[← Source sessions](/audits/fable/key-sessions) · [Transcript archive](/audits/fable/transcripts) · [Executive summary](/audits/fable/findings-summary)
# Injected is not defined
| Field | Value |
| --- | --- |
| Session ID | `6d75f403-a5b4-4f45-b928-bf2116a7196a` |
| Record type | Lead review session export |
:::note[Appendix record]
Readable export of a supplementary review session. Tool outputs and system context are omitted; download the [JSONL archive](/audits/fable-chats-4626-2026-06.zip) for the complete log.
:::
## Engagement brief
Friday, Jun 12, 2026, 11:14 AM (UTC-7)
Uncaught ReferenceError: injected is not defined
at injected.js:110:1
46Loading the image '' violates the following Content Security Policy directive: "img-src 'self' data: blob: ". The action has been blocked.
embedded-wallets-37f3bce68d4a22d6.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 Warning!
embedded-wallets-37f3bce68d4a22d6.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 You are reading this message because you opened the browser console, a developer tool. Do not enter or paste code you do not understand. Never share your tokens or any other info with anyone. If someone told you to do this, it is very likely a scam.
main-DCekUZjI.js:4617 Connecting to 'https://coins.llama.fi/prices/current/coingecko:ethereum' violates the following Content Security Policy directive: "connect-src 'self' https://auth.privy.io https://privy.4626.fun https://privy.app.4626.fun https://api.developer.coinbase.com https://chain-proxy.wallet.coinbase.com https://keys.coinbase.com https://.wallet.coinbase.com https://account.base.app https://api.cdp.coinbase.com https://base-mainnet.g.alchemy.com https://.g.alchemy.com https://explorer-api.walletconnect.com https://metamask-sdk.api.cx.metamask.io wss://metamask-sdk.api.cx.metamask.io wss://www.walletlink.org https://www.walletlink.org https://.rpc.privy.systems https://rpc.zora.energy https://mainnet.base.org https://api.production.xmtp.network:5558 https://.xmtp.network:5558 https://.xmtp.network: wss://.xmtp.network: https://ipfs.decentralized-content.com https://api.lens.xyz https://ccip.ens.xyz https://res.cloudinary.com". The action has been blocked.
window.fetch @ main-DCekUZjI.js:4617
main-DCekUZjI.js:4617 Fetch API cannot load https://coins.llama.fi/prices/current/coingecko:ethereum. Refused to connect because it violates the document's Content Security Policy.
window.fetch @ main-DCekUZjI.js:4617
evmAsk.js:15 Uncaught TypeError: Cannot redefine property: ethereum
at Object.defineProperty ()
at r.inject (evmAsk.js:15:5093)
at Lv.window.addEventListener.once (evmAsk.js:15:9013)
inject @ evmAsk.js:15
Lv.window.addEventListener.once @ evmAsk.js:15
await in Lv.window.addEventListener.once
(anonymous) @ contentScript.js:1
Lv @ evmAsk.js:15
(anonymous) @ evmAsk.js:15
await in (anonymous)
(anonymous) @ evmAsk.js:15
(anonymous) @ evmAsk.js:15
requestProvider.js:2 Uncaught TypeError: Cannot set property ethereum of # which has only a getter
at requestProvider.js:2:585532
at requestProvider.js:2:585712
at requestProvider.js:2:585716
at requestProvider.js:2:585720
(anonymous) @ requestProvider.js:2
(anonymous) @ requestProvider.js:2
(anonymous) @ requestProvider.js:2
(anonymous) @ requestProvider.js:2
injected.js:110 Uncaught ReferenceError: injected is not defined
at injected.js:110:1
(anonymous) @ injected.js:110
main-DCekUZjI.js:4617 Connecting to 'https://coins.llama.fi/prices/current/coingecko:ethereum' violates the following Content Security Policy directive: "connect-src 'self' https://auth.privy.io https://privy.4626.fun https://privy.app.4626.fun https://api.developer.coinbase.com https://chain-proxy.wallet.coinbase.com https://keys.coinbase.com https://.wallet.coinbase.com https://account.base.app https://api.cdp.coinbase.com https://base-mainnet.g.alchemy.com https://.g.alchemy.com https://explorer-api.walletconnect.com https://metamask-sdk.api.cx.metamask.io wss://metamask-sdk.api.cx.metamask.io wss://www.walletlink.org https://www.walletlink.org https://.rpc.privy.systems https://rpc.zora.energy https://mainnet.base.org https://api.production.xmtp.network:5558 https://.xmtp.network:5558 https://.xmtp.network: wss://.xmtp.network: https://ipfs.decentralized-content.com https://api.lens.xyz https://ccip.ens.xyz https://res.cloudinary.com". The action has been blocked.
