Hong Kong advances tokenization as institutions continue building amid market pullback

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability FixSmart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.Photo by Nenad Novaković on UnsplashAccount abstraction vulnerabilityThis vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.Improving user experienceAccount abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.Company mergerEarlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

Elliptic and CODE join forces to propel crypto compliance in KoreaElliptic, a global blockchain analytics and crypto compliance solutions provider, has partnered with CODE, a Seoul-based Travel Rule solution provider, as part of efforts to expand its operations into the Korean market. Under this agreement, the two companies aim to actively support virtual asset service providers (VASPs) in South Korea in their attempts to adapt to the evolving international regulatory landscape for anti-money laundering (AML) and the crypto Travel Rule.Photo by NordWood Themes on UnsplashCrypto Travel RuleThe Travel Rule refers to the Financial Action Task Force’s (FATF) Recommendation #16, which outlines that VASPs must share certain personal information about customers — including names and account numbers — when facilitating crypto transactions that exceed a certain amount.Empowering VASPs through risk mitigationElliptic and CODE will work together on comprehensive regulatory technology-based (RegTech) solutions to enable VASPs to identify AML and Counter Financing of Terrorism (CFT) risks among virtual asset transactions, ultimately leading the sustainable growth of the crypto asset industry. In particular, CODE will be able to leverage Elliptic’s services to ensure compliance with Travel Rule regulations. Elliptic offers solutions like wallet screening, transaction monitoring, crypto investigations and VASP screening for big names like Coinbase, Binance and BitGo, as well as law enforcement agencies.“This partnership with Elliptic allows us to expand our compliance services beyond Travel Rule-related solutions for VASPs. Elliptic’s advanced technology and expertise will help our corporate members achieve regulatory compliance more efficiently, contributing greatly to enhancing transparency and security throughout the larger virtual asset industry,” said CODE CEO Lee Sung-mi.

Polymesh’s APAC Digital Asset Regulation Report Highlights ChallengesThe project team behind Polymesh, an institutional-grade permissioned blockchain built specifically for regulated assets, released a report on digital asset regulation within the Asia Pacific (APAC) region on Tuesday, highlighting several challenges that regulators are attempting to overcome.In a press release, the company outlined that the report covers recent regulatory developments in South Korea, Singapore, Hong Kong, and the broader APAC region.Photo by Jéan Béller on UnsplashProgressive regulatory effortsRegulators within the APAC region are currently striving to introduce legislation for digital assets, while several centers within the region are vying to establish themselves as hubs for digital asset-related business.The report explores the individual efforts of regulators in various APAC nations as they work towards crafting regulatory frameworks tailored to their jurisdictions. Those efforts encompass implementation, investigation, and enforcement of legislation in a borderless industry.Regulators in South Korea, Singapore, and Hong Kong have all embarked on formulating rules for emerging asset categories, albeit using different terminologies such as “digital assets,” “digital payment tokens,” and “virtual assets.” Their focus lies in striking a balance between consumer protection, market integrity, and industry development.Additionally, all three regulators adhere to the principle of “same activity, same regulations, same risks” when it comes to tokenized securities. They argue that regulatory requirements do not significantly differ solely because a security is in tokenized form. Each state has been actively engaged in local and global activities surrounding security tokens, including state involvement in the advancement of security token technology and cross-border transactions.Main findingsThe report’s main findings emphasize that while regulators in the APAC region are making strides in introducing digital asset legislation, the road ahead will not be without challenges.Legislating a cross-border industry poses difficulties that necessitate harmonization to foster a robust and interconnected ecosystem. Digital assets originating in Asia can be traded globally and vice versa. Merely identifying the asset’s place of origin is no longer sufficient.Although the report delves into the efforts of individual regulators, it emphasizes the need for long-term collaboration to establish a unified vision and practical implementation of regulations for this borderless phenomenon.Regulatory challengesThe regulatory challenges faced by South Korea, Singapore, and Hong Kong in driving the growth of digital assets in the APAC region are multifaceted. They include the intricacies of legislating an inherently cross-border industry. In turn, that can lead to the potential violation of legislation from other jurisdictions.The lack of harmonization among different jurisdictions, and variations in regulatory approaches among the three regulators are likely to be problematic. Furthermore, there are push-pull dynamics between the industry and regulators, with even the regulators themselves not always in agreement.However, despite these challenges, all three regulators have initiated the formulation of rules for new asset categories, with a strong emphasis on safeguarding consumer interests, maintaining market integrity, and fostering industry development.