Top

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability Fix

Policy & Regulation·October 28, 2023, 1:31 AM

Smart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.

Photo by Nenad Novaković on Unsplash

 

Account abstraction vulnerability

This vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.

This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.

 

Improving user experience

Account abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.

EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.

In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.

This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.

It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.

 

Company merger

Earlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:

“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”

In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

More to Read
View All
Web3 & Enterprise·

Jan 05, 2024

OKX Wallet now supports WEMIX3.0 mainnet

Seychelles-based crypto exchange OKX’s Web3 wallet service, OKX Wallet, has begun supporting Wemade’s blockchain network WEMIX3.0, according to an announcement on Friday (KST). This development will allow OKX Wallet holders to directly manage the crypto assets that they hold from the WEMIX3.0 ecosystem. Photo by GuerrillaBuzz on UnsplashSeamless access and versatile Web3 servicesOKX Wallet notably supports over 70 networks and 3,000 cryptocurrencies and provides other wide-ranging Web3 services like NFT trading, crypto swaps and a decentralized finance (DeFi) platform. In particular, it also has a hassle-free recovery process for account access that employs Multi-Party Computation (MPC) technology, effectively eliminating the need for traditional recovery methods like seed phrases.  OKX Wallet and WEMIX3.0 also vowed to work on more integrations and joint campaigns in the future to round up a larger global user base and lead the era of Web3.  A rising force in cryptoIn other news, WEMIX3.0’s governance token, WEMIX, has been making a significant impact in the crypto industry. The asset ranked ninth in CoinMarketCap’s list of largest blockchains in crypto ranked by total value locked (TVL) last month, and it possessed the largest constituent weight in terms of market capitalization in the gaming sector in the latest Crypto Sector Indices released by Sygnum, a global digital asset banking group headquartered in Switzerland and Singapore. 

news
Policy & Regulation·

Aug 07, 2023

The Need to Distinguish Between Security and Non-Security Virtual Assets

The Need to Distinguish Between Security and Non-Security Virtual AssetsWith the recent enactment of the Virtual Asset User Protection Bill in South Korea, there is a need to lay out criteria for determining whether virtual assets qualify as securities, says Kim Ja-bong, a senior research fellow at the Korea Institute of Finance, in his report titled “The Implications of Determining Which Virtual Assets Constitute Securities and Investor Protection” released on Saturday.Photo by Shubham Dhage on UnsplashThe implications of the Virtual Asset User Protection ActThe Virtual Asset User Protection Act — which will take effect in July of next year — aims to protect customer assets, establish regulations against unfair trading practices, and enforce penalties. Notably, it will target virtual assets that are not securities, deeming it necessary for regulators to determine if virtual assets qualify as securities or not in order to enforce the bill. Assets with characteristics of securities will fall under the jurisdiction of the Capital Markets Act.Therefore, if the Virtual Asset User Protection Act does not provide sufficient investor protection, issuers may be incentivized to issue non-security assets rather than security assets to avoid the regulations of the Capital Markets Act. This further necessitates the act of distinguishing between virtual assets that are securities versus those that are not.Determining if a virtual asset is a security or notThere are two approaches to do this, according to Kim: the passive approach, which avoids considering a virtual asset as a security whenever possible, and the active approach, which treats a virtual asset as a security whenever applicable.He argues that it is better to focus on whether an investment contract qualifies as a security if it is considered an investment contract, rather than simply selecting a specific approach.Furthermore, the nature of virtual assets renders them unbound by national borders, so it is necessary to establish assessment criteria that correspond with international standards, such as those used in the US and Europe.This is especially important because if the criteria differ from international standards, there is a risk of domestic investors suffering damages due to an issuer’s pursuit of regulatory arbitrage between countries.Equitable recognition and potential for security tokensAccording to Kim, the importance of determining whether virtual assets are securities lies in ensuring that security tokens receive the same recognition and trading treatment as traditional securities such as stocks. With such a measure, security token offerings can serve as an efficient and reliable method for raising funds. Although there may be concerns that such a regulation may hinder the development of virtual assets, it may well be an opportunity for security tokens to be qualified and trusted as high-quality financial instruments just like existing securities, Kim claims.Even for virtual assets that are not considered securities, there are many types of assets that are financial in nature, such as e-money tokens — therefore, it is necessary to actively protect investors in non-security virtual assets through financial regulations such as reinforcing disclosure obligations, which is being done in the EU through the Markets in Crypto-Assets Regulation (MiCA).Empowering regulators for enhanced investor protection and market integrityKim underscored that investor protection and healthy growth of the virtual asset market are made possible mainly through expanding regulators’ authority to protect economic interests and prevent damages. The author also suggested institutional reforms that grant regulators substantial authority, which would enhance their ability to protect investors effectively and provide compensation for damages.He added that regulators should also have the authority to enforce liability for damages or impose civil penalties for unfair trading practices conducted using classified information.

news
Markets·

Nov 12, 2025

Crypto policy and profitability in focus as market faces global crosswinds

Amid the ongoing cryptocurrency market slowdown, a South Korean analyst said a rebound will hinge on effective policy measures and sustainable business models.Photo by Kanchanara on UnsplashAnalyst urges policy and profitabilityAccording to an analysis by iM Securities researcher Yang Hyun-kyung, cited by local outlet Etoday, the current downturn stems from several factors: a liquidity crunch in short-term funding markets, a strengthening U.S. dollar, rising risk aversion, and a prevailing narrative of a cyclical correction. Yang noted that a strong dollar typically drains market momentum, as tighter global liquidity prompts investors to deleverage and reduce exposure to risk assets. He added that growing uncertainty over potential U.S. rate cuts in December has further fueled risk aversion among institutional investors, putting selling pressure on both major cryptocurrencies and altcoins. While the expected resolution of the U.S. government shutdown may create a more favorable environment for a modest technical rebound, Yang argued that the crypto sector still needs to develop profitable business models and gain growth momentum through supportive policy measures. Brokerage frames crypto as diversifierDespite the current headwinds, another Korean brokerage firm released a quarterly report framing digital tokens as an emerging alternative asset class. According to Etoday, Hanwha Investment & Securities CEO Jang Byung-ho wrote in the report that the primary goal of retail investment is to preserve purchasing power. He drew a parallel to the U.S. market in the 1980s, when bond investors would have seen their returns erode had they failed to recognize equities as a viable investment vehicle. Citing that lesson, Jang suggested investors consider digital assets as a new pillar for portfolio diversification. Diverging approaches from global central banksThese evolving viewpoints on crypto come against a complex global macroeconomic backdrop. From one perspective, the People’s Bank of China (PBOC) has begun quantitative easing (QE). Otavio Costa, a macro strategist at Crescat Capital, shared a chart on X showing that the value of the PBOC’s balance sheet assets is on track to surpass that of the U.S. Federal Reserve. Costa predicted the Fed would soon follow suit, stressing that investors are underexposed to hard assets. This potential easing contrasts with speculation that the Bank of Japan (BOJ) may raise interest rates next month. One BOJ board member noted at a recent policy meeting that most conditions for a hike have already been met and added that a move is likely once wage negotiations scheduled for spring point to sustained pay growth, as long as the global economy avoids major disruptions. These diverging policy directions have mixed implications for the crypto market. Typically, dovish measures like QE are seen as supportive, as increased liquidity tends to boost risk appetite. Rate hikes, by contrast, withdraw liquidity from the system, limiting the upside for risk assets like digital tokens. As economic conditions evolve and the industry adapts, investors will be watching closely to see how these shifts shape the market’s next moves. 

news
Loading