window.fetch @ main-DCekUZjI.js:4617
main-DCekUZjI.js:4617 Fetch API cannot load https://coins.llama.fi/prices/current/coingecko:ethereum. Refused to connect because it violates the document's Content Security Policy.
window.fetch @ main-DCekUZjI.js:4617
main-DCekUZjI.js:4617 Connecting to 'https://coins.llama.fi/prices/current/base:[0x5b67…fa75](https://basescan.org/address/0x5b674196812451b7cec024fe9d22d2c0b172fa75 "0x5b67…fa75")' violates the following Content Security Policy directive: "connect-src 'self' https://auth.privy.io https://privy.4626.fun https://privy.app.4626.fun https://api.developer.coinbase.com https://chain-proxy.wallet.coinbase.com https://keys.coinbase.com https://.wallet.coinbase.com https://account.base.app https://api.cdp.coinbase.com https://base-mainnet.g.alchemy.com https://.g.alchemy.com https://explorer-api.walletconnect.com https://metamask-sdk.api.cx.metamask.io wss://metamask-sdk.api.cx.metamask.io wss://www.walletlink.org https://www.walletlink.org https://.rpc.privy.systems https://rpc.zora.energy https://mainnet.base.org https://api.production.xmtp.network:5558 https://.xmtp.network:5558 https://.xmtp.network: wss://.xmtp.network: https://ipfs.decentralized-content.com https://api.lens.xyz https://ccip.ens.xyz https://res.cloudinary.com". The action has been blocked.
window.fetch @ main-DCekUZjI.js:4617
main-DCekUZjI.js:4617 Fetch API cannot load https://coins.llama.fi/prices/current/base:[0x5b67…fa75](https://basescan.org/address/0x5b674196812451b7cec024fe9d22d2c0b172fa75 "0x5b67…fa75"). Refused to connect because it violates the document's Content Security Policy.
window.fetch @ main-DCekUZjI.js:4617
21112-83e90d768b862fba.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 Successfully verified access token.
main-DCekUZjI.js:2 [ERC-4337] Bundler entrypoint probe returned RPC error, continuing: request denied - paymaster proxy internal error
console.warn @ main-DCekUZjI.js:2
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor Object
console.warn @ main-DCekUZjI.js:2
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor Object
console.warn @ main-DCekUZjI.js:2
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor Object
console.warn @ main-DCekUZjI.js:2
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor Object
console.warn @ main-DCekUZjI.js:2
main-DCekUZjI.js:2 [ERC-4337] UserOp failed: Missing or invalid parameters. Double check you have provided the correct parameters. URL: https://app.4626.fun/api/paymaster Request body: {"method":"pm_getPaymasterStubData","params":[{"callData":"0x34fcd5be000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000000000000002200000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc100000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000002dd0e30db062635f72306763767434712c62635f33717a726c74733117008021802180218021802180218021802100000000000000000000000000000000000000000000000000000000000000420000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006d095ea7b3000000000000000000000000000000000022d473030f116ddee9f6b43ac78ba3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff62635f72306763767434712c62635f33717a726c747331170080218021802180218021802180218021000000000000000000000000000000000000000000000000000000000000006ff5693b99212da76ad316178a184ab56d299b430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000008243593564c000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000006a2c536900000000000000000000000000000000000000000000000000000000000000030a00100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000260000000000000000000000000000000000000000000000000000000000000038000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000006a53d95c00000000000000000000000000000000000000000000000000000000000000020000000000000000000000006ff5693b99212da76ad316178a184ab56d299b43000000000000000000000000000000000000000000000000000000006a2c536400000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001200000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000041f05a5c7902d2b6d08944ad6ef15846a8b8bcd622dc36808d79f0f175bcb3a91448d6842412b1a3341f9f0eb8fc26e33e4d77b80ef5f26558471fe1f235e569ff1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002b4200000000000000000000000000000000000006000bb81111111111166b7fe7bd91427724b487980afc6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c00000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000030b070e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000000600000000000000000000000001111111111166b7fe7bd91427724b487980afc698000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000200000000000000000000000001111111111166b7fe7bd91427724b487980afc690000000000000000000000000000000000000000000000000000000000000080000000000000000000000 Object
console.error @ main-DCekUZjI.js:2
1112-83e90d768b862fba.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 Successfully verified access token.
