Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Markets·

Mar 04, 2024

Bitcoin rally significantly benefits online-only Kbank in Korea

Following the recent bitcoin boom, transactions in cryptocurrencies among Korean investors have surged, significantly benefiting local banks that have made contracts with Korean crypto exchanges to offer real-name accounts for crypto investors. As the price of bitcoin soared to as high as KRW 90 million ($67.6 million) in Korea on Thursday, online-only bank Kbank saw an uptick in trading fee revenue, according to local media outlet The Seoul Economic Daily. Kbank is a partner with crypto exchange Upbit, which accounts for 70% of the Korean crypto market.  Under the current law, Korean crypto exchanges offering trading against Korean won must secure real-name accounts from a bank. These banks typically earn fees of KRW 300 to KRW 1,000 per transaction. Currently, other than Kbank, NongHyup Bank offers real-name accounts to Bithumb, Kakaobank to Coinone, Shinhan Bank to Korbit and Jeonbuk Bank to Gopax.Photo by Kanchanara on UnsplashCrypto trading volume up 68.2% in a monthAccording to Xangle, a crypto data intelligence platform, the total crypto trading volume in Korea rose by 68.2% between the last week of January and the last week of February, rising from KRW 2.39 trillion to KRW 40.2 trillion. During the same period, the daily average trading volume also grew from around KRW 4 trillion to KRW 5.7 trillion.   In particular, the bitcoin trading volume on Upbit surged to 19,254 BTC on Feb. 28, reaching the second-highest level since Nov. 10, 2022, when the asset’s trading volume stood at 20,710 BTC. After signing the real-name account contract with Upbit in 2020, Kbank raked in KRW 29.2 billion in fees during the last bull market of 2021, which was equivalent to 14% of its annual interest income of KRW 198 billion and exceeded its net income for the year, which stood at KRW 22.5 billion. Increased bank deposits from exchange usersKbank also saw a substantial rise in its balance sheet, with Upbit users depositing around KRW 2.94 trillion into their real-name accounts. The sum is six times greater than the deposits made into NongHyup Bank by Bithumb users, which stood at KRW 547.1 billion.  Experts see that the surge in Kbank’s user base, which recently surpassed 10 million users, is largely attributed to growing excitement surrounding bitcoin. One crypto insider said that crypto trading fees, which have been on the decline for the past 2 years, could take a turn this year, signaling further gains for the affiliated banks.  

news
Markets·

Nov 05, 2024

Asia emerges at the forefront of crypto development

Asia has taken the lead, surpassing North America, in terms of being a crypto developer hub according to a recent report. Electric Capital, a venture capital firm based in Silicon Valley in the United States, recently compiled a report centered upon global crypto developer data. Its analysis of the data has led to some interesting findings. Photo by Shubham Dhage on UnsplashNorth America loses its leadElectric Capital General Partner Maria Shen took to the X social media platform on Oct. 30 to provide further details on some key takeaways. In the first instance, Shen points out that North America has lost its lead in terms of crypto developer share, with Asia emerging as the leading region in this respect. Shen stated that “for the first time, Asia is the #1 continent for crypto talent.” Underpinning that claim, she provided data that identifies a drop in North America’s share of crypto developers from 44% in 2015 to 24% in 2024. Within the same timeframe, Asia’s share of crypto developer talent has increased from 13% to 32%. Teasing the data out further, the United States still remains the number one country for crypto devs on a country-by-country basis. It leads this particular metric with 18.8% of the developer talent pool, followed by India with 11.8% and the United Kingdom with 4.2%. A consequence of U.S. regulatory uncertaintyRegulatory uncertainty in the United States has been identified as a contributing factor by some crypto community commentators. The Securities and Exchange Commission (SEC) in the U.S. has engaged in regulation by enforcement rather than establishing a bespoke regulatory framework for crypto.  This approach has led to SEC Commissioner Mark Uyeda calling crypto regulation in the U.S. “a disaster” earlier this month. Others, like Nic Carter, a partner at Castle Island Ventures, have gone further, describing the approach of the Biden Administration to crypto as “Operation Choke Point 2.0,” suggesting that there is an active plan being implemented to suppress the industry. This negative approach has led many U.S.-headquartered crypto firms to pursue growth opportunities overseas, particularly within centers in Asia and the Middle East such as Dubai, Abu Dhabi, Hong Kong and Singapore. All of these centers have taken the opposite approach, deliberately working towards putting purpose-made regulatory frameworks in place over the course of the past two years, in order to get crypto innovation started on the right footing. Shen underscored the issue from a U.S. perspective, by pointing out that 81% of crypto devs, who are actively playing their part in shaping the future of digital money, live outside the U.S. She highlighted the significance of this, stating: “This is a national security issue & innovation drain for the US.” In a subsequent post, she questioned whether this had come about due to a negative regulatory environment, adding that “the US needs clear crypto policy to maintain its country lead.” 

