Ethereum Paymaster: Who Pays Gas?
The paymaster contract pays the gas, and if you think that means free transactions, you are already underwater. In the ERC-4337 stack, a paymaster is a smart contract that agrees to cover gas fees on behalf of a user operation, but somebody funds that contract, and that somebody is almost never the user. The real question is not who signs the transaction but who settles the bill when the bundler comes knocking. 🎯
The Three-Layer Billing Stack
Strip away the marketing and every paymaster model collapses into three funding layers: the paymaster's own ETH deposit inside the EntryPoint, the stake it locks to guarantee behavior, and the off-chain balance it tracks against each user. The EntryPoint contract does not care about your business logic. It deducts gas from the paymaster's deposit the moment validation passes, and if that deposit runs dry, the user operation reverts before your application code ever executes. This is where Ethereum Paymaster designs live or die — a paymaster with a thin deposit is a paymaster that fails at peak congestion.
Sponsorship Models and Their Hidden Cost
Sponsored transactions, token paymasters, and subscription paymasters each shift the cost burden differently. A token paymaster charges users in ERC-20 and swaps to ETH to refill its deposit, which means the user pays gas indirectly through slippage and swap fees. A sponsored model pushes cost to the dApp treasury, and that treasury is exposed to gas volatility with zero hedging unless the operator prefunds aggressively. The operator who ignores the postOp gas overhead — the second call after execution — gets eaten alive by unbilled gas on every single operation. ⚠️
Who Actually Foots the Bill
Follow the ETH. The paymaster's deposit is funded by an operator wallet, a treasury multisig, or a relayer service. In token-paymaster flows, the user funds it indirectly. In subscription models, a prepaid balance covers it until the balance depletes. The gas sponsorship illusion breaks the moment the paymaster's deposit hits zero and the bundler rejects the entire bundle. No deposit, no transaction, no exceptions.
Deposit Exhaustion and Reputation Risk
Bundlers track paymaster reputation and throttle or ban paymasters that revert too often during validation. A paymaster that runs out of deposit mid-bundle does not just fail one user — it poisons its own reputation score and gets deprioritized across the entire mempool. The operators who survive are the ones who monitor deposit levels against a rolling gas price feed and top up before the threshold, not after the first failed bundle. 🛠️
Stake Requirements and Slashing Exposure
A paymaster handling storage access must post a stake to the EntryPoint, and that stake is slashable if the paymaster violates the storage rules during validation. The stake is not gas — it is collateral — but it sits locked and illiquid while the operator funds it. Every account abstraction deployment that leans on paymasters must budget for both the gas deposit and the stake, and those are two separate capital pools that cannot be swapped on demand.
Prefunding Math and the Volatility Trap
Prefund too little and bundles revert at the worst moment. Prefund too much and capital sits idle in a contract that earns nothing. The aggressive operators run a buffer of three to five times median gas cost per operation and rebalance on a fixed cadence, accepting idle capital as the price of uptime. The ones who skip the buffer discover that a single congested block can drain a week of deposit in minutes.