main-DCekUZjI.js:2 [ERC-4337] Bundler entrypoint probe returned RPC error, continuing: request denied - paymaster proxy internal error
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
zM @ main-DCekUZjI.js:88
await in zM
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] UserOp failed: Missing or invalid parameters. Double check you have provided the correct parameters. URL: https://app.4626.fun/api/paymaster Request body: {"method":"pm_getPaymasterStubData","params":[{"callData":"0x34fcd5be000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000000000000002200000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc100000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000002dd0e30db062635f72306763767434712c62635f33717a726c74733117008021802180218021802180218021802100000000000000000000000000000000000000000000000000000000000000420000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006d095ea7b3000000000000000000000000000000000022d473030f116ddee9f6b43ac78ba3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff62635f72306763767434712c62635f33717a726c747331170080218021802180218021802180218021000000000000000000000000000000000000000000000000000000000000006ff5693b99212da76ad316178a184ab56d299b430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000008243593564c000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000006a2c537700000000000000000000000000000000000000000000000000000000000000030a00100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000260000000000000000000000000000000000000000000000000000000000000038000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000006a53d96c00000000000000000000000000000000000000000000000000000000000000020000000000000000000000006ff5693b99212da76ad316178a184ab56d299b43000000000000000000000000000000000000000000000000000000006a2c537400000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000416d433737b015e406945f241555b104b9b530c53746128a070bd314b98a98aa9068f12cae4a45bea77d264e7c113cc2d82fa8e66f97190d616f0a47fa8d97a4a21c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002b4200000000000000000000000000000000000006000bb81111111111166b7fe7bd91427724b487980afc6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c00000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000030b070e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000000600000000000000000000000001111111111166b7fe7bd91427724b487980afc698000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000200000000000000000000000001111111111166b7fe7bd91427724b487980afc690000000000000000000000000000000000000000000000000000000000000080000000000000000000000 {smartWallet: '0xab6d…67b5', ownerAddress: '0xcECa…85e9', ownerIsContract: false, userOpSignMode: 'auto', calls: Array(3), …}
console.error @ main-DCekUZjI.js:2
console.error @ main-DCekUZjI.js:4617
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
1112-83e90d768b862fba.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 Successfully verified access token.
main-DCekUZjI.js:2 [ERC-4337] Bundler entrypoint probe returned RPC error, continuing: request denied - paymaster proxy internal error
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
zM @ main-DCekUZjI.js:88
await in zM
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] estimateUserOperationGas advisory skip; using Zora callGas floor {error: 'An error occurred while executing user operation: …e check you have provided the correct parameters.', errorName: undefined, revertData: '0x34fcd5be0000000000000000000000000000000000000000…0000000000000000000000000000000000000000000000000', callGasLimit: '5500000', bundlerUsesProxy: true}
console.warn @ main-DCekUZjI.js:2
console.warn @ main-DCekUZjI.js:4617
ste @ main-DCekUZjI.js:88
await in ste
Ge @ main-DCekUZjI.js:88
ae @ main-DCekUZjI.js:88
await in ae
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
main-DCekUZjI.js:2 [ERC-4337] UserOp failed: Missing or invalid parameters. Double check you have provided the correct parameters. URL: https://app.4626.fun/api/paymaster Request body: {"method":"pm_getPaymasterStubData","params":[{"callData":"0x34fcd5be000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000012000000000000000000000000000000000000000000000000000000000000002200000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc100000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000002dd0e30db062635f72306763767434712c62635f33717a726c74733117008021802180218021802180218021802100000000000000000000000000000000000000000000000000000000000000420000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000006d095ea7b3000000000000000000000000000000000022d473030f116ddee9f6b43ac78ba3ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff62635f72306763767434712c62635f33717a726c747331170080218021802180218021802180218021000000000000000000000000000000000000000000000000000000000000006ff5693b99212da76ad316178a184ab56d299b430000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000008243593564c000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000006a2c538400000000000000000000000000000000000000000000000000000000000000030a00100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000260000000000000000000000000000000000000000000000000000000000000038000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000004200000000000000000000000000000000000006000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000006a53d97a00000000000000000000000000000