Security Audit Report for MegaETH's Normal Account Contracts

The target of this audit is the private code repository of Normal Account Contracts of MegaETH. The Normal Account Contracts of MegaETH is a smart account infrastructure for EOAs leveraging EIP-7702 delegation. Its core objective is to upgrade standard EOAs into fully programmable smart accounts without deploying individual proxy contracts per user. Through EIP-7702’s code delegation mechanism, an EOA can dynamically bind to predefined account logic while retaining its original address. The system supports multi-key authorization (secp256k1, P-256, WebAuthn, external signers), fine-grained spending limits, customizable execution guards to constrain transaction behavior, a new gas-payment system for flexible fee sponsorship, and cross-chain settlement capabilities that let a single account securely and efficiently interact across multiple chains

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 3 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The Normal Account Contracts team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.