Indian railways to explore NFT ticketing during Holi festival

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability FixSmart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.Photo by Nenad Novaković on UnsplashAccount abstraction vulnerabilityThis vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.Improving user experienceAccount abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.Company mergerEarlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

U.S. authorities seize crypto tied to Asian ‘pig butchering’ scamThe United States government has taken control of digital currency valued at approximately half a million dollars from an account linked to a Chinese individual implicated in a Reuters investigation into a crypto-investment fraud originating from Southeast Asia.Photo by Growtika on Unsplash‘Pig butchering’According to Reuters, U.S. officials have disclosed that the seized assets are connected to a crypto-investment scam known as “pig butchering,” where fraudsters manipulate unsuspecting individuals they encounter online, convincing them to invest in fraudulent crypto schemes.The unsuspecting scam victim (the pig) is conned by scammers into handing over money with the promise of an outsized return. Once funds have been handed over, the vast majority of victims are unable to recover their money.According to a document filed by U.S. authorities in federal court in Massachusetts, the U.S. Secret Service confiscated the crypto in June from an account registered to Wang Yicheng. At the time of the seizure, the digital currency was valued at around $500,000. The funds were traced back to a victim in Massachusetts who had initially fallen prey to the scam.In a recent Reuters article, Wang was identified as a businessman who cultivated relationships with members of Thailand’s law enforcement and political elite while serving as the vice president of a Chinese trade group based in Bangkok. The report outlined that a crypto account in Wang’s name had received over $90 million in recent years, with at least $9.1 million linked to a crypto wallet associated with pig-butchering scams, as reported by U.S. blockchain analysis firm TRM Labs.Multi-million dollar scamsOne case highlighted in the report involved a California man who was scammed out of approximately $2.7 million, funds that were channeled into the account in Wang’s name. Another example cited in the U.S. court filing detailed a resident of Cambridge, Massachusetts, who was allegedly defrauded of about $478,000 worth of crypto, which ended up in two crypto accounts, one of which belonged to Wang.The U.S. court filing, part of a civil forfeiture action, seeks court approval to take possession of assets linked to the alleged crime. While no criminal charges have been filed, Acting U.S. Attorney Joshua Levy emphasized the use of civil forfeitures to recover funds stolen through crypto fraud schemes, highlighting law enforcement’s adaptability in the face of cryptocurrency transactions’ seemingly elusive nature.Crypto scammers sanctionedIn a related development, authorities in the United Kingdom reported on Friday that individuals operating pig butchering crypto scams in Myanmar, Cambodia and Laos had been sanctioned, in a move coordinated with their counterparts in the U.S. and Canada, alongside the United Nations Human Rights Organization.Many of these cases are understood to involve human trafficking, where individuals are illegally detained and forced to work on pig butchering crypto scams.

Kandle Secures Funding for Platform DevelopmentSingapore-based crypto fantasy GameFi startup Kandle has recently secured $1.7 million in a seed funding round, with Saama Capital, a venture capital firm that invests in early and growth stage tech sector companies, leading the investment.Other participants in the funding round included PointOne Capital, Cloud Capital, Good Capital, Founder’s Room, Seeders Fund, and Sumit Gupta, CEO of crypto investment platform CoinDCX.The GameFi concept is an innovative fusion of blockchain technology, gaming, and decentralized finance, allowing players to earn cryptocurrency and non-fungible tokens (NFTs) while playing games on the platform. Additionally, GameFi enables the transfer of in-game items to the virtual world, enabling trade on NFT marketplaces and crypto exchanges.Photo by Towfiqu barbhuiya on UnsplashExpansion plansKandle stands out by offering fantasy games that incorporate crypto tokens, where players compete to win various rewards. Already gaining traction in Southeast Asian countries like Indonesia and Vietnam, as well as in burgeoning markets such as Nigeria and India, Kandle has ambitious plans to expand its footprint across Asia and North America.As part of its efforts to realize that expansion, funding is being used to build out the Kandle platform further, expanding its user base into the bargain. Founder Jaideep Yadav expressed enthusiasm about the potential of gaming and crypto coming together, positioning Kandle at the forefront of this evolving landscape.Yadav stated: “There is a massive opportunity at the intersection of gaming and crypto, and we’re excited to be at the forefront of this evolution in crypto fantasy gaming. Super grateful for the unwavering support of our investors as we forge ahead in bringing the vision of Kandle to fruition. “Project roadmapLooking ahead, Kandle aims to unveil its project roadmap, which will include token issuance, token utility, and a play-and-win model designed to reimagine the play-to-earn ecosystem. Notably, Kandle has taken a unique approach by prioritizing the development of a fully functioning, sustainable gaming product based on sound gaming principles rather than merely focusing on project tokens. The team plans to integrate smart contracts to ensure transparency, security, and fairness in the gaming experience.Ash Lilani, the Managing Partner at Saama Capital, commented on the importance of making the crypto industry safer for the next wave of users. He praised Kandle’s gamified approach for providing a secure and unique way for users to engage with crypto without taking direct exposure to any specific coins.Kandle’s funding success signifies the increasing interest and investment in the GameFi space, which merges the excitement of gaming with the possibilities offered by blockchain and cryptocurrencies. News of the investment comes within the same time frame as an announcement by Sky Mavis, the team behind Axie Infinity, which is also Singapore-headquartered, which sees it partner with CyberKongz, an Ethereum-based non-fungible token collection.The development of blockchain gaming has not progressed in a neat straight line. It’s been imperfect but ongoing activity in the sector suggests that ultimately, GameFi start-ups will continue to evolve until such time as a mass market breakthrough is made in gaming.