Nexo gets on regulatory ladder in Dubai with initial approval

Singapore’s UniPass Plays Role in ERC-4337 Vulnerability FixSmart contract wallet provider UniPass and crypto infrastructure firm Fireblocks have successfully addressed a significant vulnerability in the Ethereum ecosystem.Photo by Nenad Novaković on UnsplashAccount abstraction vulnerabilityThis vulnerability, identified as the ERC-4337 account abstraction vulnerability, posed a critical security risk to hundreds of mainnet wallets. The joint effort between Fireblocks and UniPass was detailed in a blog post published to the Fireblocks website on Thursday.This vulnerability, if exploited, could have enabled a malicious actor to execute a complete takeover of the UniPass Wallet by manipulating Ethereum’s account abstraction process. The vulnerability represented a substantial threat to the security of smart contract wallets, as it could lead to unauthorized access and fund drainage.Improving user experienceAccount abstraction, as dealt with via ERC-4337, is a mechanism that introduces a novel way of processing transactions and interacting with smart contracts on the Ethereum blockchain. It allows for a more flexible and efficient handling of transactions, transcending the traditional distinction between externally owned accounts (EOAs) and contract accounts.EOAs are controlled by private keys and can initiate transactions, while contract accounts are governed by the code of a smart contract. When an EOA initiates a transaction with a contract account, it triggers the execution of the contract’s code. Account abstraction introduces the notion of abstracted accounts, which are not tied to a specific private key and can initiate transactions and interact with smart contracts, similar to EOAs.In the context of ERC-4337, an account executing an action relies on the EntryPoint contract to ensure that only signed transactions are executed. Typically, these accounts trust a single audited EntryPoint contract to validate user operations before executing commands. However, the vulnerability resided in the fact that a malicious or buggy EntryPoint contract could potentially skip the validation step and directly call the execution function, bypassing essential security measures.This vulnerability, identified by the two firms, had allowed attackers to seize control of UniPass wallets by replacing the trusted EntryPoint of the wallet. Once this takeover was completed, the attacker could access the wallet and drain its funds.It’s worth noting that the vulnerability posed a threat to several hundred users who had activated the ERC-4337 module in their wallets, making them susceptible to exploitation by any actor on the blockchain. Fortunately, the wallets affected by this vulnerability contained only small amounts of funds, and swift mitigation efforts were successful in preventing further harm.Company mergerEarlier this year, Singapore’s UniPass merged with Chinese wallet provider Keystone to form Account Labs, a company which has been incorporated in Singapore. At the time, Keystone founder Liu Lixin outlined that further developing account abstraction-derived products was the objective of the creation of Account Labs. He stated:“We are on the cusp of a Web3 Account Abstraction revolution. Together, we’ll drive rapid transformation, making the transition from Web2 to Web3 effortless for users. Our goal is to ensure everyone can securely and smoothly manage a decentralized account. We welcome partners to join us in advancing the Web3 account domain.”In furthering that objective, Account Labs announced on Thursday that it had raised $7.7 million in a funding round led by Amber Group, MixMarvel DAO Ventures, and Qiming Ventures.

