Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Web3 & Enterprise·

Sep 11, 2023

UAE’s Royal Office Visits Korea to Further Security Token Collaboration with AIITONE

UAE’s Royal Office Visits Korea to Further Security Token Collaboration with AIITONEAIITONE, a Korea-based augmented reality firm specializing in security tokens, invited journalists to showcase its strategy to foster business collaborations between South Korea and the United Arab Emirates (UAE) on the occasion of the Korean visit of the Private Office of His Highness Sheikh Ahmed Bin Faisal Al Qassimi.Photo by Ethan Brooke on UnsplashPrivate Office’s return visitThe Private Office is a Dubai-based corporate conglomerate that operates businesses in various areas including real estate, energy, and finance. This visit by the Private Office marks a return visit following AIITONE’s visit to the UAE in July.The conference took place at a hotel in Gangnam, Seoul, and was attended by Lee Jin-yeop, CEO of AIITONE; Bruce Jeong, Chairman of Middle East Investment; and H.H. Sheikh Ahmed Bin Faisal Al Qassimi.Security tokens, CBDCs, smart defenseChairman Jeong, leading AIITONE’s global initiatives, said that their primary endeavor is to set up a Korean branch of the Royal Office. This branch will function as an international business hub, facilitating collaborations across three key sectors: security tokens, central bank digital currencies (CBDCs), and smart defense ventures.The event also featured presentations by AIITONE officials who introduced the company’s focus areas.Kang Man-soo, who leads AIITONE’s defense unit, highlighted the company’s technical expertise in maintenance training equipment, interactive electronic technical manuals, and integrated system support. He pointed out that AIITONE has been actively involved in the development of technical manuals and training simulators for various defense assets, including warships, guided weapons, and fighter aircraft. Kang emphasized that AIITONE’s strategic partnerships with Korean defense firms have propelled their engagement in initiatives aimed at exporting these products to countries such as Indonesia, Malaysia, and Poland.Lee Joo-hyung, the head of AIITONE’s extended reality (XR) content division, revealed the company’s plan to create portable products that can replicate the physical sensations of the real world, including sensations like physical contact and heat. Additionally, Lee introduced MOUM, a metaverse platform that features blockchain-powered security functions and generative artificial intelligence (AI) capabilities.Park Sang-il, who is at the helm of the firm’s security token project, showcased AIITONE’s comprehensive security token platform, which enables users to both issue and distribute security tokens. Notably, the platform is compatible with hyperledgers Besu and Fabric.Since arriving in Korea last Wednesday, the Royal Office has met with representatives from Standard Chartered Bank Korea and lawyers from law firm Kim and Chang, as well as lawmaker Yang Hyang-ja. Additionally, the Royal Office made a visit to smart farms located in South Jeolla Province.H.H. Sheikh Al Qassimi expressed a high regard for South Korea, acknowledging its beautiful natural landscapes and significant economic development. He underlined that this visit serves as an opportunity for the Royal Office to strengthen cooperation between UAE companies and their Korean counterparts, further fostering economic exchanges between the two countries.

