Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Policy & Regulation·

Sep 14, 2023

Asian Countries Dominate Chainalysis’ 2023 Global Crypto Adoption Index

Asian Countries Dominate Chainalysis’ 2023 Global Crypto Adoption IndexBlockchain analytics firm Chainalysis has just unveiled an excerpt of its “2023 Global Crypto Adoption Index,” revealing that Asian nations are top of the class in terms of the pace of crypto adoption.The report extract published to the Chainalysis website brings into focus the remarkable strides made by a number of Asian countries, emerging as the front-runners in driving grassroots cryptocurrency adoption.The index showcases the dominance of regions like Central and South Asia, along with the broader Oceania regions. Astonishingly, six of the top 10 countries on the index hail from this part of the world.Photo by Louis Hansel on UnsplashIndia takes top spotIndia, in particular, shines as the torchbearer of cryptocurrency adoption in the region, securing its position as the largest cryptocurrency market. It not only leads the way in grassroots adoption but has also ascended to become the second-largest crypto market globally in terms of raw estimated transaction volume, eclipsing even some major global economies.It’s interesting that India should find itself in this position when you consider that a number of measures have been taken that could have been expected to dampen adoption. The Indian authorities introduced a 30% tax on capital gains earned through the sale of digital assets, as well as a 1% tax on Tax Deducted at Source (TDS) for all crypto transactions.Last month, Indian crypto exchange CoinDCX specifically cited these tax burdens, combined with the recent bear market, as being contributing factors in its decision to cut its workforce by 12%. Another excerpt of the Chainalysis report explicitly refers to these measures and their potential to retard cryptocurrency use.Adoption despite bear marketDespite a temporary downturn in worldwide grassroots cryptocurrency adoption, Chainalysis’ research finds that these developing Asian nations, have not only weathered the storm brought about by the recent bear market but have thrived, with their total grassroots adoption surpassing the levels of Q3 2020, just before the most recent bull market.Other countries featuring in the top ten include Vietnam (third), the Philippines (sixth), Indonesia (seventh), Pakistan (eighth), and Thailand (tenth). China, Turkey, Bangladesh, and Japan then feature within the top twenty.This data holds promise for the cryptocurrency landscape in the Asian region. Many of these nations are lower middle-income (LMI) countries that typically exhibit burgeoning industries and populations, collectively representing more than 40% of the global population. Chainalysis suggests that if these countries shape the future, cryptocurrencies are poised to play an indispensable role in shaping the global financial ecosystem.Institutional adoptionThe excerpt from the report also hints at the burgeoning trend of institutional adoption in high-income countries, even in the face of a lingering bear market. This suggests a potential dual-directional adoption scenario, where cryptocurrencies cater to the needs of users from both affluent and developing nations, bringing together a diverse spectrum of economic backgrounds.The report takes an optimistic outlook, stating:“Grassroots crypto adoption isn’t about which countries have the highest raw transaction volumes. . . . Instead, we want to highlight the countries where average, everyday people are embracing crypto the most.”“If LMI countries are the future, then the data indicates that crypto is going to be a big part of that future.”

