Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Policy & Regulation·

Aug 22, 2023

China Furthers Efforts to Shape the Metaverse

China Furthers Efforts to Shape the MetaverseFindings by US political media outlet POLITICO suggest that Chinese authorities and state-owned companies are seeking to mold the metaverse in line with existing systems in China such as the country’s social credit scoring system.The concept of the metaverse entails a network of interconnected immersive virtual worlds powered by virtual reality, augmented reality, and simulations. Development in this area is centered around applications such as online gaming and virtual events.Photo by Hanson Lu on UnsplashDigital Identity SystemIn a report published on Sunday, POLITICO referenced recently drafted proposals put forward by China Mobile, a state-owned telecoms operator. The proposals outline a “Digital Identity System” for users within online virtual worlds and metaverses.These proposals recommend the use of “natural characteristics” and “social characteristics” within digital IDs, encompassing personal data such as occupation, “identifiable signs,” and other attributes. Moreover, they suggest storing this information “permanently” and sharing it with law enforcement to ensure order and safety within the virtual realm.Setting agreed benchmarks for emerging techThe proposals present a hypothetical scenario involving a disruptive user named Tom, who causes turmoil in the metaverse. The digital identity system, according to these proposals, would facilitate prompt identification and punishment by law enforcement.These discussions are occurring within the framework of the International Telecommunication Union (ITU), a United Nations (UN) agency responsible for establishing global technology standards. This strategy echoes China’s endeavor to set worldwide benchmarks for emerging technologies.The ITU, as a UN agency, holds significant sway in defining global telecommunications and technology infrastructure standards. Given that the US and China have quite different outlooks when it comes to technology governance, particularly the future development of the internet and related technologies, the ITU has become a means through which common ground can be found and differences resolved.Upcoming vote on proposalsChina Mobile’s proposals, presented during the ITU’s metaverse focus group meeting, are poised to be voted on during the next meeting in October in Geneva. The company is the largest mobile operator by subscriber base. Demonstrative of ongoing tensions that exist between the US and China, the company was delisted from the New York Stock Exchange in 2021 following a US executive order.Chinese organizations are reportedly submitting more proposals than their Western counterparts, demonstrating that China is very much taking a lead in metaverse development. It’s evident that there is a clear strategy for China to establish itself in furthering this technology.In May, Alibaba Cloud, a subsidiary of Chinese e-commerce giant Alibaba Group, entered into a partnership with layer one blockchain Avalanche to better enable businesses to deploy metaverses. Around the same time, an administrative body within China’s Henan Province established a $22 million dollar investment fund, focused on financing metaverse-related ventures.Later that month, the city of Zhengzhou announced a set of policy proposals designed to support the growth and development of metaverse companies in the region.Within the Chinese autonomous territory of Hong Kong too, there has been plenty of metaverse-related activity. Metaverse start-up Artifact Labs completed a funding round with a view towards expanding its operations. The city is home to Animoca Brands, a prominent player in metaverse-related development.

news
Policy & Regulation·

May 16, 2023

China’s Jiangsu Province Integrates Digital Yuan Into Education System

China’s Jiangsu Province Integrates Digital Yuan Into Education SystemChina has taken a raft of measures to try to build momentum in its digital currency, the digital yuan or e-CNY, with the latest step being an expansion into the education system in Jiangsu Province.Photo by Kimberly Farmer on UnsplashChina’s digital yuan is a legal tender fully backed by the People’s Bank of China (PBOC) and pegged to the renminbi. Unlike most cryptocurrencies, it is not decentralized or anonymous but is monitored by the PBOC. While adoption has been slow, China has been first off the blocks in developing a central bank digital currency (CBDC) to the point of some level of active use by comparison with its international peers.Enforcing a payments use caseJiangsu Province will attempt to establish the use of the digital yuan in its education system by the end of 2025, according to the Jiangsu Education Department. By the end of the year, students studying within the province are likely to be paying tuition fees using the digital currency. The pilot plan that Jiangsu administrators within the province’s Education Department have put together also aims to establish a means through which examination registration fees will be paid in digital yuan, while scholarships will be received in the digital currency.Zhou Maohua, a researcher with Beijing-headquartered Everbright Bank, told China Daily that it is imperative that more users are registered and go on to actively use the digital yuan to further its development.“The establishment of infrastructure for the digital yuan should be further accelerated,” said Maohua. “Its software and hardware must be upgraded to improve user experience. The security and reliability of the system must also be strengthened,” he added.Over the course of the past three months, four million digital yuan accounts have been opened by ordinary citizens within Jiangsu Province. Total e-CNY transactions have reached a level in excess of 200 billion yuan ($29 billion).Multiple initiativesIn April, the administrators of the city of Changshu, which is situated within Jiangsu Province, announced that it was gearing up to commence paying state employees within the city in digital yuan. Around the same time, officials within the city of Xuzhou, also located within Jiangsu Province, announced that they were in the process of publishing a pilot scheme which will set out a means for promoting China’s e-CNY digital currency.If that was enough in proving Jiangsu’s commitment to furthering the development of the e-CNY, another Jiangsu Province city, Suzhou, was one of the first locations in China to run a digital yuan pilot scheme in April 2020.Earlier this month, it was revealed that the French international banking group, BNP Paribas, had partnered with the BOC in enabling an initiative to promote the use of the digital yuan among its corporate clients.China is working with other countries on a Multiple CBDC Bridge project to explore the feasibility of cross-border fund transfers among different currencies. Launching its own CBDC for cross-border transfers may allow China to reduce its reliance on the US dollar and increase its influence over global trade and monetary policy.

