You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
"Bug 1 (architectural): a session can spend tokens beyond its tokenDailyLimit by calling a contract in allowedContracts that internally pulls already-approved tokens via transferFrom. The wallet's calldata-aware gating only fires for direct ERC-20 selectors, so contract-mediated pulls bypass the cap. Mitigate at the SDK / FE layer — refuse to deploy a session policy whose allowedContracts overlap with router-style approvals."