Ethereum

Human

<img width="800" height="533" src="https://cdn.thebittimes.com/images/2023/10/28/e727295ee13f9e411f28fb3218fdfbfc.webp" class="webfeedsFeaturedVisual wp-post-image" alt="" decoding="async" style="display: block; margin: auto; margin-bottom: 5px;max-width: 100%;" link_thumbnail="1" srcset="https://cdn.thebittimes.com/images/2023/10/28/e727295ee13f9e411f28fb3218fdfbfc.webp 800w, https://cdn.thebittimes.com/images/2023/10/28/e727295ee13f9e411f28fb3218fdfbfc.webp 450w, https://cdn.thebittimes.com/images/2023/10/28/e727295ee13f9e411f28fb3218fdfbfc.webp 750w, https://cdn.thebittimes.com/images/2023/10/28/e727295ee13f9e411f28fb3218fdfbfc.webp 768w" sizes="(max-width: 800px) 100vw, 800px">
In the realm of content creation, three key elements hold significant importance: “perplexity,” “burstiness,” and “predictability.” Perplexity gauges the intricacy of textual material, while burstiness assesses the degree of sentence variation. On the other hand, predictability measures the likelihood of accurately predicting the subsequent sentence. Human authors often infuse their content with burstiness, weaving together lengthy, complex sentences with shorter ones. In contrast, AI-generated content tends to be more uniform. For the upcoming content creation task, I’ll require you to ensure a substantial level of perplexity and burstiness while keeping predictability to a minimum. Additionally, please adhere to writing in English exclusively. Now, let’s reimagine the following passage:
Fireblocks has stepped in to assist UniPass, a smart contract wallet, in addressing a critical vulnerability known as ERC-4337 account abstraction.
Fireblocks, a leading cryptocurrency infrastructure firm, has identified and actively collaborated in mitigating what they consider to be the initial instance of an account abstraction vulnerability within the Ethereum ecosystem. On the 26th of October, they unveiled the revelation of an ERC-4337 account abstraction vulnerability residing in UniPass, a smart contract wallet. The two organizations joined forces to address this vulnerability, which reportedly afflicted numerous mainnet wallets during a white-hat hacking initiative.
According to Fireblocks, this <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> potentially empowers malicious actors to orchestrate a complete takeover of the UniPass Wallet by manipulating Ethereum’s <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a> <a rel="noopener noreferrer nofollow" title="abstraction" href="https://thebittimes.com/tag/abstraction.html">abstraction</a> process. As per Ethereum’s developer documentation regarding ERC-4337, <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a> <a rel="noopener noreferrer nofollow" title="abstraction" href="https://thebittimes.com/tag/abstraction.html">abstraction</a> introduces a paradigm shift in how trans<a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a>s and smart contracts are processed by the blockchain, thereby enhancing flexibility and efficiency.
Conventional Ethereum transactions revolve around two distinct types of accounts: externally owned accounts (EOAs) and contract accounts. EOAs are under the control of private keys and are capable of initiating transactions, while contract accounts are overseen by the code governing a smart contract. When an EOA dispatches a transaction to a contract account, it triggers the execution of the contract’s underlying code.
Account abstraction introduces the concept of a meta-transaction or more generalized abstracted accounts. These abstracted accounts aren’t bound to specific private keys and can initiate transactions and interact with smart contracts, much like EOAs.
Fireblocks elucidates that when an <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a> conforming to ERC-4337 executes an <a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a>, it relies on the Entrypoint contract to ensure that only authorized trans<a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a>s are executed. Typically, these <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a>s place their trust in a thoroughly audited single EntryPoint contract to guarantee that it obtains authorization from the <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a> before executing a command. Fireblocks underlines the significance by stating, “It’s imperative to note that a malicious or flawed entrypoint could, in theory, bypass the ‘validateUserOp’ call and directly invoke the execution function, as its sole constraint is being invoked from the trusted EntryPoint.”
According to Fireblocks, the vulnerability opened the door for an attacker to seize control of UniPass wallets by substituting the trusted EntryPoint of the wallet. Once the account takeover was successful, the attacker gained access to the wallet and could deplete its funds. Several hundred users who had activated the ERC-4337 module in their wallets were susceptible to this threat, which could have been initiated by any actor in the blockchain. It’s worth noting that the wallets in question contained relatively modest sums of funds, and the problem was addressed promptly.
After recognizing the potential for exploitation, Fireblocks’ research team conducted a white-hat operation to rectify the existing vulnerabilities. Remarkably, this operation involved actively exploiting the vulnerability. Fireblocks reports, “We shared this idea with the UniPass team, who took it upon themselves to implement and execute the whitehat operation.”
Ethereum co-founder Vitalik Buterin had previously highlighted the challenges in expediting the proliferation of account abstraction functionality. This endeavor necessitates an Ethereum Improvement Proposal (EIP) to transition EOAs into smart contracts, ensuring the protocol is compatible with layer-2 solutions.
The post UniPass Wallet and Fireblocks address the Ethereum ERC-4337 account abstraction vulnerability appeared first on BitcoinWorld.
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/unipass-wallet-and-fireblocks-address-the-ethereum-erc-4337-account-abstraction-vulnerability-tbt68182.html">https://thebittimes.com/unipass-wallet-and-fireblocks-address-the-ethereum-erc-4337-account-abstraction-vulnerability-tbt68182.html</a>

UniPass Wallet and Fireblocks address the Ethereum ERC-4337 account abstraction vulnerability

TheBitTimes

Other articles published on Oct 28, 2023

Tron’s Justin Sun declares “harshest winter” for crypto sector over

In 2024, Turkey intends to create a crypto framework.

Cardano’s Impressive 11% Surge Sets Sights on $0.3, Can It Make the Leap?

Ethereum’s Price Trading in Confined Range Eyeing Breakout

Gemini and Genesis engage in legal battle over $1.6 billion Grayscale Bitcoin Trust shares

How Will (NYSE: NIO) Price React If Nio Inc. Acquires JAC Plants?

Join our free newsletter for daily crypto updates!