000000000000000000000000000000000020000000000000000000000006ff5693b99212da76ad316178a184ab56d299b43000000000000000000000000000000000000000000000000000000006a2c538200000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000120000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000004151d6fbe6bb8e8463227cc2f3f894d825e249cf5f0964e237c9cf76c1b9494dc120f33bab8de6d1267ff342b3d799efa8bb6b5824332e959d4c5292836f46f64b1b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000002386f26fc10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000002b4200000000000000000000000000000000000006000bb81111111111166b7fe7bd91427724b487980afc6900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003c00000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000030b070e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000006000000000000000000000000000000000000000000000000000000000000000e000000000000000000000000000000000000000000000000000000000000002a000000000000000000000000000000000000000000000000000000000000000600000000000000000000000001111111111166b7fe7bd91427724b487980afc698000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a000000000000000000000000000000000000000000000000000000000000000200000000000000000000000001111111111166b7fe7bd91427724b487980afc690000000000000000000000000000000000000000000000000000000000000080000000000000000000000 {smartWallet: '0xab6d…67b5', ownerAddress: '0xcECa…85e9', ownerIsContract: false, userOpSignMode: 'auto', calls: Array(3), …}
console.error @ main-DCekUZjI.js:2
console.error @ main-DCekUZjI.js:4617
Gc @ main-DCekUZjI.js:88
await in Gc
tne @ main-DCekUZjI.js:88
Yo @ main-DCekUZjI.js:88
one @ main-DCekUZjI.js:88
(anonymous) @ main-DCekUZjI.js:88
1112-83e90d768b862fba.js?dpl=dpl_5RMSkr38mB8ZUmJPmv9wcD5HAxdi:1 Successfully verified access token.
main-DCekUZjI.js:2 [ERC-4337] Bundler entrypoint probe returned RPC error, continuing: request denied - paymaster proxy internal error
I'll dig into this console dump — two distinct things stand out: the paymaster proxy reporting an internal error, and what looks like corrupted calldata inside the executeBatch UserOp. Let me check the paymaster handler and the swap calldata builder.
Looking at the error from the production app, the user is attempting a sponsored canonical swap on the CSW token, and the paymaster proxy is crashing internally — this points to a handler failure in the /api/paymaster endpoint rather than an issue with the swap logic itself.
The pm_getPaymasterStubData request is being rejected with "Missing or invalid parameters," but the real issue appears to be corrupted calldata. The WETH deposit call is 45 bytes when it should only be 4 bytes, and the approve call is 109 bytes instead of 68 — there's about 41 extra bytes appended that decode to ASCII strings like "bc_r0gcvt4q" and "bc_3qzrlts1" mixed with repeated 8021 bytes. This malformed calldata is likely what's causing the paymaster handler to crash when it tries to process the request.
The pattern strongly suggests a browser extension is tampering with the transaction data before it reaches the paymaster. The console errors mentioning evmAsk.js and injected.js with wallet extension conflicts point to multiple extensions colliding and corrupting window.ethereum — one of them is injecting these tracking markers into the calldata, which is why the bundler rightfully rejects it as invalid.
Let me decode the actual calldata to confirm the corruption. The executeBatch function call shows the deposit operation targeting WETH with that suspicious ASCII string bc_r0gcvt4q,bc_3qzrlts1 embedded in the middle of what should be clean function parameters, followed by garbage bytes.
This pattern — the same corrupted strings appearing consistently across retry attempts — points to something deterministically tampering with the calldata in the page context before it gets sent. The bc_ prefix and the specific junk bytes suggest either a known malicious extension or a wallet extension with a buggy calldata manipulation feature, possibly related to referral tracking or some other injection mechanism. I need to check the paymaster handler code to understand where the internal error is coming from, and also search for any dataSuffix handling that might be corrupting the calldata. The error messages suggest the proxy is crashing in production—either from malformed parameters or the corrupted calldata issue—so I should look at Vercel logs to see what's actually failing. Let me start by examining the paymaster handler paths and then decode what's happening with the probe request.
Tools invoked: Grep, Grep
The working tree has unrelated in-flight work staged, so I'll commit only the hotfix files by path.
I've got some unrelated changes already staged that belong to a different effort, so I need to be careful to commit only my hotfix files. Using git commit <paths> will let me specify exactly which files to include, bypassing the index and avoiding those pre-staged changes.
Tools invoked: Shell
Tools invoked: Shell
I've pushed the changes and now I'm waiting for the Vercel production deployment to complete so I can verify that the /api/paymaster endpoint recovers. I'll check the deployment status using the Vercel CLI and then test the production endpoint with a JSON-RPC request to confirm the fix is working.Pushed to main. Now I'll monitor the Vercel build and check if the /api/paymaster endpoint recovers.