news
Web3 & Enterprise·

Apr 30, 2025

Circle & local institutions advance stablecoin projects in Abu Dhabi

It’s proving to be a significant week for the further development of stablecoins in the United Arab Emirates (UAE) with leading U.S. dollar-backed stablecoin issuer Circle achieving in-principle licensing approval in Abu Dhabi, while a group of Abu Dhabi-based institutions have announced plans to launch a UAE dirham-pegged stablecoin.Photo by Yan Ma on UnsplashRegulatory licensingIn a press release published on April 29 Circle outlined that it had received in-principle approval to operate as a money services provider from the Financial Services Regulatory Authority (FSRA), the regulator for projects operating out of the Abu Dhabi Global Market (ADGM). ADGM is a free zone located within the UAE capital that has established its own regulatory framework for virtual asset-based businesses. The in-principle licensing award puts the company on a firm path towards the acquisition of a full Financial Services Permission (FSP) license. Circle Co-Founder Jeremy Allaire said that this in-principle licensing “advances our strategy to establish deep roots in markets embracing the onchain economy, creating new pathways for investment and innovation in the region.” On X, Ian Ballina, founder and CEO of Token Metrics, said that the licensing milestone signaled more global momentum for crypto adoption. Ballina pointed out that Circle’s USDC stablecoin is gaining traction as a result of the company’s strategy of partnering with local tech innovators. In addition, Circle announced a collaboration with Hub71, an Abu Dhabi-based global tech ecosystem. The objective of the partnership is to strengthen innovation within the digital assets space, with Circle joining Hub71’s digital assets ecosystem to offer expertise to a community of more than 500 tech startups and venture capital firms. Dirham stablecoin launchIn a separate development, ADQ, an Abu Dhabi-headquartered sovereign wealth fund, announced that it had joined with local partners to launch a UAE dirham-pegged stablecoin.  In its efforts to launch the stablecoin, ADQ has partnered with First Abu Dhabi Bank (FAB), the UAE’s largest bank, and conglomerate International Holding Company (IHC). The trio envisage that the stablecoin will be regulated by the UAE’s central bank and will be used “by citizens and consumers, businesses and institutions.” Once regulatory approval has been granted, the stablecoin will be hosted on the ADI blockchain, a network which was established by the Abu Dhabi-based non-profit ADI Foundation. ADQ CEO H.E. Mohamed Hassan Alsuwaidi described the launch of the stablecoin as “a pivotal step in our commitment to strengthening the UAE’s digital infrastructure ecosystem.” He added that the stablecoin will provide a secure, efficient and scalable solution for market participants as the UAE progresses towards an increasingly digital and connected economy. FAB CEO Hana Al Rostamani suggested that the new stablecoin would make a significant impact, with the potential to “revolutionize the use of trusted blockchain payments for UAE consumers and businesses.” Last December, the FSRA approved leading U.S. dollar stablecoin Tether (USDT) as an accepted virtual asset (AVA). Some weeks prior to that approval, Tether outlined that it planned to launch a dirham-backed stablecoin in collaboration with local partners. In October the country’s central bank issued in-principle approval to the promoters of another dirham-backed stablecoin, AE Coin.

news
Loading