Ethereum

Cryptocurrency

<div class="sg-post-des">
 Fireblocks assists smart contract wallet UniPass to address ERC-4337 account abstraction vulnerability.
</div>
<div class="cointelegraph">
 Cryptocurrency infrastructure firm Fireblocks has identified and assisted in tackling what it describes as the first account abstraction vulnerability within the Ethereum ecosystem.
 An announcement on Oct. 26 unpacked the discovery of an ERC-4337 account abstraction vulnerability in the smart contract wallet UniPass. The two firms worked together to address the vulnerability, which was reportedly found in hundreds of mainnet wallets during a ‘whitehat’ hacking operation.
 According to Fireblocks, the vulnerability would allow a potential attacker to carry out a full account takeover of UniPass wallet by manipulating Ethereum's account abstraction process.
 As per Ethereum’s developer documentation on ERC-4337, account abstraction allows for a shift in the way transactions and smart contracts are processed by the blockchain to provide flexibility and efficiency.
 Related:&nbsp;Account abstr<a rel="noopener noreferrer nofollow" title="action" href="https://thebittimes.com/tag/action.html">action</a> will drive a billion users from Asia to Web3: ConsenSys exec
 Conventional Ethereum transactions involve two types of accounts, externally owned accounts (EOAs) and contract accounts. EOAs are controlled by private keys and can initiate transactions, while contract accounts are controlled by the code of a smart contract. When an EOA sends a transaction to a contract account, it triggers the execution of the contract's code.
 Account abstraction introduces the idea of a meta-transaction or more generalized abstracted accounts. Abstracted accounts are not tied to a specific private key and are able to initiate transactions and interact with smart contracts just like an EOA.
 As Fireblocks explains, when an ERC-4337-compliant account executes an action, it relies on the Entrypoint contract to make sure only signed transactions get executed. These accounts typically trust an audited single EntryPoint contract to ensure that it receives permission from the account before executing a command:
 <blockquote>
 “It’s important to note that a malicious or buggy entrypoint could, in theory, skip the call to “validateUserOp” and just call the execution function directly, as the only restriction it has is that it’s called from the trusted EntryPoint.”
 </blockquote>
 According to Fireblocks, the <a rel="noopener noreferrer nofollow" title="vulnerability" href="https://thebittimes.com/tag/vulnerability.html">vulnerability</a> allowed an attacker to gain control of UniPass <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s by replacing the trusted EntryPoint of the <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>. Once the <a rel="noopener noreferrer nofollow" title="account" href="https://thebittimes.com/tag/account.html">account</a> takeover was complete, an attacker would be able to access the <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a> and drain its funds.
 Several hundred users that had the ERC-4337 module activated in their <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s were vulnerable to the attack which could be performed by any actor on the blockchain.&nbsp;The <a rel="noopener noreferrer nofollow" title="wallet" href="https://thebittimes.com/tag/wallet.html">wallet</a>s in question only held small amounts of funds and the issue has been mitigated at an early stage.
 Having ascertained that the vulnerability could be exploited, Fireblocks’ research team managed to carry out a whitehat operation to patch the existing vulnerabilities. This involved actually exploiting the vulnerability:
 <blockquote>
 “We shared this idea with the UniPass team, who took it upon themselves to implement and run the whitehat operation.”
 </blockquote>
 Ethereum co-founder Vitalik Buterin previously outlined&nbsp;challenges in expediting the proliferation of account abstraction functionality,&nbsp;which includes the need for an Ethereum Improvement Proposal (EIP) to upgrade EOAs into smart contracts and ensuring the protocol works on layer-2 solutions.
 Magazine:&nbsp;Ethereum restaking: Blockchain innovation or dangerous house of cards?
 <template data-name="subscription_form" data-type="defi_newsletter"></template>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/fireblocks-unipass-wallet-tackle-ethereum-erc-4337-account-abstraction-vulnerability-tbt68041.html">https://thebittimes.com/fireblocks-unipass-wallet-tackle-ethereum-erc-4337-account-abstraction-vulnerability-tbt68041.html</a>

Fireblocks, UniPass wallet tackle Ethereum ERC-4337 account abstraction vulnerability

TheBitTimes

Other articles published on Oct 27, 2023

Nerayoff claims no ceiling for XRP’s financial reach

In a final attempt to dismiss the regulator’s lawsuit, Coinbase contests the SEC’s jurisdiction o...

Crypto dot com records highest Bitcoin inflow since FTX collapse

Solana Launches Incubator Program to Boost Startup Growth

DOGE Price Analysis: Will DOGE Leap Through To Hit $0.083?

Australia stopped using cash, who will continue to enforce CBDCs?

Join our free newsletter for daily crypto updates!