lib/account-abstraction/contracts/utils/Exec.sol#22-30) uses assembly - INLINE ASM (lib/account-abstraction/contracts/utils/Exec.sol#27-29) Exec.delegateCall(address,bytes,uint256) (lib/account-abstraction/contracts/utils/Exec.sol#32-40) uses assembly - INLINE ASM (lib/account-abstraction/contracts/utils/Exec.sol#37-39) Exec.getReturnData(uint256) (lib/account-abstraction/contracts/utils/Exec.sol#44-58) uses assembly - INLINE ASM (lib/account-abstraction/contracts/utils/Exec.sol#45-57) Exec.revertWithData(bytes) (lib/account-abstraction/contracts/utils/Exec.sol#61-65) uses assembly - INLINE ASM (lib/account-abstraction/contracts/utils/Exec.sol#62-64) ECDSA.tryRecover(bytes32,bytes) (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#60-79) uses assembly - INLINE ASM (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#70-74) ECDSA.tryRecoverCalldata(bytes32,bytes) (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#84-103) uses assembly - INLINE ASM (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#94-98) ECDSA.parse(bytes) (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#211-234) uses assembly - INLINE ASM (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#212-233) ECDSA.parseCalldata(bytes) (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#239-262) uses assembly - INLINE ASM (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#240-261) Ownable2StepUpgradeable._getOwnable2StepStorage() (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#35-39) uses assembly - INLINE ASM (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#36-38) OwnableUpgradeable._getOwnableStorage() (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#30-34) uses assembly - INLINE ASM (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#31-33) Initializable._getInitializableStorage() (lib/openzeppelin-contracts-upgradeable/contracts/proxy/utils/Initializable.sol#232-237) uses assembly - INLINE ASM (lib/openzeppelin-contracts-upgradeable/contracts/proxy/utils/Initializable.sol#234-236) ReentrancyGuardUpgradeable._getReentrancyGuardStorage() (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#49-53) uses assembly - INLINE ASM (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#50-52) AtomWallet._call(address,uint256,bytes) (src/protocol/wallet/AtomWallet.sol#319-326) uses assembly - INLINE ASM (src/protocol/wallet/AtomWallet.sol#322-324) AtomWallet._extractValidUntilAndValidAfterFromSignature(bytes) (src/protocol/wallet/AtomWallet.sol#337-361) uses assembly - INLINE ASM (src/protocol/wallet/AtomWallet.sol#355-357) AtomWallet._getAtomWalletOwnerStorage() (src/protocol/wallet/AtomWallet.sol#367-371) uses assembly - INLINE ASM (src/protocol/wallet/AtomWallet.sol#368-370) AtomWallet._getAtomWalletPendingOwnerStorage() (src/protocol/wallet/AtomWallet.sol#377-381) uses assembly - INLINE ASM (src/protocol/wallet/AtomWallet.sol#378-380) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#assembly-usage INFO:Detectors: Detector: pragma 3 different versions of Solidity are used: - Version constraint ^0.8.28 is used by: -^0.8.28 (lib/account-abstraction/contracts/core/BaseAccount.sol#2) -^0.8.28 (lib/account-abstraction/contracts/core/Helpers.sol#2) -^0.8.28 (lib/account-abstraction/contracts/core/UserOperationLib.sol#2) -^0.8.28 (lib/account-abstraction/contracts/interfaces/IAccount.sol#2) -^0.8.28 (lib/account-abstraction/contracts/interfaces/IAggregator.sol#2) -^0.8.28 (lib/account-abstraction/contracts/interfaces/IEntryPoint.sol#6) -^0.8.28 (lib/account-abstraction/contracts/interfaces/INonceManager.sol#2) -^0.8.28 (lib/account-abstraction/contracts/interfaces/ISenderCreator.sol#3) -^0.8.28 (lib/account-abstraction/contracts/interfaces/IStakeManager.sol#2) -^0.8.28 (lib/account-abstraction/contracts/interfaces/PackedUserOperation.sol#2) -^0.8.28 (lib/account-abstraction/contracts/utils/Exec.sol#2) - Version constraint ^0.8.20 is used by: -^0.8.20 (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#4) -^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#4) -^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#4) -^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/proxy/utils/Initializable.sol#4) -^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/utils/ContextUpgradeable.sol#4) -^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#4) - Version constraint 0.8.29 is used by: -0.8.29 (src/interfaces/IMultiVault.sol#2) -0.8.29 (src/interfaces/IMultiVaultCore.sol#2) -0.8.29 (src/protocol/wallet/AtomWallet.sol#2) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#different-pragma-directives-are-used INFO:Detectors: Detector: dead-code _packValidationData(ValidationData) (lib/account-abstraction/contracts/core/Helpers.sol#61-68) is never used and should be removed _parseValidationData(uint256) (lib/account-abstraction/contracts/core/Helpers.sol#44-54) is never used and should be removed