news
Policy & Regulation·

Jun 17, 2024

Malaysia launches operation to clamp down on crypto tax evasion

The Inland Revenue Board (IRB) of Malaysia has launched an operation, which has been dubbed as “Ops Token,” to tackle tax evasion within crypto trading circles in the southeast Asian nation. Klang Valley raids According to the Malaysian English language newspaper, The Star, the special operation is a coordinated effort involving the Royal Malaysia Police and CyberSecurity Malaysia (CSM) alongside the IRB. The Malaysian tax authority raided ten locations, with 38 personnel involved in the raids, which were carried out within the Klang Valley region. The main objective of the raids and the operation overall, is to identify crypto corporate entities and individuals that had failed to report trading activities and therefore, associated revenues, profits and taxes. The initiative aligns with the Malaysian government’s broader strategy of stamping out tax evasion across all sectors, reducing revenue leakage and optimizing the nation’s tax take.Photo by Esmonde Yong on UnsplashStern warning for traders Datuk Abu Tariq Jamaluddin, CEO of the IRB, issued a stern warning to crypto traders: declare and pay taxes or face compliance actions. Jamaluddin clarified that crypto traders are subject to the same income tax rules that are applied to businesses across various sectors throughout Malaysia. While cryptocurrency is not regarded as legal tender by Malaysia’s central bank, crypto-centric businesses must adhere to the nation's income tax regulations. The IRB commented on the operation via a statement published on June 15. It stated: "Through this operation, it was possible to find stored cryptocurrency trading data in mobile devices and computers. We have successfully identified the digital assets that are traded, which has caused significant tax revenue leakage." The agency intends to carry out further analysis on the data that it seized in a bid to ascertain the trading revenues generated, the profits derived from that trading activity and the taxes owed as a consequence. The IRB has asserted that a number of corporate entities and partnerships were specifically formed with the purpose of tax evasion. The agency estimates the total value of crypto-related transactions to date in 2024 to amount to 1.441 trillion Malaysian ringgits, approximately $310 billion. International enforcement efforts Malaysia is not alone in its efforts to ensure tax compliance relative to cryptocurrency trading and investing. The Organization for Economic Cooperation and Development (OECD) has established a set of crypto tax rules, namely the Crypto-Asset Reporting Framework (CARF). The initiative is part of an effort to achieve a Common Reporting Standard (CRS) relative to crypto on an international basis, with OECD member states transposing the CARF into domestic law. The CARF is due to go live in 2027. The International Monetary Fund (IMF) maintains that crypto presents itself as a major headache for tax authorities globally. In a research paper published last year, it outlined that countries would need to update their tax systems in order to deal with the challenge that crypto presents with the potential for a leakage in tax revenues. In the United States, an Internal Revenue Service (IRS) official stated in December 2023 that the agency has seen an increase in its caseload relative to crypto tax cases.

news
Loading