news
Policy & Regulation·

Nov 11, 2023

Laos targets crypto operators’ unpaid fees

Laos targets crypto operators’ unpaid feesIn a bid to enhance state revenues, Laos has turned its focus to the cryptocurrency sector, revealing that operators in the country owe a total of $20 million in fees. The announcement, reported on Thursday by Chinese state news agency Xinhua News, references information from the Lao People’s Army News.Photo by Alessio Roversi on UnsplashLoss-making mining activityLaos had previously granted authorization to 15 blockchain companies to engage in crypto mining or operate as exchanges as part of a strategy to diversify government income sources. However, Prime Minister Sonexay Siphandone disclosed that two of these companies showed no progress in their operations, while others lagged behind in meeting their financial obligations to the state.It emerged in August that the national electricity supplier, Electricité du Laos, had decided to suspend the supply of energy to crypto miners amid a perfect storm of challenges. Laos has ample hydro electric resources and is a net exporter of electricity. However, a drought this year has challenged it to honor contracts for supply of electricity to the Electricity Generating Authority of Thailand.To deal with this issue, power supply to Laotian crypto miners was suspended. To compound matters, many mining operators have been struggling financially and were unable to pay their bills.Debt reliefSiphandone mentioned that since the government initially set the tax obligations, the overall value of cryptocurrencies has experienced a 50% decline. Consequently, Laos has decided to alleviate the burden on crypto companies by reducing the outstanding balance by an equivalent 50%.Following this decision, the affected companies have commenced the settlement of their fees, and it is anticipated that all outstanding amounts will be fully resolved by the year’s end, according to the country’s Prime Minister. However, he issued a cautionary note, stating that companies failing to make satisfactory progress would face consequences, including the suspension of their operations, imposition of fines or even the revocation of their licenses.Digital transformationIn May, Laos outlined key aspects of its digital transformation strategy, emphasizing the use of digital technology to generate new fiscal revenue, strengthen foreign exchange reserves, control inflation, and promote sustainable economic growth. The move to reduce crypto companies’ tax burdens amid market volatility underscores Laos’ adaptability to the challenges presented by the dynamic cryptocurrency landscape.As part of its digital transformation strategy, the Laotian government signed a cooperation agreement with Singapore’s MetaBank. Partnering with another overseas entity, the country has also relied upon the expertise of Japanese fintech developer Soramitsu with regard to a central bank digital currency (CBDC). Soramitsu has played a pivotal role in enabling the issuance of Laos’ Digital Lao Kip.Early last year, the landlocked Southeast Asian country authorized trading licenses for two crypto platforms. These included Lao Digital Assets Exchange (LDX), a joint venture between Phongsupthavy Group and AIF Group, and Bitqik, a subsidiary company of Simuong Group.

news
Policy & Regulation·

Jul 26, 2023

Fair Weather Day for Rain With Abu Dhabi License Approval

Fair Weather Day for Rain With Abu Dhabi License ApprovalRain, the cryptocurrency exchange that serves the Middle East and North Africa (MENA), Turkey, and Pakistan, has scored a significant regulatory win in the United Arab Emirates (UAE). On Tuesday, the Abu Dhabi unit of Rain secured a license to operate as a virtual assets brokerage and custody service within the country.Photo by Agnieszka Kowalczyk on UnsplashCoinbase backingHeadquartered in Bahrain and backed by Coinbase, Rain’s Abu Dhabi Global Market financial free zone entity will now have the authority to offer virtual asset services to institutional and select retail clients in the UAE. This includes the ability to facilitate the buying, selling, and custody of cryptocurrencies.According to Co-Founder Yehia Badawy, the newly acquired license brings additional advantages to Rain. Notably, the exchange will be able to open a bank account in the UAE, simplifying fund management for its clients who can now utilize the local payment network.For Rain, this regulatory approval holds particular significance, as it addresses the hesitancy among local asset managers to engage with crypto firms lacking a domestic license. With this stamp of approval, these managers are expected to feel more at ease collaborating with Rain, thus expanding the potential demand from institutional investors.$500 million valuationRain has been gaining traction since its establishment in 2017 by Badawy and three other co-founders. Kleiner Perkins and Coinbase Ventures, two prominent investors from Silicon Valley, have backed the exchange. Both participated via a Series B funding round in January 2022 that saw Rain raise $110 million. Interestingly, Rain’s leading investor, Coinbase, also expressed an interest in developing a base in Abu Dhabi in recent months.There has been a lot of speculation in recent times with regard to where Binance, the world’s largest cryptocurrency exchange, is headquartered. Although still not certain, many believe that Abu Dhabi provided that base for the company. Meanwhile, US-headquartered cryptocurrency exchange Gemini, is working towards establishing a base in the UAE.Overcoming challenging market conditionsLast year’s Series B fundraise resulted in the company achieving a valuation of $500 million. The funds from that round were earmarked for the expansion of Rain’s operations throughout the region. Later that same year, the company laid off dozens of employees as bear market conditions within the digital assets space began to bite. As market conditions worsened later that year, the firm announced a fresh round of job cuts in September.The UAE has been positioning itself as a crypto-friendly destination, aiming to attract major players in the cryptocurrency industry. By enabling cryptocurrency payments in sectors like real estate and education, the UAE has spurred adoption rates and transaction volumes. Additionally, the country has been actively working on developing virtual asset regulations to accommodate new business opportunities in a highly competitive Gulf region.Rain’s recent licensing achievement signifies a significant milestone for the exchange and contributes to the UAE’s ongoing efforts to establish itself as a leading hub for the cryptocurrency sector.

news
Loading