Hong Kong Authorities Block Access to JPEX Amid Ongoing InvestigationDubai-headquartered crypto exchange JPEX has been under intense scrutiny in Hong Kong over the course of the past week due to issues experienced by Hong Kong users in withdrawing funds from the platform. In the most recent twist to the saga, authorities in the Chinese autonomous territory have now blocked access to the JPEX website and mobile application.Photo by Tao Yuan on UnsplashCutting off service accessThe firm published a statement on Wednesday, outlining this latest sanction, while protesting that the move had been unreasonable. It appears that the authorities requested local telecommunications providers to block access to the company’s online platform.The measure follows ongoing enforcement actions initiated by local law enforcement agencies, which have led to the detention of at least 11 individuals and the seizure of assets related to the case. The scandal has also had implications for the crypto sector as a whole, as local regulators are now looking once more at regulation and determining if there’s a need to tighten regulatory measures as a consequence of JPEX’s failings in Hong Kong.VPN recommendationIn its statement, JPEX stated:“Since September 13, 2023, the SFC [Securities and Futures Commission] has suddenly made a series of accusations against our platform’s operating model and promotional methods, which we vehemently resent as they were made without investigation or review.”In response to the blocking of their platform, JPEX has encouraged users to utilize virtual private network (VPN) services to access their services. The exchange sought to reassure its user base, stating: “Here, we strongly reiterate that, even in the face of such oppression and unfair treatment, our platform will continue to operate as usual. Users can log into our mobile application or operate on our web version using VPN applications like Surfshark.”The investigation into JPEX was initiated following warnings from the SFC regarding false or misleading statements made on social media by crypto influencers and the trading platform relative to a trading license application.On Sunday, JPEX announced that it had suspended certain operations and increased withdrawal fees due to an ongoing liquidity crisis, triggering an influx of complaints from users. As of Monday night, the police had received a total of 1,641 complaints, with claims amounting to approximately HK$1.19 billion ($152 million) in assets involved, as revealed during a police briefing on Tuesday.DAO Stakeholders Dividend PlanIn response to these developments, JPEX unveiled plans for a “DAO Stakeholders Dividend Plan.” Under this initiative, JPEX users will have the opportunity to convert their assets on the platform into DAO stakeholder dividends at a 1:1 ratio.The exchange intends to distribute 49% of the DAO Stakeholder dividends, with an estimated total value of approximately 400,000,000 USDT available for subscription and conversion. Additionally, JPEX plans to offer repurchase options one year and two years after the program’s launch.New users who subscribe to the DAO stakeholder dividends will enjoy double payouts, and they will not be required to bear all the operational responsibilities of the platform. This move is seen as an attempt by JPEX to address the concerns of its user base and navigate the challenges it currently faces.The situation surrounding JPEX remains fluid, with ongoing investigations and regulatory actions continuing to unfold.

Fingerlabs launches Web3 solution to help partners build membership NFTsFingerlabs, a subsidiary of digital marketing company FSN, has launched its participatory Web3 membership platform dubbed “Bling” in an effort to foray into the evolving digital landscape, according to an official press release.Photo by Choong Deng Xiang on UnsplashCustomizable characters and collaborative benefitsBling is an all-in-one marketing solution that allows businesses to conveniently create and manage NFTs that offer membership benefits. Users can create customizable characters on Favorlet, Fingerlabs’ NFT wallet and customer management service, using clothing or accessories called “parts.” These parts are linked to benefits offered by Fingerlabs’ partner firms, usually in the form of coupons that can be used both online and offline — thus touting the name “parts NFTs.” This can help boost brand exposure as Fingerlabs will be able to share its customer base with its partners.“Bling will prove to be a novel attempt in demonstrating that Web3 technology is not exclusive but for everyone to use. It will significantly reduce the risks associated with directly operating NFT projects and support any brand in effortlessly utilizing Web3 technology as an all-in-one solution for development and operations,” explained Fingerlabs CEO Kim Dong-hoon.Partner firms can construct their parts NFTs through Favorlet, and users can store theirs on their Favorlet wallet. Notably, parts NFTs can also be traded on NFT is Life Evolution (NILE), a decentralized autonomous organization (DAO) and NFT platform built on blockchain gaming publisher Wemade’s WEMIX3.0 mainnet.Bringing a classic to Web3Fingerlabs also announced that it is working with the K Museum of Contemporary Art, located in Seoul, as Bling’s first official partner. Users can customize their Bling characters with Great Gatsby-themed parts in line with the museum’s newest exhibit based on the classic novel. Passes to the exhibit will also be minted as NFTs. The K Museum of Contemporary Art previously worked with Fingerlabs in August on a project where exhibit poster cards were minted as reward-yielding NFTs.