Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Web3 & Enterprise·

Jan 05, 2026

South Korean card issuers line up stablecoin plans as regulation nears

South Korean credit card companies are preparing to develop a stablecoin-powered payment system, Yonhap Infomax reported. The Credit Finance Association (CREFIA)—a nonprofit comprising credit card firms, leasing companies, and venture capitalists—plans to launch a second task force this month. The group aims to prepare for the anticipated regulatory framework governing stablecoins.Photo by rupixen on UnsplashStablecoin cards, settlement under reviewThe task force will discuss building a comprehensive system covering the entire transaction process, from stablecoin-based card payments to merchant settlements. The agenda also includes testing stablecoin-powered debit cards, which would allow users to pay at standard card terminals just as they would with traditional cards. This second task force will include nine credit card companies—including Samsung Card, Shinhan Card, and KB Kookmin Card—that participated in the initial task force formed last July. At that time, CREFIA and the participating firms held weekly meetings on regulatory and technological issues while gathering input from external advisors. Through that process, the group examined whether credit card companies could legally engage in stablecoin businesses under the current Specialized Credit Finance Business Act. They also jointly filed 30 stablecoin-related trademark applications and reportedly sought consultations with financial authorities on securing payment and settlement accounts for stablecoin transactions. This push into the sector comes despite lingering uncertainty regarding the government’s phase-2 virtual asset legislation. Progress on the draft has been delayed due to disagreements between financial and monetary authorities. The Bank of Korea favors a model where only consortia with majority bank ownership can issue stablecoins. By contrast, the Financial Services Commission opposes setting a specific bank-ownership threshold in law to allow participation by non-bank firms. The forthcoming legislation is expected to comprehensively regulate stablecoins, including their issuance, distribution, and custody, leaving companies to await clearer guidance. Despite the legislative delays, the credit card companies are positioning themselves to move quickly once the rules are finalized. Investor sentiment shifts to U.S. equitiesWhile traditional financial firms explore digital assets to expand their business, South Korean investors are prioritizing U.S. equities over cryptocurrencies for this year. According to a weekly survey of 2,000 respondents conducted by CoinNess and Cratos, 30.8% said they plan to focus on U.S. stocks. Cryptocurrencies ranked second at 25.5%, followed by gold and silver (18.3%), Korean stocks (12.8%), and cash (12.7%). Market sentiment toward Bitcoin also appears cautious. 22.7% of respondents said they expect Bitcoin to rise or surge this week, down from 28.9% the previous week. Meanwhile, 38.3% predicted the price would move sideways, while 39% expected a fall or plunge. Asked about the broader crypto market, 50.8% of respondents said fear or extreme fear was prevailing. 

news
Web3 & Enterprise·

Aug 28, 2023

BC Card Accelerates Launch of NFT Guarantees for Secondhand Luxury Goods Trades

BC Card Accelerates Launch of NFT Guarantees for Secondhand Luxury Goods TradesSouth Korean credit card issuer BC Card announced on Sunday that it has applied for two domestic patents for blockchain technology that will be used to issue digital guarantees for purchases of luxury goods, such as bags, watches, and more. These guarantees will be minted as non-fungible tokens (NFTs) that can later be accessed by buyers or sellers during secondhand trades, which often pose risks and uncertainty regarding product quality or authenticity.Enhancing trust and securityThese NFTs will be based on paper or digital payment receipts — which contain detailed information on purchase receipts, such as product names, payment amounts, purchase dates, and shop information — that a customer receives after purchasing goods at stores that accept BC cards.Photo by Towfiqu barbhuiya on UnsplashBecause the guarantees are stored on a blockchain, they are almost impossible to tamper with. BC Card anticipates that this service will offer advantages like boosted safety, convenience, and security for both buyers and sellers who wish to partake in transactions of secondhand luxury goods.In addition, the data distributed across servers eliminates concerns about data loss. To achieve this, BC Card plans to collaborate with telecommunications provider KT and BC’s subsidiary, VP, which specializes in electronic payment services.“Through this patent application, we expect to significantly enhance the trustworthiness of secondhand luxury goods transactions in Korea,” said Kwon Sun-moo, Director of the New Financial Research division at BC Card. “After the patents are registered, we plan to collaborate with companies under KT Group like KT Alpha as well as other distribution companies in a business-to-business-to-consumer (B2B2C) system.”Access through a digital walletCustomers can take a photo of a receipt with their phones or download it, then upload it to BC Card’s financial platform, Paybook. The photo is then converted into an image that is automatically stored as an NFT on the blockchain network.Once a seller registers a payment receipt for a product that they bought, then the subsequent NFT guarantee can be accessed or sent through their BC Card digital wallet — a feature that the company plans to launch soon — at any time during future transactions. This offers a convenient solution to the possibility of losing receipts, which traditionally requires manually downloading them again from the card company’s website or app.Revolutionizing secondhand tradeThis new technology could play a significant role in the booming resell and secondhand goods trading market, the company said. According to data from the Korea Internet & Security Agency last year, the domestic secondhand market has grown from a scale of KRW 4 trillion in 2008 to KRW 24 trillion in 2021 and is projected to exceed KRW 30 trillion this year.“Through the registration of payment receipts, we can analyze consumption patterns and even suggest improvements in spending habits to our customers,” Director Kwon highlighted.BC Card is also considering offering luxury appraisal and authentication services along with the future launch of the NFT service.

news
Web3 & Enterprise·

Jul 10, 2023

DeSpread and Crypto Times Team Up to Bridge Blockchain Information Gap in Korea and Japan

DeSpread and Crypto Times Team Up to Bridge Blockchain Information Gap in Korea and JapanDeSpread, a Web3 consulting company based in South Korea, has announced a partnership with Crypto Times, a blockchain media outlet owned by Japanese digital media company Rokubunnoni. The goal of this collaboration is to tackle information asymmetry in the blockchain industries of both countries and expand their global blockchain services.Photo by Ketut Subiyanto on PexelsLeveraging respective expertiseDeSpread intends to leverage its knowledge of the Korean and global markets to assist international Web3 projects in entering the Japanese market, with the ultimate aim of integrating the global Web3 industry into Japan. Recognizing Crypto Times’ thorough understanding of the Japanese market and its culture, DeSpread has chosen to collaborate with them.Sharing market analysesAs part of their partnership, both companies will localize their research reports on a regular basis to share market analyses of the two countries. To start off, Crypto Times will distribute a paper related to the latest trends of zkSync for free. Subsequent papers will be published on DeSpread’s Scribe channel on the digital content monetization platform Access Protocol.The collaboration also aims to provide a comprehensive consulting and marketing solution for Web3 projects seeking to expand into Korea, Japan, and other markets.Creating synergiesRokubunnoni Co-founder Shingo Arai expressed his belief that the cooperation between DeSpread and Crypto Times will create synergies within the Korean and Japanese blockchain industries. Arai expects that the combined expertise of the two firms will offer valuable insights into the Web3 market, delivering new perspectives. He also highlighted that Crypto Times’ research platform, CT Analysis, will improve its services and provide a greater variety of content to its readers, further contributing to the Japanese crypto market.Echoing similar sentiments, Earl Cho, the head of the Japanese business division at DeSpread, emphasized that the collaboration will facilitate the entry of more Web3 companies from Korea and abroad into the Japanese market. Cho expressed hope that this opportunity would unite the efforts of both countries, enabling the East Asian market to better connect with the global market in the Web3 sphere and positioning East Asia as a leader in the crypto industry.

news
Loading