Tools invoked: Shell
The production environment is still down as expected, and a new deployment is currently building—it started about 9 seconds ago and should take around 10 minutes. I'm going to set up a background monitor that polls the deployment status until it's ready, then automatically re-probe the system once it's live.The fix is pushed and Vercel is building the production deployment now. I'll verify the paymaster endpoint once it goes live.
Tools invoked: Shell
The build will take about ten minutes, and since this is a production outage fix, I need to monitor it closely. I'll use AwaitShell to wait for either a DEPLOY_READY or DEPLOY_FAILED signal.The fix is committed and pushed to main, with Vercel building the production deployment now. I'll verify the paymaster endpoint once it's live.
Tools invoked: AwaitShell
The deploy is live. Verifying the production paymaster endpoint now.
Now I need to verify the production endpoint is working correctly—checking that the paymaster proxy no longer throws the generic dispatcher error and instead returns proper JSON-RPC errors from the handler itself. I'll test with empty parameters on both the main endpoint and a benign method like pm_getPaymasterStubData to confirm the validation errors are distinguishable from the previous crash behavior.
Tools invoked: Shell
The production handler is working correctly now—invalid parameters properly return the standard JSON-RPC error code, and the entrypoint query returns the actual list from the upstream bundler instead of crashing. I'll mark the remaining tasks as complete and wrap this up.
Tools invoked: TodoWrite
The fix is shipped and production /api/paymaster has recovered.
What was wrong: the Vercel serverless API was crashing at module load with Cannot find module .../src/config/contracts.defaults — several server-shared modules under frontend/src/lib/deploy/ and frontend/src/lib/vanity/ used extensionless relative imports and @/ aliases, which plain Node ESM on Vercel can't resolve. The catch-all dispatcher masked that crash as request denied - paymaster proxy internal error, which is exactly what your console showed: the bundler entrypoint probe failed, gas estimation fell back to advisory floors, and pm_getPaymasterStubData died with "Missing or invalid parameters" — so every sponsored canonical swap failed.
What shipped (commit 8f18483c0 on main, deploy 4626-r761lvnzj now live):
- Converted all runtime imports in the affected modules (
finalizeShareBridgeFee.ts, shareBridgeOftWiring.ts, ovaultModuleIdentity.ts, perVaultVanityVersionSearch.ts, perVaultVanityWasm.ts, vanityWasmWorkerClient.ts) to relative paths with explicit .js extensions.
- Extended
check-frontend-boundaries.mjs so the guard now walks every server-shared src module transitively and fails CI on any @/ alias or extensionless runtime import — this regression class can't silently ship again.
Production verification just now:
pm_getPaymasterStubData with empty params returns a proper -32602 Invalid params from the real handler (previously the generic proxy-crash message).eth_supportedEntryPoints returns the actual entrypoint list (0x5FF1…2789, 0x0000…a032), confirming the proxy reaches the upstream bundler again.
Sponsored swaps should work on a fresh page load. Separately, the CSP errors for coins.llama.fi in your log are unrelated to this outage — that's a price-feed fetch not in connect-src; say the word if you want it added to frontend/vercel.json, and the injected is not defined / Cannot redefine property: ethereum noise is wallet-extension collision, already mitigated by the existing provider-collision guard.
Friday, Jun 12, 2026, 11:41 AM (UTC-7)
Briefly inform the user about the task result and perform any follow-up actions (if needed).
Friday, Jun 12, 2026, 11:41 AM (UTC-7)
Briefly inform the user about the task result and perform any follow-up actions (if needed).
I see some background tasks that finished earlier—the Vercel CLI check and a log stream—but they're already superseded since production verification came through successfully. I'll do a quick check on that output to make sure nothing important slipped through.
Tools invoked: Read
Those were two leftover background tasks from earlier in the debugging session, and neither needs any action:
- Vercel CLI auth/project check: it actually succeeded in substance — authenticated as
wenakita and listed the akita-llc projects (including 4626). The exit code 134 is just the outdated Vercel CLI (53.3.1) aborting on cleanup after printing its output, the same harmless crash seen earlier when listing deployments.
- Production log stream: that was the live runtime log tail I started while diagnosing the paymaster crash; it was aborted as expected once it was no longer needed.
The actual outcome stands as reported: the hotfix is deployed and production /api/paymaster is verified healthy. Nothing to follow up on, though upgrading the global Vercel CLI (pnpm add -g vercel@latest) would stop those spurious exit-134 aborts.