# Understanding EIP-5189: Addressing the DoS Attack Vector in ERC-4337

## Introduction

ERC-4337 introduces a new mechanism for handling transactions in Ethereum by allowing bundlers to pay the fees for the transaction owners. However, this approach brings two primary concerns:

1. **Potential for Denial of Service (DoS) Attacks**: Since bundlers pay the transaction fees, they must ensure they will be reimbursed at the end of the execution. To mitigate risks, bundlers perform off-chain simulations of UserOperations (the transaction structure in EIP-4337) in their local environments.
2. **Indeterminate Variables in Simulations**: Variables such as `BlockTimestamp` and `BlockNumber` cannot be accurately determined during simulation. To address this, EIP-4337 restricts UserOperations from depending on global variables, which can be restrictive.

Despite these measures, the DoS problem remains unresolved.

## Workflow of ERC-4337

In the ERC-4337 workflow, bundlers take transactions from a private mempool, run simulations using the EntryPoint contract for each transaction, and only send the transaction to Ethereum if it passes the simulation. This process is resource-intensive and not foolproof.

## EIP-5189: Introducing the "Endorser" Smart Contract

EIP-5189 proposes a new type of smart contract called the "Endorser" to address the shortcomings of ERC-4337:

- **Focus on Mempool Filtering**: Instead of focusing on transaction execution, Endorsers filter UserOperations in the mempool, distinguishing between good and bad transactions.
- **Dependency Analysis**: Endorsers help bundlers by identifying UserOperations with dependencies on global variables like `maxBlockNumber` and `maxBlockTimestamp`. They also highlight other dependencies by providing addresses and storage slots to be monitored, allowing bundlers to anticipate state changes affecting transaction execution.

## Benefits and Limitations of EIP-5189

### Benefits

1. **Improved Filtering**: Endorsers provide information to help maintain a pool of “good” Account Abstraction (AA) transactions.
2. **Enhanced Transparency**: By indicating dependencies, Endorsers give bundlers better insight into potential execution issues.
3. **Crypto-Economic Security**: Bundlers can require Endorsers to burn ETH as a form of security, although this does not fully eliminate the need for simulation.

### Limitations

1. **Soft Guarantees**: The information from Endorsers provides only a soft guarantee that transactions will execute correctly. Bundlers must still simulate the results.
2. **Untrusted Operations**: There remains a possibility that Endorsers cannot fully validate UserOperations, leaving some transactions in a gray area.

## Critique of EIP-5189

While EIP-5189 offers significant improvements, it is not a complete solution to the problems introduced by ERC-4337. Some key points of critique include:

- **Simulation Requirement**: Bundlers still need to simulate transactions, which does not fully resolve the DoS issue.
- **Alternative AA Standard**: Despite being presented as an alternative AA standard to ERC-4337, EIP-5189 seems more like an extension to existing smart wallets rather than a standalone solution.

## Conclusion

EIP-5189 is a promising step towards mitigating the issues brought by ERC-4337. It enhances bundler decentralization by putting some simulation settings on-chain and improves the reliability of UserOperations. However, the requirement for simulations and the existence of gray areas mean that challenges remain.