calldataKeccak(bytes) (lib/account-abstraction/contracts/core/Helpers.sol#95-102) is never used and should be removed finalizeAllocation(uint256,uint256) (lib/account-abstraction/contracts/core/Helpers.sol#121-135) is never used and should be removed finalizeAllocation.asm_0.finalize_allocation(uint256,uint256) (lib/account-abstraction/contracts/core/Helpers.sol#126-129) is never used and should be removed finalizeAllocation.asm_0.round_up_to_mul_of_32(uint256) (lib/account-abstraction/contracts/core/Helpers.sol#131-133) is never used and should be removed min(uint256,uint256) (lib/account-abstraction/contracts/core/Helpers.sol#111-113) is never used and should be removed Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#dead-code INFO:Detectors: Detector: solc-version Version constraint ^0.8.20 contains known severe issues (https://solidity.readthedocs.io/en/latest/bugs.html) - VerbatimInvalidDeduplication - FullInlinerNonExpressionSplitArgumentEvaluationOrder - MissingSideEffectsOnSelectorAccess. It is used by: - ^0.8.20 (lib/openzeppelin-contracts/contracts/utils/cryptography/ECDSA.sol#4) - ^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#4) - ^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#4) - ^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/proxy/utils/Initializable.sol#4) - ^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/utils/ContextUpgradeable.sol#4) - ^0.8.20 (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#4) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#incorrect-versions-of-solidity INFO:Detectors: Detector: low-level-calls Low level call in BaseAccount._payPrefund(uint256) (lib/account-abstraction/contracts/core/BaseAccount.sol#152-160): - (success,None) = address(msg.sender).call{value: missingAccountFunds}() (lib/account-abstraction/contracts/core/BaseAccount.sol#154-156) Low level call in AtomWallet._call(address,uint256,bytes) (src/protocol/wallet/AtomWallet.sol#319-326): - (success,result) = target.call{value: value}(data) (src/protocol/wallet/AtomWallet.sol#320) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#low-level-calls INFO:Detectors: Detector: naming-convention Function Ownable2StepUpgradeable.__Ownable2Step_init() (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#43-44) is not in mixedCase Function Ownable2StepUpgradeable.__Ownable2Step_init_unchained() (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#46-47) is not in mixedCase Constant Ownable2StepUpgradeable.Ownable2StepStorageLocation (lib/openzeppelin-contracts-upgradeable/contracts/access/Ownable2StepUpgradeable.sol#33) is not in UPPER_CASE_WITH_UNDERSCORES Function OwnableUpgradeable.__Ownable_init(address) (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#51-53) is not in mixedCase Function OwnableUpgradeable.__Ownable_init_unchained(address) (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#55-60) is not in mixedCase Constant OwnableUpgradeable.OwnableStorageLocation (lib/openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol#28) is not in UPPER_CASE_WITH_UNDERSCORES Function ContextUpgradeable.__Context_init() (lib/openzeppelin-contracts-upgradeable/contracts/utils/ContextUpgradeable.sol#18-19) is not in mixedCase Function ContextUpgradeable.__Context_init_unchained() (lib/openzeppelin-contracts-upgradeable/contracts/utils/ContextUpgradeable.sol#21-22) is not in mixedCase Function ReentrancyGuardUpgradeable.__ReentrancyGuard_init() (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#60-62) is not in mixedCase Function ReentrancyGuardUpgradeable.__ReentrancyGuard_init_unchained() (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#64-67) is not in mixedCase Constant ReentrancyGuardUpgradeable.ReentrancyGuardStorageLocation (lib/openzeppelin-contracts-upgradeable/contracts/utils/ReentrancyGuardUpgradeable.sol#47) is not in UPPER_CASE_WITH_UNDERSCORES Parameter AtomWallet.initialize(address,address,bytes32)._multiVault (src/protocol/wallet/AtomWallet.sol#107) is not in mixedCase Parameter AtomWallet.initialize(address,address,bytes32)._termId (src/protocol/wallet/AtomWallet.sol#107) is not in mixedCase Constant AtomWallet.AtomWalletOwnerStorageLocation (src/protocol/wallet/AtomWallet.sol#46-47) is not in UPPER_CASE_WITH_UNDERSCORES Constant AtomWallet.AtomWalletPendingOwnerStorageLocation (src/protocol/wallet/AtomWallet.sol#54-55) is not in UPPER_CASE_WITH_UNDERSCORES Variable AtomWallet.__gap (src/protocol/wallet/AtomWallet.sol#74) is not in mixedCase Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions INFO:Detectors: Detector: unused-state AtomWallet.__gap (src/protocol/wallet/AtomWallet.sol#74) is never used in AtomWallet (src/protocol/wallet/AtomWallet.sol#23-382) Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#unused-state-variable INFO:Slither:src/protocol/wallet/AtomWallet.sol analyzed (18 contracts with 101 detectors), 48 result(s) found