Public-mempool gas sponsorship can't have all three: no locked money, no off-chain trust, public relay

You want a contract to pay gas for someone else's transaction and have the public mempool relay it. The impossibility result: pick at most two of unlocked funds, no trust, and open relay.

The reason is timing. A relayer front-runs by broadcasting the sponsored tx and racing the payment. If the sponsor's funds aren't committed before relay, a griefer drains sponsorship without ever landing the intended call, or the payer can renege after inclusion. Nothing on-chain binds the promise at broadcast time.

So any working paymaster design pays for it somewhere: an escrow that locks funds per request, a slashable bond, or a trusted relayer you fall back on. ERC-4337's escrow model is the first branch made explicit.

ethresear.ch

@soliditypedia