China disrupts massive crypto-related laundering operation

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability FixSmart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.Photo by Nenad Novaković on UnsplashAccount abstraction vulnerabilityThis vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.Improving user experienceAccount abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.Company mergerEarlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

MANTRA, a real-world asset (RWA) layer one blockchain built on Cosmos, recently outlined its vision for the on-chain financial ecosystem, outlining that it plans to acquire licensing in the Middle East and Asia as part of its efforts to expand. In a press release published on Chainwire on March 14, the company outlined that it has applied for licensing in the United Arab Emirates (UAE) in an effort to pave the way for MANTRA to target a global clientele who want to harness the potential of RWA asset tokenization. Issuing and trading tokenized RWAsAt the core of the Hong Kong-headquartered project’s offering lies its layer one blockchain, aptly named MANTRA Chain. The network is designed to streamline the issuance and trading of tokenized RWAs. Having established this technological product base, the company is now on a mission to onboard financial institutions and commercial entities with an interest in asset tokenization. With teams stationed in Hong Kong and the UAE, MANTRA has honed a full understanding of the shifting regulatory landscapes in pivotal regions. By securing its inaugural financial licenses in the UAE, MANTRA is aiming to take a slice of market share in the swiftly evolving RWA sector across the Middle East and Asia. The overarching goal for 2024 is to tokenize a diverse spectrum of assets, spanning real estate, private market funds, equity, art and treasuries.Photo by Sigmund on UnsplashIn an X social media post, MANTRA Founder and CEO John Patrick Mullin outlined that the company is already engaging with institutions and partners in the private sector. Mullin stated: “MANTRA is actively collaborating with real-world institutions and partners, including real estate, private market funds, private equity, the art sector, and treasuries, among others, to help bring these traditional asset classes onchain.” Mullin claims that the current crypto market capitalization of around $2 trillion is just a drop in the ocean by comparison with the potential that exists in the tokenization of RWAs and in unlocking the RWA economy. Hong Kong licensingAlongside the Middle East, Asia is the other target market for the company. Mullin suggested that Asian countries are already preparing for this fundamental shift, having developed RWA regulations. Last November, it emerged that Hong Kong was setting out a regulatory roadmap in respect of RWA tokenization. In February 2023 the Chinese autonomous territory achieved a first-of-its-kind tokenized green bond issuance.With that, the company’s home base of Hong Kong will also be central to its efforts to acquire relevant licensing. In recent weeks, MANTRA claims to have made significant progress in decentralizing its network, garnering validator support on a more broadly distributed basis. The project is expected to launch its final testnet, dubbed “Hongbai,” shortly. MANTRA is aiming to emerge as the pioneer RWA layer one blockchain with the capability to ensure real-world regulatory compliance. By expediting the adoption of tokenized RWAs, the project suggests that there’s an RWA economy value unlock potential of $16 trillion with its regulatory-ready blockchain being positioned to benefit from that. The network is gearing to offer a compliant framework, so that traditional finance (TradFi) companies can seamlessly transition to and harness asset tokenization and blockchain solutions, propelling global RWA expansion. 

It’s proving to be a significant week for the further development of stablecoins in the United Arab Emirates (UAE) with leading U.S. dollar-backed stablecoin issuer Circle achieving in-principle licensing approval in Abu Dhabi, while a group of Abu Dhabi-based institutions have announced plans to launch a UAE dirham-pegged stablecoin.Photo by Yan Ma on UnsplashRegulatory licensingIn a press release published on April 29 Circle outlined that it had received in-principle approval to operate as a money services provider from the Financial Services Regulatory Authority (FSRA), the regulator for projects operating out of the Abu Dhabi Global Market (ADGM). ADGM is a free zone located within the UAE capital that has established its own regulatory framework for virtual asset-based businesses. The in-principle licensing award puts the company on a firm path towards the acquisition of a full Financial Services Permission (FSP) license. Circle Co-Founder Jeremy Allaire said that this in-principle licensing “advances our strategy to establish deep roots in markets embracing the onchain economy, creating new pathways for investment and innovation in the region.” On X, Ian Ballina, founder and CEO of Token Metrics, said that the licensing milestone signaled more global momentum for crypto adoption. Ballina pointed out that Circle’s USDC stablecoin is gaining traction as a result of the company’s strategy of partnering with local tech innovators. In addition, Circle announced a collaboration with Hub71, an Abu Dhabi-based global tech ecosystem. The objective of the partnership is to strengthen innovation within the digital assets space, with Circle joining Hub71’s digital assets ecosystem to offer expertise to a community of more than 500 tech startups and venture capital firms. Dirham stablecoin launchIn a separate development, ADQ, an Abu Dhabi-headquartered sovereign wealth fund, announced that it had joined with local partners to launch a UAE dirham-pegged stablecoin.  In its efforts to launch the stablecoin, ADQ has partnered with First Abu Dhabi Bank (FAB), the UAE’s largest bank, and conglomerate International Holding Company (IHC). The trio envisage that the stablecoin will be regulated by the UAE’s central bank and will be used “by citizens and consumers, businesses and institutions.” Once regulatory approval has been granted, the stablecoin will be hosted on the ADI blockchain, a network which was established by the Abu Dhabi-based non-profit ADI Foundation. ADQ CEO H.E. Mohamed Hassan Alsuwaidi described the launch of the stablecoin as “a pivotal step in our commitment to strengthening the UAE’s digital infrastructure ecosystem.” He added that the stablecoin will provide a secure, efficient and scalable solution for market participants as the UAE progresses towards an increasingly digital and connected economy. FAB CEO Hana Al Rostamani suggested that the new stablecoin would make a significant impact, with the potential to “revolutionize the use of trusted blockchain payments for UAE consumers and businesses.” Last December, the FSRA approved leading U.S. dollar stablecoin Tether (USDT) as an accepted virtual asset (AVA). Some weeks prior to that approval, Tether outlined that it planned to launch a dirham-backed stablecoin in collaboration with local partners. In October the country’s central bank issued in-principle approval to the promoters of another dirham-backed stablecoin, AE Coin.