Ethereum Paymaster Gas: How Is Gas Sponsored?
Gas sponsorship on Ethereum does not happen through charity — it happens because a paymaster contract agrees to absorb the gas cost for a user's transaction, and that agreement is enforced by the EntryPoint contract's validation logic before a single opcode executes. 🧠 If you think gasless transactions are some kind of magic trick, you have never audited a UserOperation's paymasterAndData field. The entire sponsorship flow hinges on that byte blob, and once you understand how the EntryPoint parses it, the illusion collapses into pure mechanism.
The EntryPoint Handshake Nobody Talks About
When a UserOperation arrives at the EntryPoint, the bundler calls validatePaymasterUserOp on the designated paymaster. That function must decide, in a single transaction context, whether to stake collateral and lock the sponsorship. The paymaster returns a context blob, and the EntryPoint deducts the maximum possible gas cost from the paymaster's deposit inside the EntryPoint itself — not from any wallet. This is the core of Ethereum Paymaster Gas accounting: the deposit is pre-charged, then any surplus is refunded to the paymaster's balance after execution. No wallet ever touches ETH for that op. The paymaster's balance sheet does all the bleeding.
What separates a real sponsor from a broken integration is the postOp call. After the user's callData executes, the EntryPoint invokes postOp on every paymaster that was validated, and that is where actual final gas consumption gets reconciled. If postOp reverts, the entire UserOperation reverts — the sponsorship is atomic. I have seen paymasters try to skip the postOp gas accounting and end up with deposits drained by griefing attacks within hours. Do not be that team.
Verifying Allowlists Without Trusting the User
The paymaster cannot trust user-supplied calldata. Validation must read the sender address, the call target, and the callData selector, then compare against a signed allowlist or an onchain policy. Most production sponsors use a signature scheme: the backend signs a sponsorship quote over the sender, nonce range, gas limits, and expiry, and the paymaster verifies that signature inside validatePaymasterUserOp. 🔒 The nonce range is the part lazy teams skip — and that is exactly where replay griefing lives. A sponsorship quote without a nonce window is a blank check. The signature must bind the exact UserOperation hash, not a loose hash of the call, or a bundler can mutate gas fields and inflate the sponsor's exposure.
Here is the brutal truth about gas sponsorship in production: the sponsor pays for failed ops as well. If validation passes and the call reverts, the paymaster still eats the gas up to the verification gas limit plus call gas limit. Budget for that. Sponsors that assume only successful ops get billed have their deposits vaporized by attackers who intentionally trigger reverts. The EntryPoint does not care about your intent — it cares about the limits you set and the deposit you funded.
Deposit, Stake, and the Collateral Trap
A paymaster that sponsors more than a trivial volume must stake with the EntryPoint, and that stake is subject to a thawing period. Staked paymasters get access to the storage of other entities during validation, but the price is locked collateral and a slow exit. ⚠️ The trap: stake is not deposit. Stake secures behavior; deposit pays gas. Teams that confuse the two end up with a staked contract that cannot pay for a single UserOperation because the deposit hit zero. Track both balances separately in your monitoring, or your sponsorship will silently stall mid-campaign.
The gas overhead of paymaster validation is itself non-trivial — roughly 30k to 60k gas depending on storage reads and signature verification. That overhead must be included in the verification gas limit the user signs over, otherwise the op fails at the EntryPoint with a validation OOG before your allowlist logic even runs. The paymaster pays for its own complexity. Every storage slot you touch during validation is a direct tax on the sponsor's deposit, and cold SLOADs at 2100 gas each add up fast across thousands of ops.
Sponsorship is not a user experience feature bolted onto a wallet. It is a collateralized, atomic, replay-sensitive financial primitive where the paymaster absorbs gas risk on every single op — and the EntryPoint enforces that absorption with zero sympathy for sloppy validation logic.