Docs · 02 / 07 · How it works

Work replaces the funding transaction.

The flow#

1. Epoch. The SDK polls the relay's pow_getEpoch every 60 s in the background. An epoch (15 minutes on testnet) fixes the difficulty, fee caps, gas caps and a random seed revealed only when the epoch starts.
2. Build. The op's gas limits come from fixed per-template profiles, its fees from the epoch, its pre-verification gas from the relay's 30-second quote. The EntryPoint nonce key is always 0. A first op carries an EIP-7702 authorization for Simple7702Account v0.9.
3. Hash. userOpHash is the EntryPoint v0.9 EIP-712 hash, which covers the 7702 delegation.
4. Mine and sign, in parallel. The PoW lives in the unsigned paymasterSignature suffix, so the account signs the op while the miner searches for 8 nonces.
5. Relay. The relay recomputes the hash, verifies the proof and every on-chain rule, reserves the op's maximum cost against the deposit, co-signs userOpHash and forwards the op to its own bundler (or holds it for the delay you asked for).
6. Bundle. The bundler sends a type-4 transaction that applies the delegation and calls handleOps. The fresh address holds 0 ETH before and after.
7. Validate and account. validatePaymasterUserOp checks the proof, the co-signature and the policy against the epoch's write-once parameters. postOp records the cost and emits OpSponsored.

paymasterAndData#

196 bytes in co-signed mode (the MVP default), 131 in permissionless mode. The PoW nonces and the co-signature sit in the EntryPoint v0.9 paymasterSignature suffix, which userOpHash excludes; the signed part only carries the version and the epoch id.

In viem terms: paymasterData = 0x01 ‖ epochId (5 bytes) and paymasterSignature = nonces ‖ cosig (129 bytes). viem appends the length and the magic itself. Before mining, the SDK fills the suffix with 64 zero bytes and a 65-byte stub co-signature, so the hashed length is already final.

The challenge#

challenge = keccak256(abi.encode(
    CHALLENGE_TAG,        // keccak256("PowPaymaster/v1/challenge")
    block.chainid,
    address(entryPoint),
    address(this),        // the paymaster
    epochId,              // uint32
    seed,                 // uint96, revealed when the epoch starts
    userOpHash            // EntryPoint v0.9 EIP-712 hash
))
h_i = keccak256(abi.encode(challenge, uint256(nonce_i)))   // one 64-byte keccak block
accept_i  ⇔  uint256(h_i) ≤ targetPerSolution

• Bound to one op. The chain id, EntryPoint and paymaster are in the challenge, and the EntryPoint nonce inside userOpHash makes each proof usable once.
• No stockpiling. The seed is unknown until the epoch starts, ops expire 5 minutes after the next roll, and the relay refuses an old epoch's ops 2 minutes after a roll.
• 8 independent solutions. The 8 nonces must be strictly increasing and each must hash under the target.

How much work#

gasSum      = verificationGasLimit + callGasLimit + paymasterVerificationGasLimit
              + paymasterPostOpGasLimit + preVerificationGas
work        = max(minWork, gasSum × refFeePerGas × workPerGwei / 1e9)   // expected total hashes
perSolution = ceil(work / 8)
target      = (2^256 − 1) / perSolution

• Priced like the gas the paymaster pays. refFeePerGas is the base fee snapshotted at the roll, so work follows fee levels, and fee headroom in maxFeePerGas costs no extra work.
• Tight limits pay off. Every client of a template uses the same published gas profile, so the work is the same for everyone.
• K = 8. With 8 sub-solutions the 95th-percentile solve time is about 1.64 × the mean (3 × with one solution), and progress can be shown honestly as x/8.
• Bounded. work ≤ 2^48 for every epoch, far inside the 64-bit nonce space.

A typical first op (a claim with its delegation, gasSum ≈ 360,000) at the testnet floor costs about 2^25 hashes: around 3 s on a mid laptop and 9 s on a mid Android phone. At the 7.5× ceiling, about 21 s and 67 s (the p95 is 1.64 × these means).

Validation#

Validation reads only the op's epoch (4 storage slots, written once) and, with the delegate check, the sender's 23-byte delegation designator. It reverts only on malformed data or an unknown epoch. Every other failure is soft: all checks run, at constant gas, and the result is SIG_VALIDATION_FAILED. The same checks are exposed as checkUserOp(), which returns the failure bits:

Ops are limited to single calls from an allowlist of templates, enforced by the relay before it co-signs:

Epochs, difficulty and budget#

• Write-once epochs. A roll() (any EOA, once the epoch is over) creates the next epoch. Nothing validation reads ever changes afterwards, so a simulated op can't be invalidated by paymaster state, and the bundler never has a reason to ban it.
• Step controller. At each roll, utilization u of the epoch's budget sets the next difficulty: ×2 after two saturated epochs, ×1.25 above the 60% target, ×0.5 below half of it, ×1 otherwise, clamped to the configured range (7.5× on testnet).
• Budget = deposit. The EntryPoint deposit is topped up to the epoch budget at most once per epoch, by a direct EOA roll, and an immutable MAX_DAILY_SPEND bounds the daily outflow. The relay paces co-signing across the epoch.