If you can still use a Session Key after its expiration, it's likely because the permission check only looks at the "validity period" field and ignores on-chain state changes. Expiration just means the time window you set is over, but your smart wallet ultimately checks if that Session Key is still in the authorized list on-chain.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
Step 1: Understand the "Expiration" Mechanism of the Session Key
First, figure out which validation logic your wallet uses—this directly decides whether "expired" really means invalid.
Case A: Local time validation only (common in early implementations) The wallet checks the
validUntilfield when signing. If the current time is past that value, the front end throws an error. But here's the vulnerability: if the verifier only trusts the signed content and doesn't check on-chain state, an expired Session Key signature can still be accepted by the Bundler because the on-chain contract hasn't actively removed your authorization. Completion standard: Check whether the transaction gets bundled. If an expired signature still makes it on chain, the validation mechanism has a gap.Case B: On-chain state validation (ERC-4337 compliant) Following standard practice, the account's Validation Module dynamically checks the Session Key's permissions. Validity depends not only on the timestamp but also on whether the key has been removed or overwritten. If the wallet hasn't called
removeSessionKey(), the chain still treats the permission as active. Completion standard: Go to your wallet dashboard, open the Session Key management list, and see if that key still shows as "Authorized" or "Active".
High risk: If you think "expired means invalid" and relax monitoring, a malicious actor could use the permission you haven't properly removed in the window where you think it's dead. The right approach: Never rely on expiration alone as your safety net; always actively revoke. Unless you explicitly call the removal function, the permission remains valid on-chain forever until you revoke it. Third-party docs clearly state "once signed, the delegation is persistent and must be explicitly revoked."
Step 2: Check if a "Static Delegation" is Overriding the Expiration
Session Key authorization models fall into two types: static and dynamic.
Case A: Static Delegation In this model, you give a key ongoing permission to operate your account. This authorization never auto-expires; you must manually click "Revoke" or "Remove" in the wallet's management interface. What to do: Go to "Security Settings" or "Authorization Management" in your wallet and check the Session Key list. If that key is still listed, it remains active even if the time you set has passed. Completion standard: The key no longer appears in the list; only then is it truly dead.
Case B: Dynamic Delegation This model includes constraints like
validUntil, enforced by the account's validation logic (e.g., a plugin). What to do: Check the contract method called by the expired transaction and see if it passes thevalidateUserOpcheck. If the validation logic isn't strict (for example, ignoring the timestamp), the transaction will go through. Completion standard: If the transaction succeeds, the time check in the dynamic delegation was skipped or exploited. Currently, time-based checks are not a native mandatory ERC-4337 standard; it depends on each wallet plugin's implementation.
Common Failure Reasons
Confusing "local expiration" with "on-chain expiration": Many wallets only hide the operation buttons in the front-end UI, but the private key or authorization data still exists on-chain. Your browser refusing to call doesn't mean the on-chain contract will reject execution.
Not calling the revoke function in time: In SDKs like thirdweb, adding a Session Key includes a
permissionEndTimestamp, but that parameter is only a runtime restriction. Without executing aremoveSessionKeytransaction, the old key remains a legitimate signer at the contract level.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
After Completing the Operation
How to verify: Immediately search your wallet address on a block explorer. Look in the "Internal Transactions" or "Events" logs for
SessionKeyAddedorSessionKeyRemovedevents. If you never triggered a removal, that key is still valid.Next step: Go to your wallet's authorization management, manually click to remove the expired Session Key, and pay a gas fee to update the on-chain state. Only then is the permission completely gone. Afterwards, try initiating a transaction to confirm the system says "Unauthorized" or "Invalid signature".