news
Policy & Regulation·

Dec 05, 2023

Terraform Labs fails to halt class action lawsuit

Terraform Labs fails to halt class action lawsuitThe High Court in Singapore has dismissed an appeal filed by Terraform Labs and its co-founders, marking a significant step forward for the plaintiffs behind a class action initiated against the company.That’s according to a report published by Singaporean publication, the Business Times, on Thursday. The legal development follows the collapse of TerraUSD (UST) tokens in May of 2022, resulting in the loss of billions of dollars in market value. The collapse, in turn, has led to several lawsuits against Terraform, its founders and affiliated entities, with those court actions playing out in courtrooms in Singapore, South Korea, Montenegro and the United States.Photo by Wesley Tingey on UnsplashFraudulent misrepresentation allegedThe class-action suit, initiated in September 2022 by Julian Moreno Beltran and Douglas Gan on behalf of 375 others, alleges fraudulent misrepresentation by Terraform, Co-Founders Do Kwon and Nikolaos Alexandros Platias and the Luna Foundation Guard (LFG). The claimants argue that these misrepresentations induced them to purchase UST, stake the tokens and retain them as their value plummeted.UST had been designed to be pegged to the U.S. dollar with a 1:1 ratio. However, flaws in the tokenomics behind that digital asset meant that it faced a loss of confidence in May 2022, trading at around $0.05 when the court’s decision was released. The claimants collectively suffered losses of nearly $57 million.Terms of use cited in attempt to dismissTerraform attempted to have the lawsuit dismissed by invoking an arbitration clause in its website’s terms of use, asserting that users had waived their rights to a jury trial or participation in a class action. However, the Assistant Registrar (AR) rejected this application, stating that the defendants failed to establish an arbitration agreement.The AR highlighted that the terms of use were inconspicuous on the website, and there was insufficient effort to draw users’ attention to those clauses. Terraform, Kwon and associated entities appealed this decision, which was heard by Justice Hri Kumar Nair on Sept. 25.Despite establishing a prima facie case for an arbitration agreement, the court ruled that Terraform’s participation in the legal proceedings, including filing a defense and counterclaim, meant it could no longer seek a stay in favor of arbitration.Multiple actionsIt’s a busy time for all stakeholders relative to the Terraform collapse. Playing out within the same timeframe is a lawsuit in the United States taken by the Securities and Exchange Commission (SEC) against Terraform and Do Kwon, where the SEC claims that crypto asset securities fraud has been carried out.The latest installments in that saga in recent weeks have seen both parties file to seek summary judgment. Last week, a court in New York approved the confidential treatment of specific documentation which had been produced by Jump Crypto, a division of proprietary trading firm Jump Trading.There are also criminal actions underway. In a South Korean court in October, Terraform Labs Co-Founder Daniel Shin denied wrongdoing in the Terra/Luna collapse. Meanwhile, a court in Montenegro has approved the extradition of Do Kwon, with a final decision to be made shortly as regards whether he should be extradited to the United States or South Korea.

news
Web3 & Enterprise·

Nov 04, 2023

Komainu and Crypto Garage partner to bring about institutional crypto adoption

Komainu and Crypto Garage partner to bring about institutional crypto adoptionKomainu, the crypto custodian and portfolio company of Japanese financial services conglomerate Nomura, has partnered with Crypto Garage to work towards enabling institutional crypto adoption in Japan.The digital asset custodian made the announcement of the partnership in a press release published to its website on Wednesday. The collaboration builds upon the investment by Crypto Garage's parent company, Digital Garage, in Komainu, aimed at fortifying Komainu’s market presence in Japan. The investment also unites Digital Garage with other prominent Japanese stakeholders in Komainu, including Laser Digital, the digital asset subsidiary of Nomura, alongside the Nomura Research Institute.Photo by Agathe on UnsplashCapitalizing on growing institutional interestCrypto Garage, a company that provides custody, over-the-counter (OTC) trading and settlement services in both the Japanese and international markets, has seen a growing interest from Japanese institutions in digital assets. This has spurred Komainu and Crypto Garage to develop advanced digital asset custody solutions tailored specifically to meet institutional demands, with a strong focus on security and compliance.The partnership harnesses the diverse expertise of both entities, laying the foundation for what both firms hope will be a robust and dependable digital asset management platform throughout the lifecycle of these assets. Speaking to that notion, Crypto Garage CEO Masahito Okuma suggested that the firms share a common vision, adding:“By combining forces, we will leverage our collective expertise to deliver solutions that satisfy the unique needs of Japanese institutions.”Nicolas Bertrand, CEO of Komainu, expressed his optimism regarding the collaboration and the Japanese market, stating:“Japan is a key jurisdiction for digital assets and continues to be an important part of our plans to be the most coveted institutional-grade custodian globally.”This partnership represents a significant leap forward in advancing the institutional crypto landscape in Japan. With the support of established financial entities such as Nomura Holdings Inc. and Digital Garage Inc., this venture is poised to instill confidence among Japanese institutions by demonstrating a strong commitment from the traditional financial sector.This collaboration not only demonstrates the evolving dynamics of institutional crypto services in Japan but also underscores the broader acceptance and integration of digital asset management solutions within traditional financial frameworks. It signifies a matured understanding and approach to digital asset custody and management.Komainu, established as a joint venture between Nomura, CoinShares and Ledger, operates in full compliance with regulatory standards, offering a fusion of traditional financial services with state-of-the-art security measures for institutional custody in the digital age. Earlier this year, the firm entered into a partnership with crypto exchange platform OKX, providing the company with digital asset custody services.In August, Komainu secured a trading license from the Virtual Assets Regulatory Authority (VARA) in Dubai. Meanwhile, Crypto Garage extends its services to crypto asset businesses, both within Japan and internationally, covering custody, over-the-counter (OTC) trading and settlement services for digital assets.

news
Loading