This report describes the specification and verification of the Coinbase smart-account using the Certora Prover and manual code review findings. The work was undertaken from 8 Feb 2023 to 29 February 2024.

The following contract list is included in our scope:

src/ERC1271.sol

src/ERC4337Account.sol

src/ERC4337Factory.sol

src/MultiOwnable.sol

src/WebAuthn.sol

The Certora Prover demonstrated the implementation of the Solidity contracts above is correct with respect to the formal rules written by the Certora team. In addition, the team performed a manual audit of all the Solidity contracts. During the verification process and the manual audit, the Certora Prover discovered bugs in the Solidity contracts code, as listed below.